Anthropic publishes March 2025 misuse detection report

Anthropic published a report detailing several cases of Claude misuse it said it had detected and acted against, continuing a practice of periodic public disclosure of misuse investigations. The most developed case was a financially motivated influence-as-a-service operation that used Claude to orchestrate more than 100 social media bot accounts across X and Facebook, deciding tactically when and how bots should engage with genuine users’ posts; Anthropic said the network had engaged with tens of thousands of authentic accounts across multiple countries and languages.

Other cases included an actor using Claude to improve credential-stuffing tooling aimed at internet-connected security cameras, integrating multiple leaked-credential databases — though Anthropic said it had not confirmed the actor achieved real-world success; a recruitment-fraud operation that used Claude to rewrite scam job communications so they read as native English, disguising their origin; and a self-described novice who used Claude to progress from simple scripts to more sophisticated tools, including facial-recognition and dark-web-scanning components, beyond what Anthropic assessed the actor’s own skills would otherwise have allowed.

In each case Anthropic said it banned the associated accounts and fed the findings back into its detection systems. The report’s most notable case — the novice malware developer — illustrated a concern distinct from sophisticated state-level misuse: that capable models could compress the skill and time required for a low-level actor to build harmful tools, regardless of whether any single case caused large-scale damage.