Anthropic Rewrites Its Usage Policy for Agents, Surveillance and Robots

Anthropic published its annual Usage Policy revision on October 8, with the new terms taking effect November 12. The company frames most of the changes as clarifications rather than new restrictions, but the specifics matter for anyone shipping on Claude: the policy now spells out rules for weapons control software, consent-based tracking, autonomous physical hardware, and even user behavior toward the models themselves.

The update is a useful window into what Anthropic says it has actually been seeing. According to the company, the revisions draw on misuse patterns observed over the past year in influence operations, weapons development, and surveillance, documented in its threat intelligence reporting. Anthropic repeatedly notes that several sections describe enforcement it was already carrying out, just written more plainly.

Deception rules get consolidated

Anthropic says it has seen state media outlets, government propaganda offices, and commercial firms use Claude to operate networks of fake accounts and fabricated news sites. The company says this was already prohibited, but the relevant language was spread across its elections, fraud, privacy, and disinformation sections.

Those rules now live in a single section, titled "Do Not Engage in Deceptive Campaigns or Artificial Activity," covering both political and commercial deception. Per Anthropic, it reaches attempts to hide who is behind a message, amplification through fake accounts or posts, and the construction of tooling and infrastructure for running influence campaigns.

The infrastructure clause is the part worth reading twice. A rule that covers building the tools, not just running the campaign, implicates developers who ship general-purpose automation for social platforms. Anthropic did not publish examples distinguishing legitimate social media management tooling from prohibited influence-operation infrastructure, which leaves that line to be drawn in enforcement rather than in the text.

Elections: narrower, and one prohibition dropped

The elections section is renamed "Do Not Undermine Democratic Processes" and refocused on deceiving voters or disrupting elections. Anthropic cites spreading false information about candidates or voting procedures, impersonating candidates or election officials, and suppressing turnout.

More notable is a removal. Anthropic has dropped its blanket prohibition on personalized vote and campaign targeting, saying the rule swept in legitimate civic work, such as nonprofits producing voter information in additional languages or election officials sending ballot cure notices. The company says the underlying concerns, including deceptive voter targeting and misuse of voters' personal data, remain covered by the deception, surveillance, and privacy sections.

That is a real loosening, and it cuts both ways. A blanket ban is easy to enforce and easy to over-apply; a conduct-based standard is better calibrated but depends entirely on how Anthropic interprets it under pressure during a live election cycle. Anthropic did not disclose how it will monitor campaign-adjacent usage or what review process political clients will face.

Weapons and surveillance: more explicit, same enforcement

Anthropic says people have tried to use its models to build guidance and control software for weapons. The updated weapons section states that prohibitions extend to the software and components that make a weapon function, and to actions such as arming drones and other autonomous vehicles. The company characterizes this as reflecting how it already enforced the prior policy.

The surveillance and criminal justice section was rewritten for precision. Anthropic says tracking people without their consent is prohibited whether it happens in real time or through analysis of previously collected data, and that Claude cannot be used to decide or recommend who to investigate, arrest, or charge. Building or improving tools designed for surveillance is also prohibited. The company points to its September threat intelligence report, which it says documented growing use of AI to build systems that identify and track political dissidents.

The section also lists carve-outs: tracking people have agreed to, such as fraud monitoring, plus content moderation, journalism, and legal research. For security and trust-and-safety teams, those exemptions are the operative text. The gap Anthropic does not address publicly is how it evaluates downstream use, since a vendor selling an analytics product cannot always attest to how an end customer deploys it.

Human-in-the-loop rules, now with hardware

Anthropic says its requirements for high-risk use cases have not changed: when Claude's output can affect someone's health, legal rights, finances, livelihood, or access to essential services, a qualified human with authority to review and override the recommendation must be in the loop, and the affected person must be told AI was involved. What changed is the explanation. Anthropic says customers frequently asked whether a specific use case qualified, so the section now enumerates which categories of recommendations are covered and which are not.

The more consequential addition follows the company's Model Hardware Standard. When Claude is connected to hardware capable of taking autonomous physical actions that could cause injury, Anthropic now requires a qualified operator who can observe the equipment and stop it, and requires the equipment to hold a safe state if Claude is disconnected.

That second requirement is an engineering mandate, not a terms-of-service checkbox. A fail-safe-on-disconnect design has to be built into the controller, and it constrains architectures where the model is the primary decision loop. Teams putting language models into robotics, lab automation, or industrial control should treat this as a design input. Anthropic did not publish conformance testing, audit procedures, or a certification process for these requirements, so compliance appears to rest on customer attestation for now.

A prohibition on abusing the model

The policy adds a ban on sustained and needless abusive or cruel behavior toward Anthropic's models. The company is careful about scope: it says the rule targets extreme cases of repeated cruelty with no discernible purpose, and explicitly does not cover ordinary user frustration, pushback, dark creative themes, or model testing and research.

Enforcement, Anthropic says, will primarily run through the existing capability that lets Claude end rare conversations with persistently abusive users on Claude.ai and Claude Code. In practice that means the model, not a human reviewer, is the first line of enforcement. Anthropic did not say whether repeated conversation terminations feed into account-level action, nor did it publish how often that feature has been triggered.

The provision will read as either a reasonable product guardrail or a philosophically loaded move depending on your priors about model welfare. Anthropic frames it narrowly and ties it to existing product behavior rather than to any claim about model experience.

Supported regions

Anthropic also clarified its Supported Regions Policy. The company says Claude may not be used by people physically located in an unsupported region, by entities incorporated or headquartered in one, or by entities majority-owned or controlled by persons or entities in those regions. The majority-ownership restriction dates to last year's update; this revision addresses how it is enforced. For startups with international cap tables, the ownership and control test is the clause to run past counsel.

What to watch

• Whether dropping the blanket ban on personalized campaign targeting holds up through an election cycle, and what Anthropic does if the conduct-based standard proves hard to police.
• How Anthropic draws the line between prohibited influence-operation infrastructure and legitimate social media automation tooling, since the policy text does not.
• Whether the hardware safe-state and operator-oversight requirements come with any verification mechanism, or remain self-attested by customers.
• How the anti-abuse clause is applied in practice beyond conversation termination, and whether it ever escalates to account enforcement.
• Whether other frontier labs follow with comparable hardware and surveillance language, which would start to look like an emerging industry baseline rather than one vendor's house rules.