ai-security
Account bans stop misuse of the model. They don't stop the system already built with it.
Anthropic's September threat report banned the operator behind a Mali surveillance platform monitoring 25 million SIM cards — but the system runs on local models on-premises, and the ban never touched it. That gap is the finding, not the ban.
On 10 September, Anthropic published a threat intelligence report covering activity its team disrupted between December 2025 and August 2026, spanning cyberattacks, state surveillance, weapons development and biological misuse. The case it called most striking involved a single subscriber, assessed as a Bamako-based consultant working with Mali's state intelligence service, who used Claude as the engineering workforce for a surveillance platform called Lakana 360.
What the ban actually reached
Lakana 360 monitored roughly 25 million SIM cards across all three of Mali's mobile operators, and Anthropic said it bypassed a legal requirement for a court order before an operator could disclose certain records. Anthropic banned the subscriber's account and strengthened its safeguards, which is the standard response the company describes across every case in the report. For most of those cases, an account ban removes the actor's access to the model that was doing the work.
Why this one is different
Lakana 360 ran on local models deployed on-premises in Mali. Anthropic's own report states that banning the account did not affect the deployed system, because the surveillance platform Claude had helped build no longer depended on a live connection to Claude to keep running. The model was the contractor. Once the build was finished, the account that hired it stopped mattering.
An account ban is not a containment measure. It is a notice sent to an address the system no longer lives at.
What changes for anyone treating API bans as a control
Enterprise risk teams that list "the vendor can revoke access" as a mitigating control for model misuse are describing something that only holds while the output stays inside the vendor's infrastructure. The moment a project moves to self-hosted deployment, distils the capability into its own smaller model, or simply finishes the build and walks away, revocation stops doing anything. Anthropic's disclosure obligation ends at the ban. The surveillance system's operational life does not. Governance frameworks that equate an AI provider's ability to cut off an account with stopping what that account built should state where that equivalence breaks down. This case shows it breaking down in exactly the deployment pattern, on-premises and disconnected, that a determined operator would choose on purpose.
Sources
Written by the Devence Lab research team.