Anthropic exposes network of ~28 AI-powered dating apps using Claude to run automated catfishing scams at scale

Anthropic disclosed, via a June 2026 Sleuthcon talk and a September 2026 misuse report, that it identified roughly 28 fraudulent dating apps running AI personas on Claude through a single prepaid API account making over 100,000 requests a day. The operation paired autonomous chatbot personas with low-paid gig workers who used pregenerated replies to pass liveness checks and sustain the illusion of a real person. The Verge and independent researcher Matthew Gore-Kormanik corroborated the findings, including locating an internal protocol repository, and reported that many of the apps were still live on major app stores at time of publication.

This is a well-corroborated case (vendor disclosure plus independent researcher and journalist verification) rather than a single-source claim, which is unusual for abuse reporting and makes the facts more trustworthy. It matters most to app store trust and safety teams, consumer protection regulators, and AI vendors' misuse-detection functions, since it shows a scalable, semi-automated fraud model that blends bots with human cover to evade both liveness checks and platform review. The direct impact is bounded to consumer fraud rather than any shift in AI capability or market structure, and there is no confirmed dollar figure for user losses or victim numbers yet.

The Verge's "sexy" framing oversells the novelty. AI catfishing and fake-dating-app scams are not new. What is genuinely new here is the scale and operational detail (one API account, 100k+ requests a day, gig workers on standby), not the underlying scam concept. The claim that the apps "remained live" should be read as a snapshot at publication time, not a fixed state.

1. 01Whether Apple's App Store and Google Play actually remove the ~28 named apps (Dora, Romi, Doni and others), and how long that takes after the disclosure
2. 02Whether Anthropic (or another AI vendor) publishes any account-level enforcement action against the prepaid API account or discloses revenue/detection figures beyond the single account cited
3. 03Whether regulators (FTC, UK equivalents) or app-store trust and safety teams open a formal inquiry, and whether any user financial-loss figures or victim counts emerge