OpenAI busts five covert AI propaganda campaigns

For months, the biggest fear around generative AI was that it would turn state-sponsored propaganda into an unstoppable superweapon. OpenAI just published a detailed look at real-world covert influence operations, and the reality looks far more chaotic than terrifying.

OpenAI revealed that over the past three months, it detected and terminated accounts linked to five covert influence campaigns. The operations originated from Russia, China, Iran, and an Israeli commercial political marketing firm called STOIC.

Yet despite having access to frontier models, none of these networks managed to move the needle with real audiences.

Using state-of-the-art models for intern tasks

The targeted campaigns spanned high-profile geopolitical topics, including the war in Ukraine, the Gaza conflict, Indian elections, and domestic Western politics.

Two networks came from Russia: a newly identified group dubbed Bad Grammar running Telegram bots, and Doppelganger, which translated political messaging across X and 9GAG into multiple European languages. China's Spamouflage used models for multi-platform posting and debugging website code, Iran's network cranked out long-form articles, and Israel's STOIC ran automated profile farming across Facebook and Instagram.

Across the board, these actors treated ChatGPT like an intern. They used it to polish grammar, invent fake social bios, summarize research, and debug scripts.

None of it broke through. According to the Brookings Breakout Scale, which grades campaign reach from one to six, none of the five operations scored above a two. They posted widely, but they were essentially shouting into an empty room.

Operator incompetence did not help. In multiple instances, bad actors accidentally copy-pasted ChatGPT's refusal messages directly into their public social posts and websites.

Defenders are moving faster than attackers

While attackers are experimenting with prompts, defenders are scaling automation.

OpenAI highlighted that built-in safety guardrails repeatedly rejected malicious prompts at generation time. More importantly, the company is dogfooding its own intelligence: investigators used customized model tools to cut multi-platform threat hunts from weeks or months down to just days.

Once the accounts were banned, OpenAI passed indicators to cross-industry partners and open-source researchers to scrub downstream footprints.

Why it matters

We think this report delivers a crucial reality check to the AI doom narrative.

The real bottleneck in covert propaganda has never been typing speed. It is distribution, trust, and platform algorithmic reach. Generating ten thousand generic comments per hour does not matter if real users ignore them, and AI cannot magically buy authentic community engagement.

That does not mean malicious operations are harmless. Bad actors now have near-zero barriers to generating fluent text in foreign languages, completely eliminating telltale spelling mistakes.

Strategically, the report proves that generative AI currently benefits defense more than offense. Pattern recognition, code auditing, and footprint analysis scale exceptionally well when augmented by frontier models.

The catch is platform dependence. OpenAI can shut down malicious API keys on its servers, but it cannot police open-weight models running on local hardware. As these groups shift away from commercial APIs, tracking their footprints will become significantly harder.