An AI-assisted surveillance operation prepared a fake online identity appearing to represent a Bangladeshi expatriate in Sharjah, according to findings published by Anthropic. The handle, @BanglaExpatSharjah, formed part of a collection of synthetic personas associated with a commercial surveillance project focused on Iran and the Gulf region.
Anthropic said the activity was carried out by, or on behalf of, S2T Unlocking Cyberspace, which it described, based on open-source research, as an Israeli-Singaporean commercial intelligence vendor. The company banned the Claude account involved in June 2026.
The findings appeared in Anthropic’s September threat intelligence report, released on September 10. Reuters reported on September 11 that S2T had not immediately responded to a request for comment.
The Bangladeshi-themed handle appeared in a category labelled 'UAE expatriate', alongside @PakistaniDubaiWorker, @AjmanLaborForum, and @IntlCityWorkers. Anthropic described these as handles included in a synthetic training dataset, caught early in its review, and not assessed to have been used operationally. The findings therefore do not establish that the persona entered a Bangladeshi community group or interacted with migrant workers.
According to Anthropic, the operation used Claude for two connected tasks: analysing social media users and generating content for fabricated online personas. Investigators identified a workstream involving more than 255 synthetic social media accounts, which they interpreted as preparations for future deployment.
The profiling system processed batches of roughly 25 social media posts, asking Claude to infer the posters’ demographic groups, locations, and political leanings, with confidence ratings attached to its assessments. Users were sorted into six categories: urban, clerical, military, youth, diaspora, and rural. The system also classified people as government supporters or opponents.
Its outputs included formal Arabic-language intelligence briefings styled to resemble government communications. These contained sentiment scores broken down by Gulf nationality and suggested messages to counter the views being analysed. Anthropic assessed that the systems were likely intended for Arabic-speaking customers in the Gulf, but its account did not identify a government buyer or confirm that a government had commissioned the work.
Beyond the UAE expatriate category, the synthetic identities included personas resembling Iranian diaspora communities, student protesters, military figures, and clerical accounts. Anthropic said the content-generation activity suggested an effort to create identities that could pass as members of both pro-government and anti-government Iranian communities.
S2T’s surveillance capabilities were previously examined by Forbidden Stories in an investigation published on February 20, 2023. Reporters traced a confidential brochure found in leaked Colombian military files to the company. The document advertised capabilities extending beyond gathering publicly available information, including fake accounts, phishing, and tools for installing malware remotely.
Anthropic said its findings corroborated that earlier investigation. It described the brochure’s methods as including infiltration of private WhatsApp and Telegram groups, collection of membership lists, and subsequent phishing or device compromise. AI-generated persona content could provide a “credibility layer” to make fabricated accounts more convincing, the company said.
However, Anthropic distinguished those advertised capabilities from what it directly observed. It said it identified the operation at the pilot stage and found no evidence that the later surveillance stages had been carried out against real targets before the Claude account was banned.
The company said the activity breached its rules against surveillance, political profiling, and coordinated use of deceptive accounts. It also shared technical indicators with partners tracking commercial surveillance vendors. Its intervention blocked the operator’s access through that account; the report did not establish that the wider surveillance project had ceased.
