Anthropic's Alleged 'Pre-Crime' Surveillance of AI Activists

Anthropic's Global Safety, Intelligence, and Security (GSIS) team posted a job listing for an 'Enterprise Intelligence Specialist' paying $180,000-$230,000, tasked to 'identify, assess, track, and investigate' threats that explicitly include 'activism' alongside terrorism, crime, and nation-state targeting of the AI sector ^[1]. Security Operations Manager Zach Melvin described the underlying philosophy in a podcast reviewed by the Prospect: the goal is 'transforming operations from reactive information gathering to proactive and predictive and preventative threat engagement and management' ^[2]. Anthropic also runs a 'person-of-interest process,' explicitly built to track concerning behavior over time so the company can catch escalation patterns early ^[1].

That combination - a paid analyst role, a named predictive doctrine, and an ongoing individual-tracking process - is what separates this from routine corporate security. It is also unusually direct evidence of intent: companies rarely spell out a predictive-security doctrine in a public hiring document, which makes the job posting more revealing than a leaked internal memo would be - it is a public commitment to build the capability, not merely a reaction to being caught doing so. The taxonomy in that posting is itself a signal: grouping 'activism' with 'geopolitical instability, terrorism, crime, [and] nation-state targeting of the AI sector' ^[1]means a category of protected First Amendment activity is processed through the same identify-assess-track-investigate pipeline as violent and state-level threats. Anthropic also contracts third-party risk-detection firm Samdesk to flag protest activity near its executives and offices - a relationship close enough that Samdesk CEO James Neufeld appeared alongside Anthropic staff in the podcast reviewed by the Prospect ^[1]- and GSOC Manager Keon Ellison said Samdesk once gave the company roughly 60 minutes of advance notice that protest organizers had moved up their timeline, letting executives avoid walking into the disruption ^[2]. Whether or not 'pre-crime' is the precise label, the mechanics described are genuinely anticipatory: tracking people and movements before any specific act, not merely responding after one occurs.

Santa Clara University law professor Eric Goldman's central warning is about incentives, not intentions: 'As they become more hated, there's more pressure on them to over-disclose knowing that some of the people they identify for law enforcement shouldn't be targeted at all' ^[3]. That is a structural critique - the more public backlash a company like Anthropic absorbs, the stronger its incentive to hand names to police pre-emptively, even when the underlying signal is weak. It is also worth noting that most of the coverage amplifying the story is repackaging the Prospect's original reporting rather than independently confirming new facts ^[1][2].

The reaction beyond the original investigation was mostly amplification rather than additional reporting: same-day social posts and video reactions largely repeated the piece's core claims without confirming new facts, and even Reddit threads that generated substantial discussion clustered around interpreting the original story rather than adding to it. One thread of that discussion, in r/privacy, pointed to a 'Legal Compliance' clause in Anthropic's own Terms of Service that the commenters said permits reporting user activity to law enforcement - a framing worth noting as a talking point in that discussion, though it reflects user commentary rather than something confirmed in the underlying investigation. Separately, Prospect reporter Daniel Boguslaw used his own posts about the story to solicit further tips from frontier-lab employees via Signal, a sign the outlet may pursue additional reporting on this beat.

Earlier in 2026, Anthropic publicly refused to let its AI tools be used for the Department of Defense's mass domestic surveillance or autonomous weapons programs, after which the DoD reportedly threatened to designate the company a 'supply chain risk'; Anthropic later sued the Trump administration over related retaliation ^[4]. The ACLU and Center for Democracy & Technology backed Anthropic in that fight, with the ACLU's Patrick Toomey arguing the company's AI-guardrails advocacy was 'protected by the First Amendment' ^[5].

That history sits uneasily next to the Prospect's reporting: the same company that drew a public line against government surveillance use of its models is separately described as building its own predictive tracking of the activists most critical of its rollout ^[1]. The reported AR-15 threat against CEO Dario Amodei complicates a purely critical reading, though - a chatbot user telling Claude he had the CEO 'in his sights' after buying a weapon is a concrete, individualized threat, and flagging that to police is a different act than continuously monitoring protest organizers as a category ^[2].

Not every reaction treated the story as proof of a dystopian system. A pointed Hacker News comment captured the skeptical framing directly: 'I bet if I typed into Claude asking about pharmaceutical lobbying, I would not be reported to anyone' ^[6]- the argument being that the concern isn't predictive security in the abstract, but that AI-safety activism specifically gets sorted alongside terrorism and nation-state threats. Others in that same discussion pushed back further, arguing large companies routinely run executive-protection programs like this and that dramatizing it as a novel 'pre-crime' system overstates what the evidence shows versus standard corporate security practice.

The clearest data point cuts across both readings rather than resolving them: SEIU-USWW president David Huerta, in reporting tied to a separate pay dispute over Anthropic's security contractors, asked 'Who can survive with $22 an hour in San Francisco?' ^[1]- a wage that sits alongside the $180,000-$230,000 salary range for the intelligence analyst role built to track activists. The two figures come from different disputes over different jobs, so they don't establish a single spending pattern, but their appearance in the same body of reporting about Anthropic's security operation is itself notable.