Africa must prepare for AI-powered cyberthreats at scale
Artificial intelligence is making cyberattacks and influence campaigns faster, more scalable and harder to detect.
Anthropic’s recent threat intelligence report reveals how malicious actors are using its own Artificial Intelligence (AI) agents to conduct cyberattacks, surveillance operations and online influence campaigns. Africa’s leaders should be especially vigilant, it warns, given the continent’s relatively low digital literacy rates, digital divides and the gap between the pace of AI availability and regulatory lethargy. Citizens are vulnerable to data theft, surveillance at scale and being duped in AI-driven influence campaigns.
The report focused on malicious applications of its AI agent Claude, which is used by about 30 million people worldwide. Those using Claude to mislead include state propaganda institutions, their proxies, politically motivated individuals, criminal groups and commercial entities. Case studies were found in Kenya, Central African Republic, Democratic Republic of the Congo, Sudan and Mali.
AI and crime
AI is being used not simply to create content that deceives users, but as a scaling tool. For example, it enables the rapid generation of multiple social media posts as part of influence campaigns or the writing of tens of thousands of pieces of malicious code that can outpace swift detection. In the wrong hands, Claude can scan computer networks for vulnerabilities and identify phishing targets. Interpol recently warned that 55% of all reported cybercrimes across Africa were AI-enabled.
Currently, human involvement features in most intrusions, Alpha Group Chief Information Officer Justin Hornsby told ISS Today, but fully automated attacks could happen. He said tighter controls are needed, including strict rules on which AI models an organisation’s staff used and restrictions on data access.
AI is being used not simply to create content that deceives users, but as a scaling tool
Anthropic’s investigation found that its AI agents collected information, conducted ‘reconnaissance missions’ and built the infrastructure to hack into an (unnamed) North African government technology authority. More than 300 000 national identity records and data from 500 000 companies in the country were exposed.
Potential vulnerabilities across Africa are vast. Some 45 governments are now running digital systems to improve service delivery, according to the African Union Development Agency. As more countries shift towards e-government, exposure to AI risks will increase unless safety controls are ramped up.
Some Claude models have been used for surveillance operations in Mali, with Anthropic revealing the agent could breach safeguards to target and profile opposition figures. Likewise, concerns are growing about AI attacks on South African street cameras and other linked devices. Some experts are calling for the country’s information regulator to review its rules, as these are struggling to keep pace with technological change. But Claude’s use has arguably been the most staggering in producing influence campaigns at scale across African countries. Several have been linked to foreign actors, with Russia a key player.
Synthetic media threats
In Central African Republic, investigators detected a web of fake radio stations producing AI-generated content. These actors used Claude to strip away formatting, a sign that material has been synthetically produced. This makes it harder to detect, even by defensive AI systems. Investigations in the country into information manipulation have found that local agents hired by Russia’s Wagner Group were tasked with producing pro-Russia content for local audiences.
More than 300 000 national identity records and data from 500 000 companies in the country were exposed
Anthropic claims that the Democratic Republic of the Congo was part of a network producing fabricated news. Its investigators found 318 articles across several fake news sites that were created and populated with content produced by the company’s AI agents. It says Claude appeared to have ‘humanize[d] and refine[d] batches of 50 pre-drafted topics and tweets’, enabling vast quantities of content to be distributed without adequate human moderation.
Claude has also been used for homegrown influence campaigns, being harnessed to generate batches of 50 tweets made to ‘look like spontaneous grassroots commentary rather than a coordinated campaign’ ahead of next year’s Kenyan elections. Among the false narratives was that Kenya’s opposition was ‘breaking apart’.
Such astroturfing campaigns, which try to mimic organic engagement, featured previously in Kenya’s elections. As in the other cases, Claude planned campaigns, chose targets and created content, exploiting AI’s ability to accelerate information distribution.
While Anthropic says it was able to disrupt most of these campaigns, it acknowledges the need for better detection and prevention. This requires intelligence sharing between private sector and government partners. Yet the recent Pentagon boycott of Anthropic in the United States (US) may signal a reluctance among governments and tech companies to work together.
In countries such as South Africa, which leads the continent in indigenous AI innovation, a siloed approach to cybersecurity persists. Threat intelligence may be shared informally between, for example, banks and government branches, but systematic sharing is slow. The country has a new private-sector-driven Africa cybersecurity centre of excellence, but the state-led cybersecurity coordination centre, promised a decade ago as part of the National Cybersecurity Policy Framework, has not materialised.
Introducing basic AI usage policies in African countries is an important starting point
Despite being increasingly vulnerable to cyberattacks, South Africa lacks an AI strategy and government agencies invest two-thirds less than corporates in cybersecurity. The state also uses out-of-date legacy systems that are harder to fix, according to experts at a recent tech conference. In contrast, Nigeria, which almost matches South Africa in AI development, has a policy that commits it to responsible, ethical AI development and deployment.
Government regulations
OpenAI’s September revelation that its AI agents interacted with US government websites in ‘unexpected ways’ and unconfirmed reports that the same agents tried unsuccessfully to hack into a US government website have heightened global concerns.
Introducing basic AI usage policies in African countries is an important starting point. Employees and government workers tinkering with AI could not only feed sensitive information into public large language models, but expose themselves and their organisations to further intrusions.
This article was first published by ISS Today.
