No Single Message Was a Crime

Anthropic recently released details on what occurred after two research teams ceased requesting that its AI perform something harmful and began requesting it perform ten actions that each appeared acceptable. The outcome matches the issue I handle every week, and it accounts for why your spam filter continues overlooking the cons that genuinely cost people cash.

On October 14, Anthropic issued its approach for the US midterms. The bulk of it matches expectations from a firm that prefers its product not get used to damage an election. There is a notice directing people toward actual voting details, a usage rule that prohibits impersonating genuine individuals and creating artificial engagement, and a threat intelligence unit that suspends accounts.

Tucked in the center sits the section worth examining twice.

Anthropic requested that the Institute for Strategic Dialogue and the McCain Institute attempt to defeat its protections. They evaluated in the United States, Israel and Brazil. When they requested the model outright to perform something damaging, it declined, which is what it is designed to do and what it accomplished consistently.

So they ceased requesting outright. They divided an entire influence effort into its components and requested the components. Investigate this audience. Construct a news site. Compose some pieces. Outline how to distribute them. Every one of those requests is something a legitimate marketing person requests on a typical Tuesday. The model assisted, because there was nothing to decline.

In Anthropic's words, the researchers found that Claude "could miss a malicious campaign when it was spread across many individual requests." That discovery is what prompted the updated protections. The company says it added new classifiers to better identify novel and multi-step misuse.

This is not an election story

I read that and considered a case instead of a ballot.

A man receives a text that states "Hi, is this Linda? It's Karen, are we still on for coffee Saturday?" There is no offense in that message. There is no link, no demand, nothing to report and nothing a filter could mark without marking half the legitimate texts in the country. He replies to indicate she has the incorrect number, because that is what a decent person does.

Then they converse. For weeks. About her business, his retirement, her uncle who succeeds with crypto. Still no offense. Still nothing any tool would catch, because there is nothing in those messages except two people being friendly.

The offense appears in week six, when the app emerges, and by then he is not assessing a stranger's investment pitch. He is accepting advice from someone he has been conversing with every day since the spring.

Nobody sent him a scam. They sent him forty messages, and the scam was the form they created.

That is the identical structure the researchers employed on Anthropic, and it is why I continue stating that catching these at the message level is a losing stance. I have handled these cases. The single text that would have revealed everything does not exist. If you pull the thread and read it from the start it is clear, and if you read any one message out of the middle it is a person being nice.

What the labs can do and the rest of us cannot

Here is the part that should concern people, and it is not the part about AI.

Anthropic can address this on their side. They observe every request from an account, so they can build against the whole pattern rather than judging each errand alone. That is a genuine fix and they deployed it.

No email provider can do that, because the messages are not all arriving in email. The incorrect-number text lands on a phone, the friendly conversation shifts to WhatsApp within a week, the investment pitch occurs inside an app, and the money exits through a bank. Four companies, four fragments, and not one of them observes the form.

The scammers did not invent this. They simply observed that everything we built to protect people evaluates one thing at a time.

So what actually works

Not detection. I have stated this in a classroom full of commanders and I will state it here, because the advice people keep offering is the advice that does not work.

Nobody is going to notice the tell in message four. The grammar is fine now. The photos are real photos of a real person who does not know their pictures are being used. The voice on the phone sounds like a daughter because thirty seconds of her talking is enough to build one.

What works is a rule set before anything occurs, which is the only time anybody is thinking clearly.

Money and credentials move only after verification through a channel you selected, never the one that made contact. Someone requests a wire, hang up and call the number on the back of the card. A relative calls in trouble, hang up and call the relative. An investment appears through someone met online, it does not exist, no matter how long the conversation has been going and how much you like them.

That rule is boring and it holds, because it does not depend on anyone being clever at the exact moment somebody has arranged for them to not be clever.

The thing I keep thinking about

Anthropic sampled about 250,000 US conversations from one week in September. Requests asking Claude who to vote for came to roughly one in ten thousand.

The number is small, and it is not where the danger was. The red team found that the dangerous version never looked like that question at all. It looked like ten reasonable requests from someone with a plan.

That is the whole lesson, and it has nothing to do with elections. The harmful thing almost never introduces itself. It arrives in pieces, each one too small to refuse, and the only defense that survives contact is the one you decided on while nothing was happening.

Sources

• Anthropic's midterm plan, the red-team finding, the new multi-step classifiers, and the 250,000-conversation sample from September 21 to 27, 2026: Anthropic, "Preparing for the 2026 US midterms," October 14, 2026
• Coverage of the Institute for Strategic Dialogue and McCain Institute testing in the US, Israel and Brazil: Decrypt, "Anthropic Rolls Out Election Safeguards for Claude AI Ahead of US Midterms"
• Additional detail on the usage policy changes taking effect November 12, 2026: unite.ai, "Anthropic Strengthens Election Safeguards Ahead of 2026 US Midterms"