OpenAI said it disrupted five covert influence operations that had used its models for deceptive online activity. The campaigns were connected with actors operating from Russia, China, Iran and Israel and used AI for tasks including writing comments, translating material, researching public information and debugging simple software. Despite those productivity gains, OpenAI found no evidence that access to its models enabled the operations to break into substantial authentic audiences. The report offered a more measured picture of AI-enabled propaganda: generative tools can make existing tactics cheaper and faster, but distribution and credibility still determine whether a campaign succeeds.
Five Networks Applied AI to Familiar Tactics
The disrupted campaigns included a Russian operation called Bad Grammar, the previously documented Doppelganger network, China-linked Spamouflage, the Iranian International Union of Virtual Media and an Israeli commercial operation named Zero Zeno. Their targets and themes varied, covering the war in Ukraine, the conflict in Gaza, elections and political debate in Europe, the United States and India. The networks used OpenAI systems as components within broader influence workflows rather than as autonomous campaign managers.
Their uses were generally practical. Models generated short posts and headlines, translated text into several languages, rewrote articles for different platforms and assisted with code for bots, databases or websites. Some operators also created fake profile material and responses to their own posts. These activities show how generative AI can reduce the effort needed to maintain many accounts and produce content in multiple markets, even when the underlying strategy remains unchanged.
Higher Output Did Not Create Authentic Reach
OpenAI assessed the campaigns using a scale that distinguishes activity from meaningful penetration. None reportedly rose above a level indicating cross-platform posting without breakout into authentic communities. The networks could manufacture content and the appearance of engagement, but they did not automatically persuade real people to share it. That finding challenges the assumption that fluent AI-generated text inevitably produces effective influence.
Audience building still depends on distribution, timing, identity and trust. A model can remove grammar mistakes, but it cannot guarantee that a fabricated account appears credible or that a message resonates with a community. Platforms can also detect coordination through behavioural signals unrelated to the words in a post. AI therefore changes the economics of production more readily than the social conditions required for impact.
Attackers Mix New Tools With Old Methods
The investigations found that operators combined AI-generated material with copied memes, manually written content and established networks. This hybrid pattern is likely to be more common than fully automated propaganda. Threat actors do not need a model to perform every task; they can use it where it saves time, such as summarisation, translation or variation. The result may be a larger volume of moderately polished content rather than a fundamentally new form of manipulation.
That incremental advantage still matters. Lower production costs can allow more experiments, languages and target groups. Even if most attempts fail, operators can keep testing messages until one finds traction. Defenders should therefore avoid using viral success as the only warning signal. Early indicators may include unusual account coordination, repeated narrative templates and technical infrastructure shared across apparently unrelated profiles.
Defence Depends on Shared Intelligence
OpenAI credited safety design, open-source researchers and reporting from distribution platforms with helping its investigations. Its own AI tools also shortened parts of the analytical process, turning large collections of activity into patterns that investigators could examine. This creates a contest in which both attackers and defenders gain productivity from similar technology. The advantage may go to the side that combines models with better data and faster coordination.
Model providers occupy only one layer of the information environment. They can suspend accounts and restrict specific uses, but they do not control every open model or the platforms where content is distributed. Social networks, security researchers and public institutions must exchange indicators without treating a single provider’s report as a complete view. Consistent disclosure also allows independent experts to test whether company claims match observable activity.
The report should not be read as proof that generative AI poses little misinformation risk. It captures five detected operations during a limited period, and more capable or careful actors may behave differently. It does, however, suggest that the immediate threat is often operational acceleration rather than effortless mass persuasion. That distinction supports defences focused on networks, behaviour and distribution alongside content detection.
AI-generated text will become harder to identify reliably as models improve. Investigators will need to examine how accounts act, who coordinates them and where their infrastructure overlaps. OpenAI’s disruptions show that access controls can impose friction, but lasting resilience requires cooperation across the full chain. The decisive question is not merely whether propaganda contains AI-written sentences. It is whether coordinated deception can obtain the trust and reach needed to influence real communities.
Regular reports from model providers can help defenders track changing behaviour, provided the disclosures include enough detail for independent analysis. Common terminology and shared indicators would make comparisons easier across companies and platforms. Transparency should also cover limitations: providers cannot reliably observe activity that uses other services or locally deployed models. Treating each report as one piece of a larger threat picture will produce a more realistic assessment than either dismissing the campaigns or assuming every generated post is strategically effective.
