ANTHROPIC THREAT REPORT ON KENYA!!!! 🧵 GTG-54004: Disrupting a domestic coordinated inauthentic behavior campaign in Kenya We identified and removed an account that was used by a single actor to mass-produce Kenyan political content. The operation was built to look like spontaneous, grassroots public sentiment. The actor used Claude across several sessions to generate batches of exactly 50 tweets, explicitly instructing the model to make posts look like spontaneous grassroots commentary rather than a coordinated campaign. The network focused its messaging on key Kenyan political issues and figures. A large portion of the AI-generated tweets praised Energy Cabinet Secretary Opiyo Wandayi for stopping a scheduled Kenya Power electricity tariff hike, using the hashtags #PowerReliefKE and #PoweringTheNewKenya to boost visibility. Additionally, the network pushed stories claiming that Kenya’s United Opposition coalition was breaking apart before the 2027 general election, directly targeting politicians Rigathi Gachagua and former president Uhuru Kenyatta. Separately, the actor ran the identical AI workflow for Kenyan retail brands under a marketing persona, “SHANKI”/“Elkins Marketer.” We found no evidence of government involvement, and the activity appears consistent with an entirely domestic Kenyan operation. Our investigation revealed a highly structured political astroturfing effort that pushed identical, unified messages regarding the tariff increase across different conversations. We evaluated the impact of the network using the Breakout Scale and classified it as Category One. The activity was completely isolated within the network of fake accounts and local influences on a single platform, failing to reach or influence any real people. While we do not know the exact real-world identity of the people behind this operation, we believe this was a local Kenyan political astroturfing campaign. The network’s pro-administration tone and specific hashtags suggest it was plausibly aligned with the ruling coalition, though we have not identified the exact organization responsible. Key findings •The operation used a single playbook to amplify both pro-government and anti-opposition narratives. Boosting the incumbent administration while undermining the opposition’s viability in this way is consistent with a single, coordinated electoral communications effort. •The template used here was also used, verbatim, for the marketing of retail brands, including a promotional broadcast that was repackaged as organic tweets with links inserted on every fifth post. This fits into a commonly-observed pattern in Kenya where agencies pay local influencers to manipulate narratives. •The operation frequently used Claude to humanize and refine batches of 50 pre-drafted topics and tweets, showing that the model’s main value to the network was volume and the appearance of authenticity. The core ideological messages were completely decided by the actors before Claude was used. Attack lifecycle and AI usage The actor supplied the topic, talking points, and hashtags, and used Claude to convert them into 50 themed, character-counted posts formatted for cross-platform publishing and dissemination. In several sessions, these were packaged as an interactive copy-all widget ready for deployment. Figure 17. Inauthentic commenting accounts amplifying Cabinet Secretary (CS) Opiyo Wandayi content, showing coordinated clusters within the operation’s inauthentic accounts. Disruption and mitigations Based on a tip shared by OpenAI about recidivist activity on their platform, we conducted an internal investigation into suspected coordinated inauthentic behavior in Kenya and identified this operation. We removed the account and the organization behind it, and built detections around its behavioral signature