Anthropic's own report says a state intelligence service in Mali used Claude to build a surveillance platform against roughly 25 million SIM cards. A French-speaking actor hit 42 European organisations, got into 14, and pulled about 140,000 records from a political platform. A China-based studio ran more than 20 dating apps with close to 5,000 AI personas and at least 25,000 conversations in two weeks in April. And every capability in this episode is a public GitHub repository.
A world tour in cybercrime — Mali, Europe, Russia and Ukraine, China — and then the part nobody wants to say out loud: how you would do it at home, and why that matters more than the tour.
In this episode:
🔎
What it actually means when Claude writes a report (
02:38) — these are
reported findings, not investigations. Anthropic inferred misuse from the chats themselves. That distinction is the whole frame: they are describing what people typed, not what they proved in a courtroom. And the operator can be one person — or an entire state.
🚪
"Circumvent" (
07:41) — what happens when Claude or ChatGPT blocks you. You use the blocked model to install Ollama, pull open weights — GLM 5.2 from Z.AI, or Alibaba's Qwen under Apache 2.0 — and you run it locally. Not a Ferrari. A Volkswagen. Completely good enough for this.
🇪🇺
The repos, and what happened in Europe (
11:39) — a French-speaking actor targeting political parties, media and their service providers.
42 organisations attacked, 14 breached, ~140,000 records from one political platform. Before, that needed a group of fifty people.
🕵️
Russia and Ukraine (
16:10) — espionage, same logic. Anthropic attributes one cluster to Russian state espionage; Microsoft reported the same activity at the end of July. Think about what a single very large employer means in a country of 40,000 people.
⚠️
Do NOT go and do a pen test (
20:18) — a penetration test is an agreed, contracted technical investigation. What I will say is only what is already in the report. Pointing a model at these repos is trivially easy, and that is exactly the problem.
🛠️
Why these repos exist at all (
22:26) — they are not there for offence. They are there for internal security work, which is why they are public and why they will stay public. Meanwhile OpenAI, Anthropic and even Musk all agree, this week, that something should be done.
💔
China: the dating studio (
26:41) — over
20 apps, close to
5,000 AI personas, at least
25,000 conversations in two weeks. Want a real person at the end of it? That will cost another $5.
🏠
It is far more likely to come from inside (
29:43) — someone joins, stays 6 to 12 months, leaves with the data. Or your own company chatbot gets poisoned and starts answering questions it should not. Don't only look outward.
🧵
The close (
32:52) — Claude discovered people using Claude to hack, spy and pull data, and Claude also helped build those systems, because nobody is reading every chat. This is not reserved for hackers in China or Russia. It can be someone in your company, or a very clever 16-year-old.
In 99% of companies, the answer to "would we notice?" is no.
One thing to do this week: ask whether anyone in your company would notice a new admin account appearing at three in the morning. If the answer is no, that is your first project — before any AI project.
Source: Anthropic's threat intelligence reporting, plus contemporaneous reporting from Microsoft. Every tool named in this episode is a public repository.
📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904
The AI Cookbook Show — one subject, taken apart properly. Stay curious.