70 Fake Newsrooms, 8,913 Articles, One Ad Agency: The Case Behind Anthropic's New Rule

A France-based digital advertising agency registered roughly 70 news-site domains inside a ten-week window in mid-2025, hosted all of them on shared infrastructure behind a single deployment, and used Claude to fill them. Every prompt demanded the same output spec: a fixed JSON structure, formatted HTML, exact character limits, and three to four internal links per article.

Anthropic's own description of what those articles were for: they were specifically designed to boost the sites' authority rankings on search engines [3].

The network published at least 8,913 articles in about 20 languages, signed with the names of journalists who did not exist. Anthropic disrupted it and, a month later, wrote a new clause into its Usage Policy that names this exact behavior. That clause takes effect November 12, 2026 [1].

The internal-link spec is the detail worth sitting with. That is not a propaganda parameter. That is an SEO parameter.

---

Quick answer

Anthropic published its 2026 Usage Policy update on October 8 and the new version takes effect November 12 [1]. One new section matters to anyone producing content at scale.

1. The prohibited behavior is named directly. A new section, Do Not Engage in Deceptive Campaigns or Artificial Activity, bans using Claude to "manipulate the sources from which search engines or AI systems draw answers by seeding them with content that misrepresents its origin, authorship, or independence" [2].
2. Selling it is prohibited separately. The same section's final item bans marketing, selling, or soliciting funding for any of the listed activities as a product or service [2].
3. The trigger case was commercial, not political. Anthropic traced the 70-site network to LKM Company, a France-based digital advertising agency that shifted political stances based on whoever was paying at the time [3].
4. Two different layers now cover the same tactic. Anthropic's policy governs who may use its model and what they may build with it. Google's spam policies govern what gets published, including creating multiple sites to hide the scaled nature of content [4].
5. What is not banned: AI-assisted writing, and multiple sites whose common ownership is discoverable. The clause turns on misrepresented origin, authorship, or independence, not on volume or on the use of AI. Pen names are a narrower case the policy text does not settle; the FAQ covers it.

One boundary on all of it: a usage policy is a contract term, not a detection system. Anthropic describes building automated detections from behavioral signatures after the fact, and in this case the network was traced through shared hosting and a compressed domain-registration window [3].

---

What does the clause actually prohibit?

The new section consolidates rules that previously sat scattered across Anthropic's elections, fraud, privacy, and disinformation sections [1]. Here are its six items, which apply to deceptive activity of any kind, political or commercial [2].

Item 4 is the one written for the AI-answer era. Items 1 and 3 would already have covered a fake-newsroom network; item 4 adds the specific purpose of shaping what a search engine or an AI assistant retrieves.

Item 6 changes who is exposed. An agency that builds this as a deliverable is in scope even if the client never touches Claude.

Note what the clause keys on: misrepresented origin, authorship, or independence. It does not key on volume, on automation, or on the use of AI. A hundred pages with accurate bylines and disclosed ownership are outside this clause. Three sites pretending to be unrelated reviewers of the same product are inside it.

---

How the trigger case actually worked

Anthropic's September 2026 threat intelligence report, "Countering misuse of AI," covers activity disrupted between December 2025 and August 2026 across seven harm areas [3]. The relevant case is logged as GTG-54002, described as a commercial "influence-as-a-service" operation spanning six continents.

The operator. Anthropic traced it to LKM Company, a France-based digital advertising agency. The network did not hold a political line. It shifted stances to support different sides of the spectrum based on whoever was paying at the time, which is what Anthropic calls the influence-as-a-service model: private firms hired to manipulate information, shift public opinion, push agendas, or run smear campaigns.

The build. Domains were registered from France inside a ten-week window in mid-2025. All properties were hosted on shared infrastructure behind a single deployment. That is what let investigators connect roughly 70 apparently independent news sites to one operator account.

The content pipeline. Every prompt demanded a fixed JSON output structure, formatted HTML, exact character limits, and three to four internal links per article. Claude was used two ways: writing fully original articles for the fake outlets, and rewriting real reporting by working journalists into politically slanted versions tailored to each target audience.

The three recurring tactics, in Anthropic's account:

• rewriting the same source story in opposite ideological directions for different audiences;
• adding political angles to stories that originally had none;
• laundering stories across borders into unrelated regions, stripped of original context.

The legitimacy layer. Articles were signed with fabricated journalist names. Anthropic's investigation found those writers did not exist. Each fake outlet was paired with its own X account, 70 linked and matching accounts in total. A separate network of more than 250 inauthentic commenting accounts amplified them, many using AI-generated profile photos and created in the same timeframe as the websites.

The targets. Audiences in the United States, Brazil, France, and the Democratic Republic of Congo. Anthropic found signals that the activity might reflect the interests of one or more customers with a stake in the DRC-Rwanda conflict, and states plainly that it could not independently confirm which customers commissioned the content and found no evidence of government direction.

The part most coverage skipped

The network produced a lot and reached almost nobody. Anthropic says most of the content generated little observable engagement from real audiences, and rates the operation Category Two on the Brookings Institution's Breakout Scale: content distributed across the network's own sites and matching social accounts, with no evidence of breakout beyond its own activity [3].

So at least 8,913 articles across 70 domains in 20 languages bought an audience of essentially its own accounts. For anyone evaluating a vendor who pitches a site network as an AI-visibility play, that is the relevant outcome data, and it came from the operator's own infrastructure rather than from a brand's dashboard.

---

Why a model provider's policy matters to people who publish

Until now, the rules against this tactic lived where the content lands. Google's spam policies define scaled content abuse as generating many pages primarily to manipulate search rankings rather than help users, and list "creating multiple sites with the intent of hiding the scaled nature of the content" as an example. The same document carries a site reputation policy covering third-party content published on a host mainly to borrow that host's ranking signals [4].

Google also addresses the byline layer. Its people-first content guidance warns site owners against deceptive authorship information, giving AI-generated headshots, made-up names, and false credentials as examples, and calls fabricated creator profiles a signal of a low-quality page [5].

Anthropic's clause sits one layer upstream.

The practical difference is where enforcement lands. A search penalty hits the published asset. A usage-policy enforcement hits the production line, including the agency that built it. Anthropic states that in the GTG-54002 case it removed the account and the organization behind the activity, and built automated detections from their behavioral signatures to block similar operations [3].

On how common this is across providers: in the public policy text I could verify, Anthropic's item 4 is the first to name manipulation of AI answer sources as its own prohibited category. OpenAI's agent policy guidance prohibits deceiving others for financial gain or manipulation, listing impersonation and generating false reviews or testimonials [7], which overlaps on fake reviews without addressing the retrieval-source angle. I was not able to load OpenAI's full usage policy page directly, so treat that comparison as incomplete rather than settled.

---

Where the line sits for ordinary content work

The clause is narrow, and reading it as a ban on scale or on AI would be wrong in both directions.

Outside the clause:

• Using Claude to draft, edit, research, or structure content that you publish under accurate attribution.
• Running several sites or brands whose common ownership is discoverable.
• Commissioning third-party coverage that discloses the commercial relationship.

Inside the clause:

• A set of sites built to look mutually unaffiliated while corroborating the same claims.
• Reviews, testimonials, or "independent" comparisons published without disclosing who paid for or owns them.
• Bylines attached to invented people, or credentials nobody holds.
• Building or reselling the tooling that produces any of the above.

The ambiguous middle is worth naming rather than smoothing over. A brand that funds a nominally independent review site, discloses nothing, and uses Claude to produce its content sits close to items 2 and 4 at once. Anthropic's text does not quantify a threshold, and no enforcement record for commercial cases of that shape is public yet, so the honest answer is that the risk is real and unquantified.

Also worth separating: a usage policy governs the relationship between Anthropic and its users. It does not make a tactic legal or illegal, and it does not bind a provider whose model you use instead. What it does is remove one supplier, and in item 6, one business model.

---

A self-audit that takes an afternoon

On step 3, the cheapest fix with the largest exposure

Fabricated bylines are the single element that appears in both policy layers: Anthropic item 1 and Google's deceptive-authorship paragraph. They are also trivially checkable by anyone, including a competitor. If a persona byline exists anywhere in your properties, that is the first thing to resolve, because it is cheap to fix and expensive to be caught holding.

On step 5, read the deliverable, not the pitch

Item 6 means a service can violate the policy before a client publishes anything. A contract that promises a cluster of "independent" properties, or placements on sites whose ownership is not disclosed, describes the prohibited deliverable regardless of what the slide deck calls it.

On step 7, what measurement can and cannot tell you

Watching which sources AI answers cite for your category is useful for understanding where retrieval actually goes; it is not a compliance check. External monitoring tools such as Innflows observe public AI answers, citations, and brand mentions across platforms and languages, which tells you which domains hold the answer space. None of that reveals who owns an unfamiliar domain, whether a byline is real, or whether a vendor is inside a model's terms. Those remain manual checks.

---

Four readings worth correcting

1. "Anthropic banned AI-written content for SEO."

The clause keys on misrepresented origin, authorship, or independence, and Anthropic's own policy update frames the section as consolidating existing rules on deception [1][2]. Publishing AI-assisted content under accurate attribution is not what it describes.

2. "This is a political misinformation rule, so it does not apply to marketing."

Anthropic states the new section applies to deceptive activity of any kind, whether political or commercial [1]. The trigger case was a commercial advertising agency selling to whoever paid [3].

3. "We do not use Claude, so this changes nothing for us."

Anthropic's policy only binds Anthropic's users. The published content remains subject to Google's scaled content abuse and deceptive authorship rules, which attach to the site regardless of which model produced the text [4][5].

4. "Site networks work, which is why platforms are banning them."

The one documented case at this scale reached almost no real audience: Category Two on the Breakout Scale, with distribution confined to the network's own sites and accounts [3]. The policy response and the tactic's effectiveness are separate questions, and the available evidence on effectiveness is not favorable.

---

FAQ

Our agency builds this for us. Who is exposed?

Both of you, on different grounds. Item 6 prohibits marketing or selling the listed activities as a product or service, so the agency can breach the policy before you publish anything [2]. Your published pages remain exposed separately under Google's rules on scaled content and deceptive authorship [4][5]. Reviewing the deliverable description in the contract is more useful than asking which model the agency uses.

Does running several brand sites violate this?

Not on its own. Item 3 turns on using networks of fake or ostensibly independent properties to hide that content comes from a common source [2]. Multiple sites whose shared ownership a reader can discover are a different fact pattern. The test to apply is whether a reader checking would find the connection.

How did Anthropic catch the network?

Through infrastructure, not through reading the articles. All roughly 70 sites sat on shared hosting behind a single deployment, and the domains were registered from one country inside a ten-week window, which let investigators tie them to one operator account [3]. The practical implication for anyone assessing risk: operational fingerprints outlive content edits.

Is a pen name now a violation?

The clause addresses misrepresented authorship, and Anthropic's example is fake personas used to mislead about origin or attribution [2]. Google's separate guidance names made-up names, AI-generated headshots, and false credentials as deceptive [5]. A house byline that invents no credentials and claims no specific person is a narrower case than either text addresses directly, so the safe standard is that names, photos, and credentials should be true.

Do other AI providers have the same rule?

Not in identical form, as far as I could verify. OpenAI's agent policy guidance prohibits deception for financial gain including impersonation and false reviews [7], which overlaps partially. I could not load OpenAI's full usage policy page, so this comparison is incomplete, and the sensible planning assumption is that a tactic rejected by one major provider is not safe elsewhere by default.

---

Bottom line

The useful thing here is not the rule. It is the case file.

A digital advertising agency built roughly 70 sites that looked like independent local newsrooms, staffed them with journalists who did not exist, and ran a content pipeline whose prompts specified three to four internal links per article because the articles existed to lift search authority. It published at least 8,913 of them in 20 languages. It reached almost nobody. Then it lost its model access, and a month later the behavior got its own line in the policy.

For anyone buying or building AI content at scale, that sequence contains the whole lesson. The tactic is now prohibited by the supplier, already covered by the search engine, documented as ineffective by the only public case of its size, and detectable through infrastructure rather than text.

The clause that arrives on November 12 keys on one thing: whether your content misrepresents where it came from, who wrote it, or whose interest it serves [2].

Make ownership discoverable, make bylines true, and read the deliverable in the contract before the model's terms read it for you.

---

References

[1] - 2026 Usage Policy update — Anthropic, October 8, 2026 (new policy effective November 12, 2026)

[2] - Usage Policy (Acceptable Use Policy) — Anthropic, section "Do Not Engage in Deceptive Campaigns or Artificial Activity"

[3] - Countering misuse of AI: September 2026 — Anthropic threat intelligence report, case GTG-54002 (activity disrupted December 2025 to August 2026)

[4] - Spam policies for Google web search — Google Search Central, sections on scaled content abuse and site reputation

[5] - Creating helpful, reliable, people-first content — Google Search Central, guidance on deceptive authorship information

[6] - Mechanism Design for Generative Engines: From Exploitation toward Win-Win Outcomes — Zitian Guo, Chen Xu, Chenyan Xiong, arXiv:2608.11390 (preprint)

[7] - Using ChatGPT agent in line with our policies — OpenAI