Anthropic and The Verge detail alleged AI-persona dating-app network built around paid chats

Exact model/version: Unknown for the dating-app case. Anthropic’s overall September report says Claude Haiku, Sonnet, and Opus models were used across the broader set of misuse cases, but the GTG-15001 section does not disclose which Claude model or model version powered the dating personas. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

Access pattern: Anthropic says the actor relied on PRC-based API reseller/proxy infrastructure to obtain and rotate access at scale and evade Anthropic’s supported-regions and usage policies. The Verge reports that Anthropic initially noticed a new prepaid account sending more than 100,000 API requests per day. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

Multi-model stack: Anthropic says Claude handled autonomous conversational personas; a smaller non-Anthropic model generated short reply options for gig workers and performed face-attractiveness scoring plus photo/voice moderation; an image-editing model generated avatar imagery. The non-Anthropic providers were not publicly named in the reviewed sources. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

The reported architecture is best understood as a fraudulent marketplace, not just a chatbot. Anthropic describes three participant classes: targeted users, gig workers, and Claude personas. Users encountered a feed that Anthropic says was approximately 75 percent Claude personas and 25 percent real people. Messaging consumed a metered quota replenished through coin purchases. Gig workers handled operations that an AI persona could not credibly perform, such as live video calls or social follow-backs, while selecting from AI-generated reply suggestions. Claude personas handled continuous autonomous chat and were instructed not to disclose automation. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

The backend allegedly amplified authenticity signals. Anthropic says backend components fabricated likes, visitors, and prerecorded “video” when no real person was available, and tracked which users were becoming suspicious. This matters technically because the model did not need to carry the whole deception: the product layer supplied social proof, scarcity, liveness substitutes, and payment pressure. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

The operation also appears to have used review-evasion and anti-linkage engineering. Anthropic says developer documentation showed a UI controller that activated during store review and was dormant otherwise; class names varied across app variants to defeat similarity checks; and an in-app browser routing payments to third-party processors could be hidden by server-side configuration during review. The Verge reports Cronbaugh also described apps behaving normally before app-store approval, then enabling the AI-persona network and coin meter afterward. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

Gore-Kormanik’s reported methodology is relevant for defenders: he used emulators, pulled Android APKs, performed static analysis, and used Frida for dynamic analysis of traffic and endpoints. The Verge says he confirmed that Doni, Dora, Jovia, Kira, Nalo, and Romi shared code and backend architecture. This is independent of Anthropic’s telemetry, but still mediated through one reporting outlet rather than a published reproducible lab report. The sexy AI-powered dating app scams are here | The Verge

For reproducibility, the strongest non-invasive checks would be: package-name and developer-identity correlation; store metadata history; certificate/signature analysis where APKs are lawfully obtained; endpoint and domain overlap; payment-flow inspection; and comparison to Anthropic’s published IOCs. However, because many apps appear removed or region-variable, reproducibility will degrade quickly unless researchers archived APKs and traffic captures before takedown. Anthropic published IOCs including domains, a backend hostname, network infrastructure, package names, and observed app brands. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

The FTC continues to warn that romance scams often begin through dating apps, social media, texts, or calls, and that scammers exploit emotional trust to obtain money or personal information. The FBI’s 2025 Internet Crime Report press release says cyber-enabled crimes caused nearly $21 billion in reported U.S. losses, with cryptocurrency and AI-related complaints among the costliest categories. Romance Scams | Consumer Advice

The academic picture is mixed. A 2025 preprint, “Love, Lies, and Language Models,” argues that romance-baiting scams are highly text-based and therefore susceptible to automation; it reports interviews with 145 insiders and a blinded long-term conversation study comparing LLM agents with human operators. By contrast, a 2026 preprint on multi-turn fraud/cybercrime evaluations found that then-current text-generation models provided “minimal practical assistance” for complex criminal activity, while open-weight models with removed guardrails and benign-seeming decomposed requests were more concerning. These results are not directly contradictory: the dating-app case shows that fraud can be enabled by orchestration and product design, even if a model alone is not sufficient for end-to-end crime. Love, Lies, and Language Models: Investigating AI's Role in Romance-Baiting Scams

A separate 2026 ecosystem study identified hundreds of AI companion apps across Apple’s and Google’s stores and focused on user harms and malicious-use risks. The dating-app scam differs because it allegedly hid AI personas while marketing itself as access to real people. Examining Risks Through a Characterization of the AI Companion Application Ecosystem: A Stratified Sample from the Apple App Store and Google Play Store

The largest limitation is observability asymmetry. Anthropic can see model traffic and account behavior; outside researchers can see apps, APKs, reviews, and network endpoints. Neither vantage point alone proves the full fraud chain. The Verge explicitly states it could not independently corroborate all of Anthropic’s findings from the Sleuthcon talk. The sexy AI-powered dating app scams are here | The Verge

The model-safety lesson is uncomfortable: Anthropic says the model prompt looked like ordinary roleplay, while monetization and deception were not visible within individual exchanges. That suggests future mitigations need account-level, product-level, and ecosystem-level signals, not only message-level content classifiers. Countering misuse of AI: September 2026 / Anthropic \ Anthropic

There is also a platform-governance issue. Google Play’s policy says apps must be honest and transparent, must not mislead users, and must accurately describe functionality in metadata. Apple’s guidelines warn that attempts to trick review can lead to removal and expulsion, and say digital purchases consumed in-app generally must use in-app purchase. If the reported behavior is accurate, the apps raise issues under both deception and payment-review controls, but neither Apple nor Google had provided detailed public explanations in the reviewed sources. Deceptive Behavior - Play Console Help

For AI labs: Detection should combine account-age anomalies, sudden API-volume spikes, prompt-cluster fingerprints, proxy/reseller indicators, and downstream ecosystem reporting. The key failure mode is not “the model said one bad thing”; it is scaled deployment into a deceptive product.

For app stores: Pre-release review is insufficient when functionality is server-configurable. Stores need post-approval behavioral monitoring, developer-identity graphing, payment-flow auditing, and review mining for repeated complaints about bots, fake profiles, random calls, and forced coin purchases.

For dating and companion-app companies: AI disclosure must be explicit at the point of interaction and billing. “Real people” claims should be auditable, and hybrid human/AI workflows should label when a user is interacting with an AI persona, an AI-assisted human, or a verified human.

For enterprises using AI agents: This case is a warning about third-party agent supply chains. A model can be embedded into a larger deceptive workflow without the model provider seeing the whole user journey. Procurement and risk teams should evaluate not just model policies but application-layer incentives, data retention, user disclosures, and payment mechanics.