GTG-84005: How an AI-Powered Influence Platform Targeted Malaysia

GTG-84005: How an AI-Powered Influence Platform Targeted Malaysia

A commercial influence operation built around AI was targeting Malaysia.

According to Anthropic's September 2026 Threat Intelligence Report, an operation tracked as GTG-84005 used Claude to run a commercial election-manipulation platform aimed primarily at Malaysian users.

The operation was not just a collection of fake social media accounts.

Anthropic says it combined:

• more than 1,000 fake X/Twitter accounts;
• a synthetic news outlet called Malaysia Pulse;
• constituency-level voter targeting;
• artificial engagement;
• fabricated intelligence dossiers;
• detection-evasion mechanisms; and
• custom dashboards built with Claude Code.

The operation was also linked by Anthropic to BBS Bilisim Teknolojileri, an Istanbul-based technology company that allegedly sold access to the platform as a paid influence-as-a-service capability.

That last point is important: this is an attribution reported by Anthropic, not a finding that the Turkish government or any Turkish state institution directed the operation.

And there is another important limitation.

Anthropic rated GTG-84005 Category Two on the Brookings Breakout Scale. The company said the assets were distributed across multiple platforms, but it found no evidence of breakout into authentic communities.

In other words, there is evidence of an organised attempt.

There is not evidence in Anthropic's report that the operation successfully manipulated Malaysian public opinion at scale.

What happened?

Anthropic says it identified and removed an account that had been using Claude to operate the commercial platform.

The platform was presented as defensive cyber-intelligence and counter-disinformation tooling.

Anthropic's investigation instead found what it described as a commercial influence operation.

The company's investigation identified links between the platform and BBS Bilisim Teknolojileri, an Istanbul-based technology company.

According to Anthropic, the platform was offered as a paid "influence-as-a-service" capability.

The actor's own documentation reportedly described the infrastructure as a:

"military-grade, AI-driven, real-time political operations ecosystem."

The wording is significant because it came from the actor's own documentation rather than Anthropic's characterization of the platform.

The distinction matters.

Anthropic is reporting what it found during its investigation and what the actor's documentation claimed about the product.

It is not saying that the platform actually possessed military-grade capabilities.

A platform built around the Malaysian electorate

The operation reportedly ingested real census and electoral data, including millions of voter records, and used it to build constituency-level profiles.

Anthropic says the system targeted all 222 Malaysian parliamentary constituencies.

The targeting focused on three particularly sensitive political and social fault lines:

• race;
• religion; and
• royalty.

This is considerably more sophisticated than simply generating political spam.

The system was designed to connect political messaging with geographic and demographic targeting.

The basic workflow looked something like this:

Census + electoral data
          |
          v
Constituency profiling
          |
          v
Target selection
          |
          v
Narrative generation
          |
          +--------------------+
          |                    |
          v                    v
 Fake social accounts     Synthetic news
          |                    |
          +---------+----------+
                    |
                    v
          Artificial amplification
                    |
                    v
              Target audience

Anthropic describes this as a commercial platform rather than an isolated collection of scripts.

That distinction is important.

A reusable platform can be sold, modified and operated for different campaigns without rebuilding the entire system from scratch.

More than 1,000 fake X accounts

Anthropic says the platform managed more than 1,000 fake X/Twitter accounts.

These accounts were not simply created and immediately used.

The system reportedly included "warm-up" logic designed to make accounts appear legitimate before they were deployed for influence activity.

Anthropic says the accounts also used mechanisms such as regularly renewing cookies and IP addresses.

The objective was to make coordinated accounts harder for social platforms to identify.

The platform also included controls for artificial engagement.

According to Anthropic, operators could configure how many artificial views a target should receive.

Investigators observed a request seeking one million artificial views for the account of Malaysia's sitting prime minister.

There is an important caveat.

Anthropic explicitly says the engagement numbers recorded by the dashboard were self-reported by the actor's own tooling and could not be independently verified.

So it would be inaccurate to write:

The operation generated one million real views.

The defensible statement is:

Anthropic observed a request in the platform for one million artificial views targeting the prime minister's account.

Those are two very different claims.

Malaysia Pulse: turning rewritten material into "local" news

The operation also ran a synthetic news outlet called Malaysia Pulse.

Anthropic says the platform fed the outlet through an AI rewriting pipeline.

Legitimate Malaysian reporting was scraped and rewritten several times before being republished with fabricated bylines.

Anthropic identified malaysiapulse.com as an actor-controlled domain, registered on 10 May 2026, and linked an inauthentic YouTube channel to the same operation.

That created an attribution-laundering pipeline:

Legitimate Malaysian reporting
            |
            v
       AI rewriting
            |
            v
     Fabricated byline
            |
            v
       Malaysia Pulse
            |
            v
     Social amplification

The operation also republished material originating from Russian and Chinese state-aligned outlets, including:

• TV BRICS;
• Xinhua;
• Sputnik/RIA; and
• CGTN.

Anthropic says the operation stripped the original state attribution and presented the rewritten material as independent Malaysian reporting.

This is more than ordinary content generation.

It is source laundering.

The original source disappears.

The rewritten story then appears to come from a supposedly independent Malaysian publication.

The reader sees a local-looking article rather than the original provenance of the information.

Fabricated intelligence dossiers

The operation also generated what were presented as intelligence dossiers.

Anthropic says these dossiers contained false allegations against a named opposition politician and civil-society organisations.

Anthropic states that the allegations were fabricated by the actors.

This technique matters because the format itself can manufacture an appearance of authority.

A normal social-media post can be dismissed as an anonymous claim.

An "intelligence dossier" can appear much more credible to a reader who assumes the document came from a professional intelligence or investigative organisation.

The operation therefore combined two forms of deception:

1. synthetic distribution, through fake accounts and artificial engagement; and
2. synthetic authority, through fabricated reports and dossiers.

Claude was used as an engineering layer

One of the most interesting parts of the case is how Claude was used.

The model was not merely asked to write political posts.

Anthropic says Claude was used to build and operate substantial parts of the platform.

According to the report, Claude was used to:

• build the constituency-targeting system;
• process real electoral data;
• engineer the fake-account network;
• develop detection-evasion logic;
• rewrite and launder news;
• iterate fabricated dossiers; and
• build operational dashboards.

The actor also used Claude Code to build custom dashboards for managing, running and tracking the fake-account network.

Those dashboards tracked metrics including likes and views generated by deceptive accounts.

This changes the way the incident should be understood.

The interesting question is not:

"Did AI write fake political posts?"

The more important question is:

What happens when an AI coding system becomes part of the operational infrastructure behind an influence campaign?

This is the same shift mapped in AI agent security: the threat model changes when a model holds tooling and acts inside a workflow, not when it merely generates text.

The answer, in this case, was a system that combined targeting, content production, amplification and measurement.

The AI was not operating alone

It would be misleading to describe this as Claude independently deciding how Malaysia's politics should be manipulated.

The operation had human operators.

They supplied objectives, targets and operational requirements.

Claude was used to implement parts of the system and generate or transform content.

A simplified architecture looks like this:

Human operators
      |
      +--------------------+
      |                    |
      v                    v
Political objectives    Target selection
      |                    |
      +---------+----------+
                |
                v
        Claude / Claude Code
                |
      +---------+---------+----------+
      |                   |          |
      v                   v          v
Targeting system     Fake accounts   Content pipeline
      |                   |          |
      |                   v          v
      |              Amplification  Malaysia Pulse
      |                              |
      +---------------+--------------+
                      |
                      v
              Influence operation

The model therefore functioned as an engineering and content-production layer inside a larger human-directed operation.

That distinction matters when discussing AI-enabled influence operations.

The risk is not necessarily autonomous political decision-making.

It is capability compression.

A smaller team can potentially build systems that previously required substantially more engineering, content and operational labour.

Claude did refuse some requests

The report also shows that model safeguards were not completely bypassed.

Anthropic says Claude refused or partially refused several requests.

One example involved a fabricated dossier that the model identified as material for political defamation.

The model also objected to language explicitly evoking a psychological operation.

However, Anthropic says the actor responded by negotiating sanitized wording and continued working toward the same capability.

This is an important security lesson.

A refusal at the model layer does not necessarily mean the overall operation has stopped.

If an operator can change wording, split a task into smaller steps or move parts of the workflow elsewhere, the system around the model can continue progressing.

That means AI safety cannot depend exclusively on individual prompt refusals.

Detection needs to consider behaviour across the entire account and operational workflow.

The BBS connection

Anthropic says its investigation uncovered clear links between the platform and BBS Bilisim Teknolojileri, an Istanbul-based technology company.

The report further lists infrastructure indicators associated with the operation, including actor-controlled domains, a linked code-hosting organisation, and several example sockpuppet accounts.

These indicators are useful for threat-intelligence purposes, but attribution needs to remain precise.

The evidence published by Anthropic supports the statement that:

Anthropic linked the platform's infrastructure to BBS Bilisim Teknolojileri.

It does not, by itself, establish that:

• the Turkish government directed the operation;
• the Turkish government funded it;
• President Erdoğan ordered it;
• the Turkish state was behind the campaign; or
• BBS's entire corporate operation was involved.

Those would require additional evidence.

HEJES will not turn an infrastructure attribution into a state attribution without evidence.

What about MCMC?

Anthropic says the actor pursued a contract with Malaysia's national communications regulator.

However, Anthropic also explicitly says:

it found no evidence that the pursuit succeeded.

That distinction became important after the report was published.

On 11 September 2026, Malaysian reporting quoted the Malaysian Communications and Multimedia Commission (MCMC) as saying it was reviewing Anthropic's report.

MCMC also stated that the activity described was not part of its functions or mandate and that it was not involved in any such activity or dealings.

MCMC said it was seeking further information and clarification before determining any follow-up action.

Sinar Harian's report on the MCMC response provides the reported details of that statement.

Therefore, this should not be reported as:

"MCMC hired the election manipulation platform."

There is currently no evidence supporting that claim.

The accurate version is:

Anthropic says the actor pursued a contract with Malaysia's communications regulator but found no evidence that the attempt succeeded. MCMC says it was not involved in the activities described and is seeking further information.

Did the operation actually manipulate Malaysian voters?

This is probably the most important question.

The answer from the available evidence is:

We do not know that it did.

Anthropic classified GTG-84005 as Category Two on the Brookings Breakout Scale.

The company said the assets were distributed across multiple platforms but found no evidence of breakout into authentic communities.

That means the operation had built and distributed its infrastructure, but Anthropic did not observe evidence that it successfully crossed from its own controlled or inauthentic network into broad authentic communities.

This distinction is critical.

There is evidence of:

• a commercial platform;
• fake accounts;
• constituency targeting;
• synthetic news;
• fabricated dossiers;
• artificial engagement;
• operational dashboards; and
• attempted political influence.

There is not equivalent evidence that:

• Malaysian voters were successfully persuaded at scale;
• an election result was changed;
• the campaign achieved mass organic reach; or
• the operation controlled Malaysian political discourse.

The technology existed.

The attempted operation existed.

The claimed impact should not be exaggerated beyond the evidence.

Why this matters even without proven mass influence

It would be easy to dismiss the operation because Anthropic did not find evidence of breakout.

That would be a mistake.

The significance is the availability of the machinery.

Influence operations have traditionally required people to perform many repetitive tasks:

• research audiences;
• create accounts;
• maintain personas;
• write content;
• translate content;
• publish stories;
• coordinate amplification;
• monitor engagement; and
• adjust campaigns.

An AI-assisted platform can compress many of these tasks into software.

That potentially changes the economics of influence operations.

The question becomes less about whether someone can manually operate 1,000 accounts.

The question becomes:

How cheaply can someone build a system that operates 1,000 accounts?

That is a security problem worth paying attention to.

The real attack surface is the system

There is another lesson here for defenders.

If defenders focus only on individual posts, they may miss the larger system.

A fake account by itself may not be particularly interesting.

A fake news article by itself may be difficult to distinguish from low-quality journalism.

A suspicious dashboard may not be visible to a platform at all.

But when those components are connected, the pattern becomes much more useful:

              +------------------+
              | Electoral data   |
              +--------+---------+
                       |
                       v
              +------------------+
              | Target profiling |
              +--------+---------+
                       |
             +---------+---------+
             |                   |
             v                   v
     +---------------+   +---------------+
     | Fake accounts |   | Fake newsroom |
     +-------+-------+   +-------+-------+
             |                   |
             v                   v
     +---------------+   +---------------+
     | Engagement    |   | Synthetic     |
     | manipulation  |   | reporting     |
     +-------+-------+   +-------+-------+
             |                   |
             +---------+---------+
                       |
                       v
              +------------------+
              | Target audience  |
              +------------------+

The defensive signals therefore exist at several layers:

Account layer

• synchronized account creation;
• repeated behaviour;
• shared infrastructure;
• identical posting patterns;
• artificial engagement.

Infrastructure layer

• shared hosting;
• common deployment identifiers;
• common code repositories;
• common domains;
• reused operational components.

Content layer

• repeated rewriting patterns;
• fabricated bylines;
• attribution laundering;
• identical narratives adapted to multiple personas.

Behaviour layer

• warm-up periods;
• coordinated posting;
• automated engagement;
• account rotation;
• detection-evasion behaviour.

Looking at only one layer makes the operation harder to see.

Looking at the entire graph makes the relationships much more obvious.

What GTG-84005 actually demonstrates

The most important lesson is not that "AI can create fake news."

We already knew that.

GTG-84005 demonstrates something more consequential:

AI can become part of the software stack used to operate an influence campaign.

Claude was used across multiple stages:

Targeting
   |
   +--> Constituency profiling
   |
   +--> Fake-account engineering
   |
   +--> Detection evasion
   |
   +--> Synthetic news
   |
   +--> Fabricated dossiers
   |
   +--> Operational dashboards
   |
   v
Influence infrastructure

The model was therefore not merely the content generator.

It became part of the engineering workforce behind the operation.

That is where the threat model changes.

What we know — and what we don't

Confirmed by Anthropic's report

• GTG-84005 targeted Malaysian users.
• The operation used Claude.
• The platform involved roughly 1,000 fake X accounts.
• Anthropic says the platform covered all 222 parliamentary constituencies.
• Real census and electoral data were used.
• Race, religion and royalty were among the targeting fault lines.
• Malaysia Pulse was used as a synthetic news outlet.
• Fabricated dossiers were generated.
• Claude Code was used to build operational dashboards.
• Anthropic linked the infrastructure to BBS Bilisim Teknolojileri.
• The actor pursued a contract with Malaysia's communications regulator.
• Anthropic found no evidence that the contract attempt succeeded.
• Anthropic classified the campaign as Category Two.

Not established by the available evidence

• That the Turkish government directed the operation.
• That the Turkish government funded the operation.
• That BBS acted on behalf of the Turkish government.
• That the operation successfully changed Malaysian voter behaviour.
• That one million real people viewed the prime minister's account because of the operation.
• That MCMC participated in the operation.
• That the operation successfully penetrated authentic Malaysian communities.

This distinction is not just editorial caution.

It is what separates threat intelligence from speculation.

Why Malaysia should care

Malaysia does not need to wait for a successful influence operation before treating this as a serious security problem.

The country's political environment already contains the ingredients that make targeted influence operations attractive:

• strong ethnic and religious sensitivities;
• politically significant social-media communities;
• highly localized constituencies;
• rapid information cycles;
• encrypted messaging;
• fragmented media ecosystems; and
• growing availability of generative AI.

The existence of a commercial platform capable of combining these elements means defenders should assume that similar systems can be attempted again.

The next operation may not use Claude.

It may use another model.

It may not use X.

It may use TikTok, Facebook, Telegram, WhatsApp or a combination of platforms.

The underlying playbook can remain largely the same.

The uncomfortable part

The most uncomfortable part of GTG-84005 is not the number of fake accounts.

It is the fact that the operation was designed as a platform.

A platform can be reused.

A platform can be modified.

A platform can be sold.

And once the engineering work is done, the next campaign does not necessarily start from zero.

That is the part defenders should be thinking about.

The question is no longer simply:

"Can AI generate political disinformation?"

It obviously can.

The harder question is:

How much of the infrastructure required to run a professional influence operation can AI now build for a small team?

GTG-84005 provides one answer.

More than just content.

It can include the machinery around the content.

And that is where the real security problem begins.

---

Sources and further reading

Primary source

• Anthropic — Detecting and countering misuse of AI: September 2026 — primary source for GTG-84005, the platform architecture, BBS connection, fake-account network, Malaysia Pulse, fabricated dossiers, Claude Code usage, indicators and Anthropic's Category Two assessment.

Independent reporting

• Channel News Asia — AI firm Anthropic says it disrupted election manipulation operation targeting voters in Malaysia — independent reporting on Anthropic's findings, including the 222 parliamentary constituencies.
• The Edge — Claude creator Anthropic reveals it disrupted election-manipulation platform targeting Malaysian voters — Malaysian business reporting on the Anthropic disclosure and BBS connection.
• New Straits Times — AI firm Anthropic detects fake accounts targeting Malaysian voters — Malaysian reporting on the more-than-1,000-account network.

Malaysian response

• Sinar Harian — MCMC teliti laporan Anthropic, nafi terbabit operasi manipulasi — reporting on MCMC's response, including its denial of involvement and statement that it was seeking further information.

Editorial note

This article distinguishes between findings reported by Anthropic, statements made by Malaysian authorities, and HEJES' technical analysis.

Attribution to BBS Bilisim Teknolojileri reflects Anthropic's published findings. This article does not infer Turkish government involvement from the company's location.

Similarly, the reported one-million artificial-view request is treated as an observation from the actor's own dashboard, not as independently verified audience reach.

Most importantly, the existence of an influence operation is not evidence that it successfully influenced Malaysian voters. Anthropic's own assessment was Category Two, with no evidence of breakout into authentic communities.