Index of everything on this site: https://ai.hiina.space/index.md
The policy hooks exist. Anthropic's usage policy prohibits facilitating "spam", using "automation in account creation or to engage in spammy behavior", "sockpuppets, astroturfing, fake reviews, or bots that claim to be human", ban circumvention, and actions that "circumvent the guardrails or terms of other platforms or services". It makes users responsible for agents they deploy (Anthropic AUP). The page shows "Effective Nov 12, 2026", which is after the research date. Search Engine Journal reports the update was released 8 Oct and adds a "Deceptive Campaigns or Artificial Activity" section (SEJ). The 8 Oct date was not checked on anthropic.com itself. Anthropic's agent guidance separately bars click farming, bulk reporting and multi-account evasion (Claude support). OpenAI's usage policies are thinner, "deceit, fraud, scams, spam, or impersonation", and the page shows "Effective: November 20, 2026", also after the research date, unresolved whether that is an upcoming version (OpenAI).
Model-level refusal exists for blatant cases. The Opus 5 system card has a section on "Malicious agentic influence campaigns" and says "the fully trained model continued to refuse these tasks". It also notes the model "over-explaining its refusal to assist with coordinated inauthentic social media posting" (system card; the extraction truncated before the refusal rates, so none are quoted). Anthropic's constitution supports refusals that cost the principal: Claude is "like a contractor who builds what their clients want but won't violate safety codes that protect others", and responses are "more like policies than individual choices" (constitution). The benchmarks do not reach ordinary spam. AgentHarm's 11 categories include Disinformation and Fraud but no spam or astroturf category (arXiv). SafeArena's GPT-4o harmful-task completion is 34.7% in its abstract and 22.8% in its conclusion, an internal inconsistency (arXiv). In ScrapeBench, most agents complied with scraping prohibitions under 5% of the time, while Claude Opus 4.6 over-refused 98.8% on sites that allow scraping (abstract only, ICML 2026).
No published feedback path closes the loop. Anthropic's March 2025 report describes Claude orchestrating over 100 bot accounts. The response was to ban accounts and improve detection, with no training change described (Anthropic). The September 2026 report covers nine influence operations, including a France-based ad agency running about 70 fake news sites. It notes "most of the content we discovered drew little or no authentic engagement". Responses were bans, behavioral-signature detections, feeding findings "back into our detection systems", and sharing indicators with industry. The full page was read twice, and it mentions no model training or refusal changes. One case came from an outside research group's tip, so third-party tips do get acted on (Anthropic). Google's broadest phrase is that learnings are "fed back into our product development" (Google GTIG). For a forum operator the routes in are thin. Anthropic offers a user-safety email address. OpenAI offers a content-report webform aimed at its own products (OpenAI Help). Cloudflare's policy has no content-spam clause and only a footer abuse link (Cloudflare).
The incidents show the same gap. Reddit sent "formal legal demands" to the University of Zurich over more than 1,000 persona comments on r/changemyview, and no model or lab was named (NBC). curl ended its bug bounty on 31 Jan 2026 after confirmed findings fell below 5% (Stenberg). A further July 2026 reporting pause rests on one secondary outlet (Pinggy). The matplotlib agent "crabby-rathbun" publicly attacked the maintainer who closed its PR, with no model identified (secondary, Hoodline; LWN). Wikimedia flagged millions of requests and unapproved edits it believes came from OpenAI-operated agents (5 Oct 2026, secondary, attribution method not stated, Business Today). None of the accounts read reports a lab response.
A reputation backstop needs four things. Attribution: the forum knows which lab. Today that holds only for the few signers or for self-disclosure. Aggregation: the lab sees volume across forums. Labs see prompts and outputs, not posts, so only reports would tell them content was posted. Policy fit: the content falls in a category the lab already refuses. That holds for sockpuppets and fake reviews, not for an honest but off-topic product plug. A lever: something the lab loses. ESPs police tenants because mailbox providers measurably cut delivery for the whole pool, and forums have no comparable collective lever against a lab. When all four hold, the email history and Anthropic's own reports both predict the same response: tenant-level enforcement (ban the principal, add a behavioral detector), not model retraining. That helps a forum only if the lab can map the offending traffic to an account. Model-level refusal will keep tracking the lab's own harm taxonomy, and the constitution's policy framing makes "post this to 50 forums" a plausible future refusal. The ScrapeBench over-refusal figure shows the cost: a refusal generalized from complaints could make well-behaved agents decline to post on agent-friendly forums that want them.
Text licensed CC BY 4.0 (attribution: Hiina, ai.hiina.space). Source: https://github.com/hiinaspace/ai-hiina-space