S2T Unlocking Cyberspace AI media incident — Sep 2026

An AI-assisted surveillance operation utilized synthetic personas to profile social media users and prepare for future deployment across the Gulf region. The effort, linked to the commercial intelligence vendor S2T Unlocking Cyberspace, involved generating fake identities to monitor demographics and political leanings.

What happened

According to an Anthropic threat intelligence report, the operation utilized the Claude AI model to execute two primary tasks: analyzing social media users and creating fabricated online personas. Investigators discovered a workstream consisting of over 255 synthetic accounts, including one masquerading as a Bangladeshi expatriate in Sharjah. The profiling system processed batches of social media posts to categorize users by demographic, location, and political affiliation, assigning confidence ratings to each assessment.

The system generated formal Arabic-language intelligence briefings that mimicked government communications, providing sentiment scores and suggesting counter-narratives. Beyond the UAE expatriate category, the synthetic identities included personas resembling Iranian diaspora communities, student protesters, and military figures. Anthropic observed that these personas were intended to pass as members of both pro-government and anti-government groups. While the vendor previously advertised capabilities such as phishing, malware installation, and the infiltration of private messaging groups, Anthropic noted that the observed activity was caught at the pilot stage. The company found no evidence that the synthetic personas had successfully interacted with real targets or entered community groups before the account was banned in June 2026.