Iran's AI Spy Ring Is Coming for Us — and the Clock Is Running
Iran has turned a Silicon Valley chatbot into an automated surveillance machine targeting hundreds of Israelis and diaspora Jews — and the world is still not paying attention.
For years I have stood in courtrooms arguing that terrorism does not begin with a bomb. It begins with a list — a target list, assembled by human hands, refined over months, turned into an order of battle. What Anthropic's new threat-intelligence report reveals is that Iran has now outsourced the most labor-intensive part of that process to a machine.
Anthropic, the San Francisco company behind the Claude chatbot, confirmed this month that it identified and shut down an Iran-nexus threat actor it designated GTG-30004. The operatives used Claude to build an automated open-source intelligence system — a profiling harness — that took a pre-existing target list of Israeli governmental and non-governmental figures, and members of the Jewish diaspora, and enriched it at machine speed. What used to require teams of Iranian Intelligence analysts working for months, this system did in hours. Hundreds of individuals were profiled. Their identities, affiliations, vulnerabilities — assembled, organized, and delivered as intelligence products, ready for the next step.
The next step is the part that should keep every Jewish community leader awake at night.
The same actor, the same Iran-nexus group, was simultaneously modifying an open-source credential-stealing tool called NanoDump and building a custom C++ obfuscation pipeline designed to hide their malware from security analysts. Surveillance and cyberweapons in one hand; a dossier on you in the other. And a second Iranian actor — tracked by Anthropic as GTG-30005 — was using Claude to compile targeting handbooks against U.S. naval forces and to design a domestic mass-surveillance platform combining license-plate recognition with mobile-device interception. This is not dabbling. This is an integrated intelligence program, running in parallel workstreams, powered by an American company's product.
Let me be precise about what "automated" means here, because the word is doing a great deal of work. Anthropic's report documents that Iranian operators fed Claude batches of social-media posts — in one surveillance operation, over 155,000 posts on X — and directed the system to produce structured records identifying targets' locations, demographic data, and political leanings, complete with confidence scores. Separately, a Qom-based Iranian unit built a malicious Firefox extension — named "al-Najm al-thāqib" — that mass-harvested user identities from major social networks. Both units fed their collection into the same centralized Iranian state case-management system. Iran has built a factory. AI is the assembly line.
The ayatollahs' use of AI to hunt their enemies abroad is consistent with everything we know about how they operate. I have represented families of Iranian Jews kidnapped while trying to flee the country. I know firsthand what it looks like when the regime decides someone belongs on a list. The execution of Habib Elghanian in 1979 — accused of "corruption" in a sham one-hour trial and shot by firing squad — was the regime's announcement that every Jew in Iran was a potential target. The automated profiling of diaspora Jews in 2026 is the same logic, scaled and exported. The names change. The principle does not.
Anthropic deserves credit for publishing its findings and banning the accounts involved. The company also said it shared information about the activity with government authorities and other organizations. But let us be honest about what banning an account accomplishes: it raises the cost of the operation by approximately the time it takes to create a new one. Anthropic's own report documents Iranian actors returning to Claude within hours of a disruption, or routing through VPNs and fraudulent accounts to regain access. The regime is persistent. Platform bans are a speed bump, not a wall.
The real remedy, as it always is with Iran, runs through money and law. Every Iranian paramilitary unit and domestic-security agency whose operatives ran these operations — Anthropic identified them as linked to Iranian paramilitary and domestic-security agencies — is a sanctionable entity. The U.S. Treasury Department and the European Union should be moving now to designate the specific organizational nodes identified in this report. Freeze the accounts of the officials who directed these operations. Sanction the procurement networks that buy the access.
Beyond sanctions, American lawyers should be examining whether the Foreign Sovereign Immunities Act of 1976 and the Antiterrorism Act of 1990 open a path to civil suits on behalf of the targeted Israelis and diaspora Jews. The profiling of individuals as a preparatory step for a potential attack is not abstract surveillance — it is the reconnaissance phase of a targeting cycle. When that targeting cycle has previously resulted in violence, as it did in the 1994 bombing of the Jewish community center in Buenos Aires that killed 85 people and wounded more than 300, the legal theory writes itself.
There is one more demand that must be made clearly, of the AI companies themselves. Anthropic did the right thing by publishing this report. But the industry as a whole has treated national-security misuse as a content-moderation problem — a matter of better prompts and faster bans. It is not. It is a sanctions-compliance problem, a know-your-customer problem, a question of whether a company selling access to a powerful intelligence capability has the same obligations as a bank selling access to the financial system.
Iran has answered that question for us. It treated Claude as infrastructure. We should govern it accordingly.