A CCP Religious Affairs Intelligence Operation Used Claude to Track Falun Gong Practitioners, Shen Yun and NTD Daily

Anthropic’s fourth threat intelligence report, published on Sept. 10, 2026, devotes a section to surveillance operations the company detected and shut down between January and July of this year. Two of those cases concern Falun Gong directly.

The first, GTG-14020, is described in the report as a China-based religious affairs intelligence operation targeting Catholic, Tibetan Buddhist, Falun Gong and Taiwanese Christian communities. The second, GTG-14022, is a China-based “public opinion monitoring” and dissident surveillance operation that treats Falun Gong activity as a standing item to be tracked.

Anthropic banned the accounts and improved its ability to spot similar activity. It says the targeting lines up closely with the priorities of China’s religious affairs and united front bodies—the United Front Work Department, the Ministry of State Security, and the former State Administration for Religious Affairs. One of the people behind the accounts told the model outright that he was an information security officer for the Chinese state.

One of those three bodies is a Party organ rather than a government ministry, and it is the one that matters here. The State Administration for Religious Affairs was a State Council agency until March 2018, when the CCP (Chinese Communist Party) Central Committee’s plan for deepening reform of Party and state institutions merged it into the Central United Front Work Department.

One person replaced a department

The operator ran four work streams at once. Claude read source material in several languages, translated it, and filled in Chinese-language templates—personnel research drafts (人物调研底稿), investigative clue reports (线索报), and daily situational awareness digests (态势感知).

Every template required the same three things about a subject: their China-related activities, any scandals, and their 工作抓手—a United Front Work Department term the report translates as exploitable leverage. Literally, “a handle to grab someone by.”

Output from that single desk: 2,475 finished dossiers, clue reports and digests in 30 days. The report’s own diagram contrasts this with how the job used to be done—a staffed desk with many analysts—and makes the point plainly. What is new here is throughput and scale facilitated by new AI tools. Nothing in this operation would have surprised anyone familiar with how the 610 Office worked in 2005. What changed is that one officer can now do in a month what once took a floor of people a year.

Falun Gong watched most closely

The report lays out the five work streams side by side:

Read down the second column. Four of the five work streams target leadership, institutions or administrations—cardinals, church leaders, the administration in exile, ministries. The Falun Gong line is the exception. Its target set is practitioners: ordinary people who do the exercises, plus the organizations practitioners founded, named individually as Shen Yun and NTD.

Falun Gong also shares with the Tibetan work stream the most frequent reporting cycle in the table—daily—and it is the only group assigned continuous monitoring digests rather than files opened one subject at a time. That is the difference between a filing cabinet and a live feed.

And Falun Gong appears again in the second operation, GTG-14022, where it is listed with Uyghur and Tibetan activity as a monitoring category alongside named advocacy organizations.

Two operations, run by different actors, both with Falun Gong on the list. Twenty-seven years into the campaign, the community is not a legacy file being maintained out of habit. It is active collection.

What the CCP collected

Per the report, the operator gathered birth dates, birthplaces, immigration dates and social media handles for specific individuals. It also mapped religious venues—floor plans, building façades, structural diagrams.

Collection ran across Chinese platforms (WeChat, Xiaohongshu, Douyin, Weibo) and Western ones (LinkedIn, Instagram, Threads, X, Facebook), on a daily cycle.

Subjects ranged, in the report’s words, from senior public-facing religious figures down to private citizens. The report illustrates this with a redacted LinkedIn profile belonging to one of the surveilled people: “an instructor at a Falun Gong-affiliated college.” Anthropic says the actor compiled profiles on educators and practitioners connected to the diaspora.

An instructor at a small college in the Hudson Valley, profiled from a public résumé, by an office in China, as part of a daily intelligence product. That is the scale this technology brings within reach.

The operator also told the model how to think. The prompts instructed Claude to adopt “China’s standpoint,” to describe the Tibetan administration in exile as an illegal separatist administration, and to apply the state’s “evil cult” (邪教) label to Falun Gong. The persecution’s founding designation is being written into the files themselves.

Surveillance set up for the harm

This is what should not get lost in the technical detail.

A person’s profile is assembled entirely from public sources. Birth date. Birthplace. Immigration date. Social media handles. Each is harmless on its own. Yet putting together they can be enough to identify which relatives are still in China, to establish someone’s immigration status, and to fill in the leverage field that every one of those templates requires.

That field is the operational heart of the workflow. It exists for one reason: to find the pressure point.

Our own survey work shows what happens once the pressure point is found. In Americans Targeted by Beijing, published in June, more than 60 percent of respondents—662 people—said they felt somewhat or very unsafe about Chinese surveillance, particularly of their phones and internet use. At least seven reported being threatened with specific details about their personal information, activities or travel plans, delivered either by a direct call from the security apparatus or relayed through relatives in China.

The pattern in those accounts echo what the Anthropic report describes from the other end:

• A New York practitioner working in media mentioned upcoming travel to Taiwan to a few friends in 2023. Shortly afterward his relatives were pressed to pass along a message from the Ministry of State Security: better to return to the mainland than go to Taiwan. He concluded, correctly, that his movements were being tracked.

• A woman received a call on her New York home landline from a Ministry of State Security representative in Beijing, who addressed her by name and warned her to stop her activism, framing it as inciting subversion of state power.

• A young practitioner in New York described security police monitoring his video calls with his parents in China. As he put it, “They know everything we say”—the local police station’s own words to his parents. In July 2025, days after his mother mentioned sending him money, officers arrived demanding to examine the family company’s finances and the sources of its funds.

The Information Center has documented hundreds of transnational repression cases against U.S.-based practitioners and Shen Yun since 2020, including assault, property damage, threats and reprisals against relatives in China. Fifty of those cases involved surveillance.

Though the Anthropic report does not add new victims to that count, it does provide new information about the machinery on the other side of the glass—and confirmation that the specificity practitioners kept describing was not paranoia.

Conclusion and recommendation

AI tools have significantly dropped the cost of watching someone. Beijing targets the same people it always has, but cost is what decided, for twenty-five years, who got a file and who did not. One officer can now do that kind of work that was done by a department before. Any individual or organization potentially targeted by Beijing, now must assume that they are being watched and analyzed. For a Falun Gong practitioner, that happens on a daily basis.

With this new landscape, below are a few recommendations for potential targets of the CCP’s escalated surveillance and the U.S. government:

• For practitioners: Read your public profiles the way a collection desk would. Employer, city, arrival date, hometown, family references—harmless alone, a complete picture together. Be careful about pairing full names, photographs and affiliations if you have close family in China.

• For practitioner community’s organizations: Treat event and performance logistics as operational information, not publicity copy. Assume anything posted publicly is read the same day. Report harassment, venue pressure and approaches from people who know internal details to law enforcement and to the Falun Dafa Information Center.

• For the U.S. government: Establish a channel to warn the people being watched. Anthropic identified a surveilled private citizen and banned the accounts responsible. Yet the target presumably still does not know. A notification channel from AI companies to designated civil-society intermediaries, with privacy protections, is achievable. Congress could ask for it. So could the State Department’s transnational repression work.