A recent case involving the malicious use of language models has once again put Claude at the center of the debate over security, disinformation, and influence operations geopolitically linked to Iran. The topic has gained traction on social media and cybersecurity forums, but it is important to rigorously separate what is confirmed by public evidence from what remains attribution under investigation.

What is confirmed

The strongest evidence at this point comes from the security report published by Anthropic, titled *Detecting and Countering Malicious Uses of Claude* (March 2025). In it, the company describes detecting and blocking an “influence-as-a-service” operation that used Claude to orchestrate more than a hundred automated accounts on X/Twitter and Facebook. According to the report, the model was not used only to write text: it was also used to decide tactical actions for bot accounts—when to comment, share, “like,” or ignore posts—according to political objectives defined by the operators.

Anthropic also reported that this network interacted with tens of thousands of authentic accounts, in several languages and countries, and that the company suspended the accounts associated with the activity. In addition, the same report clarifies that they did not observe evidence of the content generated by this operation going massively viral; the strategy appeared geared toward sustained, low-visibility influence rather than spikes in reach.

That point is important: the report does confirm an operational use of generative AI to coordinate political bot activity, but it also qualifies the observed impact.

What is reported, but not confirmed

The most sensitive element of the case is state attribution. In its own text, Anthropic indicates that the campaign's narratives were “consistent with what would be expected from state-affiliated campaigns,” but it also explicitly states that it did not confirm that attribution. In other words: there is a signal of behavior consistent with a state actor, but no definitive public attribution.

In parallel, reports from other AI labs have indeed documented Iranian activity in the digital influence ecosystem. For example, OpenAI, in its publication *Disrupting deceptive uses of AI by covert influence operations* (May 2024), described the disruption of an operation associated with the International Union of Virtual Media (IUVM), identified in previous reports as an Iran-linked actor, which used models to generate and translate articles and headlines. That precedent strengthens the hypothesis that Iranian actors have tried to incorporate generative AI into information campaigns.

Even so, that precedent does not by itself prove that the operation detected by Anthropic is the same organization, or that there is direct coordination between the cases. In intelligence terms, we are talking about convergent patterns, not confirmed identity.

Why this case matters for AI in security and defense

Beyond the specific actor, the case marks a technical shift: moving from the use of AI to “create content” to the use of AI as a semi-autonomous orchestration engine. When a model helps coordinate the timing, tone, and responses of networks of accounts, the operation gains speed, multilingual scale, and adaptability.

That leap has direct implications for national security scenarios and, at the extreme, for hybrid or military-information conflict environments:

1. Greater operational density with fewer personnel. Small teams can manage campaigns that previously required more human analysts.
2. Shorter reaction cycles. AI reduces the time between a real event and a manipulated narrative.
3. Difficulty of attribution. Content generated by homogeneous models can dilute traditional linguistic signatures.
4. Escalation through automation. Combining bots, multimodal generation, and real-time analysis increases the risk of persistent campaigns of social attrition.

What to expect in the coming months

We are likely to see three simultaneous trends. First, more reports of “agentic abuse” of AI by criminal and political actors. Second, more automated defensive responses from labs, platforms, and threat intelligence teams, including dedicated classifiers for detecting prompt chains and coordinated behavior. Third, greater regulatory pressure for model providers to publish periodic abuse reports with comparable metrics.

The strategic reading is clear: this is not proof of “all-powerful AI,” but it is evidence that models already function as accelerators of complex influence operations. In the Iran-linked case, analytical caution requires holding two ideas at once: real abuse was documented and blocked; final state attribution, at least publicly, remains unresolved.

Sources

- Anthropic — Detecting and Countering Malicious Uses of Claude (March 2025)
- OpenAI — Disrupting deceptive uses of AI by covert influence operations (May 2024)