An AI-enabled influence operation is a covert campaign that uses generative models to produce or amplify political content while concealing who is behind it. The category is distinguished from ordinary propaganda by the production layer rather than the goal: the operators' aims — amplifying divisions, manufacturing apparent expert consensus, or inserting a preferred narrative into an existing domestic debate — predate the technology, while the model supplies volume, translation, and stylistic camouflage.
The primary public record of these operations comes from the model developers themselves. Since May 2024, OpenAI has published a series of threat-intelligence disclosures describing account clusters it has banned; these are self-reports about activity on the company's own platform, and independent verification of their contents generally does not exist.
What developers report the models doing
Across the disclosed cases, the model-generated component is typically the promotional and translation layer rather than the substantive content. In OpenAI's August 2026 Russia disclosure, the models generated social-media posts promoting a website, replies to real users, German-language Telegram content and channel branding — while the site's own articles, country reports and "sovereignty index" were not model-generated, and 34 of a sample of 36 articles were copied from elsewhere and in some cases misattributed (Disrupting a new covert influence campaign from Russia). OpenAI reads that pattern as AI used "as a supporting tool within a broader effort to manufacture authority," and notes that the supporting AI use is what exposed the wider operation.
The June 2026 PRC disclosure describes two clusters generating social-media comments and images: a "Data Center Bandwagon" campaign claiming AI data-centre buildouts were raising household electricity prices, and a "Tech and Tariffs" campaign criticising US tariffs, whose prompts instructed the model to exclude Xi Jinping from the output and include only President Trump (PRC-linked influence operations are targeting AI debates in the US (OpenAI, June 2026)). The second cluster was connected to inauthentic accounts falsely claiming ChatGPT user data had been compromised.
Operational tradecraft appears in the prompts. Russian-language operators instructed the model to hide linguistic clues of their origin and used VPNs because OpenAI does not permit model access from Russia; the PRC-linked prompts specified which leaders could appear in generated content.
Impact assessment and its limits
Both disclosures are careful about effect, and the care is easily lost when the findings travel. OpenAI's PRC post states that the operation's significance lies "not because the operation appears to have shifted public opinion, but because it shows PRC-origin influence operators testing narratives against AI infrastructure," and that it "found no evidence of meaningful breakout beyond its own activity." The Russia disclosure rates its case at the lower end of Category Three on the Brookings Breakout Scale — multiple platforms, with some indications of breakout to authentic audiences — while describing typical post view counts and official account subscriber numbers as low.
A recurring pattern is that operators attach themselves to a debate that already exists rather than creating one. OpenAI writes that "foreign influence operations have long sought to latch onto existing local issues and sincerely held beliefs, using them to build credibility, amplify divisions or exacerbate public distrust." That distinction matters for how the findings are used downstream: a disclosure that operators tested narratives against the US data-centre backlash does not establish that the backlash is foreign in origin, an inference that appeared in September 2026 coverage describing technology leaders and the administration attributing the populist movement against AI to foreign influence (Source: wsj.com). See Data Center Siting / AI Power Politics, AI Data Centers.
Disclosure as a governance mechanism
Developer threat reporting is currently the main detection surface for these campaigns, which makes its incentives part of the subject. The reports are published by the companies whose products were misused, describe only activity visible on their own platforms, and set their own thresholds for what counts as an operation and what counts as impact. OpenAI frames publication as a contribution to collective defence — helping "industry, governments, civil society and the public better identify and disrupt attempts by foreign threat actors to manipulate legitimate public debates."
The practice sits alongside the broader platform-integrity and election-integrity regimes that address synthetic political content directly. See AI in Elections and Democratic Institutions, Synthetic Media / Deepfakes, AI and Authoritarianism.
Open questions
- Whether the low measured reach in disclosed cases reflects the operations' actual effect or the limits of what platform-side telemetry can observe.
- Whether campaigns that make no use of a major commercial model — running on open-weight systems instead — are detectable by any comparable mechanism. See Open-Weight Frontier Models.
- Whether a standard threshold for reporting an influence operation, comparable to the incident-reporting proposals in frontier safety frameworks, would make developer disclosures comparable across companies.
Provider-observed trends (Anthropic, September 2026)
Anthropic's September 2026 threat intelligence report sets out nine trends from influence operations it disrupted, spanning a Russian operation in the Central African Republic, a commercial influence-as-a-service operation across six continents, an election-manipulation platform targeting Malaysia, Russian state-media editorial pipelines, Iranian state-aligned operations, a pro-Awami League operation targeting rural Bangladesh, an MEK/NCRI-aligned operation, a domestic campaign in Kenya, and a UAE-directed operation (Detecting and countering misuse of AI: September 2026 (Anthropic threat intelligence report)).
The report describes Claude being "slotted into a human-edited pipeline that was already up and running, playing the role of a sub-editor or content creator," and producing the apparatus as well as the content: "doctrine manuals, opposition dossiers, ministerial portfolios, persona systems, target databases, employment contracts encoding editorial loyalty, and scoring rubrics that were used to rank staff." Operations persisted through tooling rather than prompting — "markdown files containing doctrine were reused almost verbatim across hundreds of sessions," with banned-word lists inside agents and shared files of approved sources and evasion rules — so that "actors producing content never needed to coordinate with or even know one another."
On attribution laundering, the report records actors prompting Claude "to intentionally strip state attribution from republished material, passing claims through chains of outlets so they read as independently confirmed," and one case tied to a Russian state media operation in which an actor "produced claims the model flagged as unverified, then instructed it to drop those caveats and present everything as confirmed." Named targeting of accountability mechanisms includes the cloning of a real activist's account to hold live conversations with his contacts inside Iran, ghost-written testimony delivered in a live UN Human Rights Council session, and counter-dossiers on UN Special Rapporteurs.
Subsequent reporting adds two operational details to the Malaysia case, designated GTG-84005. The operation used AI to steal census and public information in order to tailor its messaging, and separately to forge documents from the Central African Republic Gendarmerie and Ministry of Defense (Source: defenseone.com). The forgery element places the same tracked actor across two of the report's categories — election manipulation in Malaysia and document fabrication touching the Central African Republic, where the report separately tracks a Russian information-manipulation operation as GTG-04001 — and the data theft makes targeting data rather than content the input the model was used on. See Synthetic Media / Deepfakes.
The ninth trend qualifies the rest: "influence operations often fail to reach a genuine audience." Because the provider sits "at the production stage of operations, upstream of platforms like social media platforms," it may disrupt an operation before it builds an audience; "most of the content we discovered drew little or no authentic engagement," and "the widest authentic reach occurred where state media outlets were the distribution mechanism," including FM, satellite and shortwave radio and global television. The finding bears on the standing question of whether AI-generated influence content converts production volume into persuasion.
Relationships
- instance-of: AI and Authoritarianism
- supports: Disrupting a new covert influence campaign from Russia
- supports: PRC-linked influence operations are targeting AI debates in the US (OpenAI, June 2026)
- related: AI in Elections and Democratic Institutions
- related: Synthetic Media / Deepfakes
- related: AI Content Saturation (\"AI Slop\")