Of all the cases in today’s threat report, GTG-15001 is the one you’d actually tell someone who has nothing to do with AI.
An app studio in China built a network of more than 20 dating apps, marketed as platforms full of real people. Over a two-week window in April 2026, Anthropic found more than 4,700 distinct AI personas there, talking to at least 25,000 individual people. Claude ran those conversations: roughly 2.36 million messages in the same window.
Three parties
The target. Swiped through a feed that was 75% Claude personas and 25% real people, with no way to tell them apart. Messaging and matching drew down a metered quota, refilled with in-app coins.
The gig workers. Real people, recruited by invitation, with profiles mixed into the same swipe feed. Their job was what Claude can’t do: live video calls and social media follows, to make the place feel real. They were paid per message, per video call, per follow-back. A smaller model proposed three replies and the worker tapped one, which pre-empted whatever Claude was about to send.
The personas. Fully autonomous. The operator’s system prompt told them never to disclose they were automated, to deflect requests for video calls or photos, and to work through a fixed sequence of conversational stages. The backend fabricated likes, visitors and pre-recorded «video» when no real person was available, and tracked which users were starting to get suspicious.
Two details that stick
First: the system prompt read like an ordinary companion deployment. From inside any single exchange, neither the monetisation nor the deception was visible. Anthropic notes that Claude stayed in persona across effectively all sampled exchanges – including a small number where users disclosed serious illness or acute distress and the model’s own reasoning surfaced the harm. It kept going anyway.
Second: the apps were engineered against store review. A UI controller activated only while a review was running and slept the rest of the time. Class names differed across the 20-plus variants so Apple and Google couldn’t link the apps by similarity. An in-app browser rerouted payments to third-party processors and was configurable server-side, so it could be hidden during review.
Remarkably unremarkable
The report says so itself: no novel misuse techniques here. It’s a cousin of a 2025 case, where someone ran a Telegram bot that wrote dating-app messages for other scammers. What changed is the scale and the division of labour. Claude for the conversations, a small third-party model for reply suggestions and photo moderation, an image model for avatars, real humans for the video calls.
Anthropic banned the accounts and shared details with the other providers involved. The app indicators went to Apple and Google directly.
What bothers me
Not the technology. It’s that every individual role in the chain looked harmless on its own. A roleplay prompt. Some reply suggestions. An image editor. A gig job that pays you for video calls. Only the ledger of who does which part turns it into fraud against 25,000 people.
That’s why I find this case more important than the flashier espionage stories in the same report. Misuse never surfaced at any single point where someone could have caught it.
Sources: Anthropic: Detecting and countering misuse of AI, September 2026 · Techmeme: Anthropic publishes a threat intelligence report