Is Anthropic’s Proactive Security Operation a Pre-Crime Mass Surveillance System?

Anthropic called San Francisco police after a Claude user allegedly told the chatbot he had bought an AR-15 and had CEO Dario Amodei “in his sights.” The user later told The San Francisco Standard he was joking. He was not arrested or charged.

The incident offers a window into a broader security operation that is becoming more proactive and less visible to the public. It does not show that Anthropic has built a machine that can identify future criminals.

Anthropic and other AI companies have faced real threats. The Wall Street Journal reported that a man entered Anthropic’s lobby in April and told a security guard that an executive was going to be killed. The incident ended without violence or an arrest, but it came amid heightened concern across the industry about threats, vandalism and protests.

Companies have a legitimate interest in protecting employees, facilities and visitors. The question is where ordinary corporate security ends and a more expansive system of preventive monitoring begins.

A Security Operation Built to Anticipate Risk

The American Prospect reports that Anthropic has expanded its monitoring of threats, protests and activists, and that the company uses a “person-of-interest” process to watch for escalation patterns.

The report stated:

"Job postings and interviews with senior security officials at Anthropic show that the frontier AI lab is building out an extensive monitoring system to keep tabs on activists who oppose the rapid development of artificial intelligence."

and,

"In addition to monitoring activists in the vicinity of Anthropic executives and keeping tabs on protests near physical Anthropic assets, the firm is also implementing a “pre-crime” approach, attempting to predict incidents before they happen. In some cases, that also means reporting suspects to police before a crime occurs. Anthropic did not respond to the Prospect’s request for comment."

The report also describes an Anthropic security manager discussing a protest that Samdesk, a risk-detection company, flagged about an hour before it was set to begin. Anthropic used the warning to reroute an executive and avoid the demonstration.

Anthropic’s own hiring materials support part of that picture. A recent job posting for its Global Safety, Intelligence, and Security team describes behavior-based threat assessments, open-source intelligence collection and tracking of threats that include crime, terrorism and activism. The posting describes a human intelligence function designed to help the company anticipate risk. It does not show that Claude, or any automated system, decides who will commit a crime.

Anthropic told CNET that it disputes The Prospect’s headline and framing. The company said the work is an internal physical-security function meant to protect employees, not a system to surveil activists. It did not dispute the posting’s language, but said “activism” is one of several categories its security team monitors for employee safety.

That response deserves careful consideration. A planned demonstration may disrupt an executive’s schedule or require a change in travel plans. It is not, by itself, evidence of violence. When activism, crime and terrorism appear in the same corporate threat framework, companies need to explain how they distinguish lawful opposition from a credible danger.

“Pre-crime” captures the anxiety many people feel when institutions act before harm occurs. It can also obscure what the evidence shows.

The available evidence documents a human-led corporate-security operation in which analysts collect information, assess patterns, work with outside providers and sometimes refer concerns to police. Anthropic disputes the characterization that it is surveilling activists.

Where the Guardrails Are Missing

The harder questions are about the guardrails. What evidence turns a chat, protest plan or public comment into a reportable threat? Who makes the decision? How long are people kept in files? What recourse exists when an assessment is wrong?

In the San Francisco case, police said an Anthropic employee would not show officers the underlying messages because of company policy. The company said it banned the account and referred the matter to law enforcement as part of its safeguards process. That leaves the public with a familiar problem: a private company may be making consequential judgments about risk without explaining enough about how those judgments are made.

Anthropic’s security buildout may be prudent in a period of genuine threats. But the company has not publicly explained enough for readers to know how it separates a credible threat from lawful dissent, loose talk or imperfect information.