An Istanbul vendor sold Malaysia a counter-disinfo costume while Claude-built dossiers, 1,000 X socks and Malaysia Pulse laundered Xinhua and Sputnik as local news.

Filed

September 15, 2026, 06:17 UTC

Actor

Operators of Anthropic case GTG-84005, which the vendor traces to BBS Bilisim Teknolojileri (BBS Technology) of Istanbul, jointly listed in the Turkish Trade Registry Gazette to Turker Batuhan Sari and Bedri Sari; paying client not established; BBS publicly denies involvement

Target

Malaysian voters and news consumers across all 222 parliamentary constituencies, especially along race, religion and royalty fault lines, plus search and X users meant to treat Malaysia Pulse and the sock network as domestic consensus

Source

Unidentified Source blurred: contractors, cutouts, buried disclosure

Confidence

medium Plausible and sourced, but attribution or interpretation still open

Techniques

Narrative launderingAstroturfingSynthetic mediaDisclosure theaterManufactured consensusCard stacking

Where

Malaysia, Turkey

Channels

• Anthropic Claude accounts later banned as GTG-84005
• malaysiapulse.com and YouTube @malaysiapulseof
• about 1,000 X sockpuppet accounts with warm-up logic
• custom engagement dashboards built with Claude Code
• census and electoral microtargeting files
• fabricated intelligence dossiers
• rewritten Xinhua, CGTN, Sputnik/RIA and TV BRICS copy
• attempted pitch to Malaysia's communications regulator

Summary

Analysis

The last two briefs in this vault covered Iranian state propaganda shops on Claude and a U.S. commercial YouTube ghost-creator line. This cycle rotates to a Turkey-based commercial election stack aimed at Malaysia, still live in the open file this week as the news skin went offline and the named vendor denied the case.

Primary record is Anthropic GTG-84005 in Detecting and countering misuse of AI: September 2026, published 10 September. The vendor says it removed a Claude account that posed as a defensive cyber-intelligence and counter-disinformation outlet while selling a paid influence-as-a-service product marketed, in the recovered copy, as a military-grade, AI-driven, real-time political operations ecosystem. Recovered indicators include malaysiapulse.com, registered 10 May 2026, YouTube channel @malaysiapulseof, example socks created on a shared 17 May stamp, and infrastructure the vendor maps to BBS Bilisim Teknolojileri. CNA, Malaysiakini and The Rakyat Post published the same numbers on 11-12 September. Lowyat on 13-14 September recorded the Pulse site unreachable after the report and printed BBS's LinkedIn denial: no involvement, knowledge or connection; categorical rejection. A separately named Turkish firm that shares the BBS letters also denied any link. MCMC said it is reviewing and that the described work is not its mandate. Score the production line as documented by the vendor plus the dead domain. Score BBS command, and any Malaysian party or ministry as buyer, as open: Anthropic says clear links and a pursued regulator contract with no evidence of success; the company says none of it is theirs; no paying client is named.

Mechanism is a rented newsroom plus a rented crowd. Claude wrote original copy and rewrote legitimate Malaysian reporting under fabricated bylines that later reporting listed as Azizah Rahman, Sarah Chen, Rajesh Kumar, Priya Suppiah and Zarith Sofiah. The same pipeline stripped state marks from Xinhua, CGTN, Sputnik/RIA and TV BRICS so the cut arrived as independent Malaysian reporting. That is narrative-laundering. Disclosure-theater is the counter-disinfo wrapper on a product whose own dossier work, Anthropic says, was entirely made up and was at points refused by the model as political defamation until the operator sanitized the prompt. Astroturf is the thousand-account layer with warm-up cookies and rotating IPs so the crowd looks aged. Manufactured-consensus is the dashboard that requested one million artificial views on the sitting prime minister's account and recorded millions of artificial engagements on a senior official; those figures are operator-reported, not independently counted. Card-stacking is the targeting graph itself: 222 seats cut by race, religion and royalty, with the opposing file and the original state-media masthead omitted. Synthetic-media is Claude as the newsroom, the dossier clerk and the dashboard coder.

This is propaganda where origin is a commercial shop selling influence, institutional form is a local news site and a regulator-facing intel tool, and the design goal is to move Malaysian belief about parties, race and a sitting government without the audience seeing a vendor or a payer. It is not a finding that Anwar Ibrahim or MCMC commissioned the graph, that one million views landed, that every critic of Pakatan Harapan is a Pulse byline, or that Category Two volume equals a stolen seat. Anthropic itself grades no breakout into authentic communities. A same-method test applies in reverse. A Western consultancy that sold a government a counter-disinfo dashboard while farming a thousand socks and reprinting RT as a hometown paper would be this brief with the nouns swapped.

Literacy counter: if a Malaysian news skin, a constituency explainer, or a dossier on an opposition name arrives with perfect race-religion-royalty targeting and no reporter who will pick up a phone, treat the byline as costume until the domain, the sock-creation stamp and the payer survive a check. A counter-disinfo label is not a source. Apply the same newsroom-to-vendor test when the stack points at another capital.

Tells

• A new local news domain that reprints Xinhua or Sputnik with the masthead stripped
• Fabricated multi-ethnic bylines on constituency explainers registered in the same week as a sock-creation stamp
• A counter-disinfo or cyber-intel pitch sitting on the same graph as smear dossiers
• Engagement dashboards that treat a million views as a deliverable rather than as measured reach
• Warm-up language about rotating cookies and IPs on accounts that all post the same cut

Evidence

1. Anthropic September 2026 threat report, case GTG-84005 on the Malaysia election platform
2. CNA, 11 September 2026: 222 seats, Malaysia Pulse, 1,000 accounts, MCMC pitch, no named buyer
3. Malaysiakini, 12 September 2026: military-grade marketing line, fault-line targeting, one-million-views request
4. Lowyat, 14 September 2026: malaysiapulse.com down; BBS categorical denial; fabricated bylines
5. The Edge Malaysia, 11 September 2026: MCMC reviewing the report and denying any such contract
6. SCMP, 14 September 2026: follow-on on voter-file microtargeting and data-safeguard risk