Detecting and countering misuse of AI: September 2026

Detecting and countering influence operations using Claude

In this section, we focus on influence operations, which we define as efforts to manipulate the information environment—including political, civic, and public discourse—with the intent to deceive, distort, or covertly influence the perceptions, beliefs, or behaviors of individuals or groups, typically while concealing the activity’s origin, sponsorship, or coordination.

Our first threat intelligence report discussed one commercial influence-as-a-service network. Since then, we’ve discovered and disrupted larger, more sophisticated operations. We’ve seen groups of actors use Claude to build networks of fake social media profiles and entire news sites, leveraging these platforms to publish deceptive content, while completely concealing the entities behind these operations.

An actor might create a hundred social media accounts that appear to belong to ordinary citizens of a country, then have all of them post content amplifying the same political view over the course of a week. The accounts are not real and the opinions are not genuinely held. Nothing on the surface identifies who’s actually behind this effort.

This report details nine of those cases. They originated in Russia, Iran, Turkey, and across the Gulf, South Asia, Africa and Europe, and targeted audiences on six continents. The actors behind these operations included governments, state-aligned propaganda institutions and state media, as well as private firms selling influence to paying clients, domestic political operators, and in one case an opposition movement in exile.

Notably, several of these campaigns were timed to national elections. For instance, Russian state media produced fabricated claims about Moldova’s president before the September 2025 vote, and a pro-government operator in Kenya prepared fake grassroots social media posts ahead of Kenya’s 2027 general election.

How we investigate

Influence operations are neither new nor unique to the internet. An established community of journalists, researchers, and government agencies has studied these tactics, exposed them, and built the frameworks we use to understand them.

However, while a social media site usually sees an operation once its content is already circulating, we may see it on Claude while the operation is still being built. Actors use AI to plan their campaign, choose their targets, and write the material. Those types of tasks produce signals that our systems are trained to detect, which often lets us disrupt an operation before it gets off the ground.

Our visibility into these operations ends once it’s live. To verify our findings and understand what happened after content left our platform, we rely on open-source research, cross-platform industry data, and public reporting. Each case explains how we found the activity and who else contributed to the investigation.

Once we identify an operation, we ban the accounts involved and attribute the activity to the organization behind it. We use what we learn to sharpen our safeguards, feeding the findings from each investigation, including novel tactics and behaviors, back into our detection systems.

How we measure reach

To accurately evaluate the impact of each influence operation, we apply the Breakout Scale, a six-category framework widely accepted by industry researchers. The scale categorizes impact based on cross-platform migration and reach. Category One represents content that is confined to a single community on a single platform, while Categories Two through Six measure increasingly higher levels of public exposure and distribution.

Trends in influence operations

1. Influence sold as a service. As we noted in our previous report, commercial actors hired by entities (political, government, et cetera) produce content for whoever wishes to pay. This gives plausible deniability to the ultimate commissioners of the influence operations, and puts this capability within reach of actors who can’t or do not want to build it themselves. In two cases presented here, a working advertising or marketing firm ran the operations alongside ordinary commercial work.
2. AI as a newsdesk. In several cases, Claude was slotted into a human-edited pipeline that was already up and running, playing the role of a sub-editor or content creator. This allowed low-resourced actors to run influence operations at a scale well beyond what they could accomplish alone.
3. AI helped to build the apparatus as well as the content. Actors had the model produce doctrine manuals, opposition dossiers, ministerial portfolios, persona systems, target databases, employment contracts encoding editorial loyalty, and scoring rubrics that were used to rank staff who were part of the operation. This kind of work would otherwise need a staffed program office.
4. Complex tool use. We found influence operations that were built to persist and easily scale over time. Markdown files containing doctrine were reused almost verbatim across hundreds of sessions. Actors kept lists of banned words inside their AI agents, maintained shared files of approved sources and evasion rules, and ran custom software that called Claude in fixed batches. The central setup meant that actors producing content never needed to coordinate with or even know one another. One actor was building a course to teach the workflow to others. Increasingly, operations are not run using individual prompts. Instead, a great deal is embedded within persistent memory files.
5. Laundering of attribution, sourcing, and certainty. Actors used Claude to engineer content so that state or commissioned narratives appeared to come from independent voices. Actors prompted Claude to intentionally strip state attribution from republished material, passing claims through chains of outlets so they read as independently confirmed. In one case, tied to a Russian state media operation, an actor produced claims the model flagged as unverified, then instructed it to drop those caveats and present everything as confirmed, so the material would read as established fact.
6. Increased operational security. Threat actors find ways to obscure the origins of their identities. This began at the outset of the content creation process: actors asked the model to strip the marks of automated text and to sound organic, built account warmup and evasion logic, and removed metadata and codenames before delivery. They also laundered their access to Claude itself through VPNs, foreign phone numbers, rotated accounts, and third-party services that masked their IP address.
7. Fake personas (and impersonation of real personas). Actors generated full personas by using AI-generated profile photos, invented biographies for fake reporters, and fabricated political spokespeople. We also uncovered impersonation of real people and real institutions (including a state spokesperson and a human rights organization) and forged government documents.
8. Targeting people and accountability mechanisms. We observed the cloning of a real activist’s account to hold live conversations with his contacts inside Iran (alongside arrest-history profiles of other Iranians), ghost-written testimony delivered in a live UN Human Rights Council session, and counter-dossiers on UN Special Rapporteurs.
9. Influence operations often fail to reach a genuine audience. Because we sit at the production stage of operations, upstream of platforms like social media platforms, we may detect and disrupt an operation while it is still being put together. Most of the content we discovered drew little or no authentic engagement, and in several cases we disrupted the operation before it could build an audience. The widest authentic reach occurred where state media outlets were the distribution mechanism (including FM radio, satellite and shortwave radio, and global television).

GTG-04001: Disrupting a Russian foreign information manipulation and interference operation in the Central African Republic

We removed an account run by a Russian-speaking actor in Bangui who provided the production backbone for a Russian state-aligned Foreign Information Manipulation and Interference (FIMI) operation targeting the Central African Republic (CAR).

The actor ran a daily content operation through Radio Lengo Songo (98.9 FM), coordinated with the Russian state media outlets RT, Sputnik Afrique, and TASS, and the Russian House in Bangui. Whenever the user generated content, they explicitly instructed Claude to embed the pro-Russia, anti-France talking points in the stories. To ensure absolute deniability, they pushed the model to strip away classic formatting habits, actively preventing the news feeds from reading like synthetic, AI-generated text. A majority of the sampled activity was pro-CAR government, pro-Wagner, anti-France and anti-CAR opposition narratives.

A recent investigative report by the All Eyes On Wagner project showed that the radio station was created and funded by the Wagner Group in 2017. The actors designed a pipeline to channel their fabricated content through the station and straight onto the national broadcaster. They managed this by trading airtime for slots on SputnikPro, Rossiya Segodnya’s media training program for foreign journalists. This setup ensured that official Russian state material would reach local listeners under the guise of ordinary national programming.

On the surface, most of the content looked like it was written by a regular CAR journalist, but our investigation linked the actor to Politology, the Africa Corps/Wagner influence branch assessed to have come under the control of the Russian Foreign Intelligence Service (SVR) in late 2023. We assess that the individual was acting as Politology’s local media coordinator on the ground. Ultimately, the actor distributed Russian state-aligned propaganda. This was a Russian state-directed covert operation built to manipulate and interfere with the Central African Republic’s information space.

Using the Breakout Scale, we would assess this operation as Category Four (content broadcast daily through Radio Lengo Songo on 98.9 FM, amplified through Telegram channels and carried by local news outlets in CAR).

Key findings

• The operation was entirely foreign-run but carefully engineered to appear as though it originated from Bangui. The Russian-speaking actor directed the output, while the contracts, scripts, and posts presented it as the work of a Central African radio station.
• The network used Claude to automate their human resources and internal management. They tasked the model and it generated contracts mandating loyalty to the President of CAR and “Russia and its contingent.” They also used the model to write job descriptions, scoring rubrics, and a three-strike dismissal process. The actors then scored staff articles against these criteria and used Claude to get recommendations on which employees to keep and which ones to fire. When Claude flagged the political weighting, the actor relabeled it in neutral terms and kept the scoring.
• The actor engaged in three additional activities aimed at political control and influence. They organized a recurring surveillance operation to track and update data on CAR opposition political figures. In addition, the actors drafted strategic talking points and statements for spokespeople in the Russia House, a cultural and information center Russia uses as a vehicle for soft-power and political hub abroad. Finally, the actor produced forged CAR government documents, including Gendarmerie and Ministry of Defense communications, built from original design files.
• Claude refused to comply with the operation’s most aggressive request, which involved naming real individuals as militants to draw security action against them. The actor pivoted to anonymous-source framing instead.

Attack lifecycle and AI usage

The foreign actor supplied the topic and the talking points, and used Claude to turn them into briefings, contracts, scripts, graphics, and posts. Several were prepared for delivery to the Presidency’s spokesperson and the Russian House director. The reused templates and standing instructions show the planning was mostly done offline before any prompt was sent to Claude.

Organizational nodes

Disruption and mitigations

We first identified this network following a tip from the INPACT/All Eyes on Wagner. The reporting from these organizations helped us start our internal review and independently confirmed the identities of the individuals involved in the network. We removed the account and the organization behind this activity. We have also built automated detections based on their behavioral signatures to identify and block similar operations in the future.

GTG-54002: Disrupting a commercial “influence-as-a-service” operation spanning six continents

We identified and removed an account that used Claude to mass-produce and rewrite political content. The operation used the model to rewrite and distribute fabricated news stories across approximately 70 fabricated news websites. This content was further amplified by 70 linked and matching X/Twitter accounts, and a network of more than 250 inauthentic commenting X/Twitter accounts.

Our investigation showed that this campaign targeted global audiences across six continents. While the actors set up the network to look like independent local newsrooms, we traced the operation to LKM Company, a France-based digital advertising agency.

This network did not stick to one political ideology; instead, they shifted political stances to support different sides of the political spectrum based on whoever was paying at the time. This behavior matches a commercial “influence-as-a-service” model. In these operations, private companies are hired to manipulate information, change public opinion, promote specific political agendas, or run targeted smear campaigns against individuals.

We disrupted this operation early, before it could build an authentic audience. The network published at least 8,913 articles in about 20 languages, but most of the content we identified generated little observable engagement from real audiences. Using the Brookings Institution’s Breakout Scale, which measures the impact of influence operations, we would assess this activity as Category Two: content distributed across the network’s own websites and matching social media accounts, with no evidence of breakout beyond its own activity.

Key findings

• The actor used Claude for two main purposes: to write completely original articles for their fake news outlets, and to rewrite real articles by legitimate journalists. The automated system rewrote real news stories into politically slanted versions that were tailored to appeal to each specific national audience and political angle they wanted.
• The operation targeted audiences in highly contested democratic spaces, specifically focusing on the United States, Brazil, France, and the Democratic Republic of Congo (DRC). Because these nations have very different political environments, the network’s choice of targets shows no single political agenda.
• Our investigation found signals that showed the activity might reflect the interests of one or more customers with a stake in the current DRC-Rwanda conflict. We are not able to independently confirm which customers commissioned this content, and we found no evidence of direction by any government.

Attack lifecycle and AI usage

The operation launched its web infrastructure in a short burst, registering the domains from France within a ten-week window in mid-2025. They hosted all these properties on shared infrastructure behind a single deployment. This allowed our investigators to connect roughly 70 individual news sites, which appeared independent on the surface, to a single operator account.

The network used Claude to create a standardized content pipeline. All prompts given demanded a fixed JSON output structure, formatted HTML, exact character limits, and three to four internal links per article. This allowed the actors to automatically generate and publish the content at scale. The articles were specifically designed to boost their site’s authority rankings on search engines.

We discovered that the operation repeatedly relied on three manipulation tactics: rewriting the same source story in opposite ideological directions for different audiences, adding political angles to stories that originally had none, and laundering stories across borders into unrelated regions, stripped of their original context.

To make their articles look legitimate, the actors signed them using the names of fake journalists. Our investigation found that these writers did not actually exist.

These fabricated bylines gave each site the appearance of an independent local newsroom with its own staff. The network paired each fake outlet with an X (formerly Twitter) account. These sites were then amplified by a layer of commenting accounts created during the exact same timeframe as the websites, with many using AI-generated profile photos. Most of these fake accounts were created in June and July 2025.

We detected signs of coordinated inauthentic behavior on September 11, 2025, when the network’s websites published almost identical articles about the DRC-Rwanda conflict within three minutes of each other. The actors modified the tone of each article to fit different regional audiences, while simultaneously coordinating the distribution of these links across numerous X accounts.

DRC-focused activity

A close look at the network’s output revealed a heavy focus on the Democratic Republic of Congo, with 318 articles across all its fake news sites. These stories typically supported the DRC government’s stance, specifically focusing on regional mineral deals and ongoing tensions with Rwanda. This strategy matched the network’s audience growth; during its first few weeks, the vast majority of fake personas following their X accounts were tied to the DRC, and their DRC-specific news page became the most shared and popular account in the entire operation at that time.

An X account presenting itself as a Congolese civilian “digital army” was also observed following several of the network’s accounts. We found no evidence of direction by any government.

Disruption and mitigations

We identified the account through ongoing investigations into influence operations in the region. We banned them and the organization associated with this activity, and implemented new detection methods targeting the operation’s behavioral signatures. Below, we share indicators to support action by other industry partners, in particular the shared deployment identifier, which ties the network to one account, and a representative sample of the 70 fabricated outlets selected across regions (the full domain and account list is available separately):

Sample fabricated outlets

GTG-84005: Disrupting a commercial election-manipulation platform targeting Malaysia

We identified and removed an account that used Claude to run a commercial election manipulation platform that primarily targeted users in Malaysia. The network consisted of roughly a thousand fake X/Twitter social media accounts, a fake news outlet, and a series of fabricated dossiers.

The platform posed as a defensive cyber intelligence and counter-disinformation tooling outlet. Nevertheless, our investigation uncovered clear links to BBS Bilisim Teknolojileri, an Istanbul-based technology company, which sold access to the platform as a paid influence-as-a-service capability. According to the threat actor’s own documentation, the infrastructure was marketed as “military-grade, AI-driven, real-time political operations ecosystem.”

The operation involved the actors leveraging that platform built through Claude to profile and target voters in Malaysia, constituency by constituency, using census and electoral data that they had ingested. The platform managed a network of about a thousand fake accounts that were optimized to inflate engagement metrics and evade social media platforms detection systems. The setup also ran a fake news site called “Malaysia Pulse” by feeding the synthetic news outlet with an AI rewriting pipeline.

The people behind this operation also generated fabricated intelligence dossiers to spread false allegations against an opposition politician and civil-society organizations. These allegations were entirely made up by the actors.

We rate this campaign as a Category Two on the Breakout Scale, meaning that the assets were distributed across multiple platforms, but without evidence of breakout into authentic communities.

The actor used Claude Code to build custom dashboards for managing, running, and tracking the networks of fake accounts. These dashboards tracked metrics such as likes and views generated by the deceptive accounts for each target. One example, for a senior Malaysian government official’s account, recorded figures in the millions. Because these figures are self-reported by the actor’s own tools, we cannot independently verify them.

Key findings

• The operation leveraged real census and electoral data, and millions of voter records to target the country’s most sensitive political and social faultlines: race, religion, and royalty across all 222 Malaysian parliamentary constituencies.
• The platform managed over 1,000 fake X/Twitter accounts. Each had warm-up logic to make the account appear real for a period before it was deployed for influence operations, including regularly renewing cookies and IP addresses. The dashboard contained a parameter where a user could tune up to how many total artificial views each target should receive. We observed a request, in support of the sitting Malaysian Prime Minister, for one million artificial views on his account.
• The actors generated allegations against named individuals for which our model’s own research could find no corroboration.
• Where Claude refused to perform the operation’s requested actions, including after it identified one document as material for political defamation, the actor negotiated sanitized wording to keep building toward the same capability.
• The actor pursued a contract with Malaysia’s national communications regulator. We found no evidence that this pursuit succeeded.

Attack lifecycle and AI usage

Claude was used to build the constituency targeting system using real electoral data, to engineer and run the fake social media account network and its detection evasion logic, to rewrite and launder fake news, and to iterate the fabricated dossiers.

The synthetic news outlet also scraped legitimate Malaysian reporting and had the model rewrite it several times before republishing it under fabricated bylines. It republished articles from Russian and Chinese state-aligned foreign outlets, including TV BRICS, Xinhua, Sputnik/RIA, and CGTN, and stripped out the state attribution to present them as independent Malaysian reporting.

Disruption and mitigations

We identified this account through our internal detections and used the recovered indicators to map the operation’s full footprint, and to disrupt future misuses.

Claude refused or partially refused the actor’s requests at several points, including after it had identified a fabricated dossier as material for political defamation and balked at language that explicitly evoked a psychological operation.

GTG-24015: Disrupting Russian state-media editorial pipelines built on Claude

We identified and removed four accounts in which individual actors used Claude as an editorial and news production desk to distribute content via Russian state-media outlets. The actors turned out completed polished content, sending it straight to the production line to be aired.

Although the individual actors attempted to conceal their identities, we assess with high confidence that the actors ultimately shared the outputs with Russian state-owned and state-funded media and that content generated by Claude was ultimately published and broadcast through Russian state-aligned media outlets, including Sputnik Moldova and RIA Novosti for Moldovan audiences, Sputnik en Español for Latin American audiences, Sputnik Africa for African audiences, and RT’s English-language newsroom for RT’s global broadcast.

Actors used a chain of different outlets to make Russian-origin claims appear to be independently reported. By using Claude’s workflows, the actors achieved a scale of production that would normally require an entire team of trained editorial staff.

Unlike covert networks that struggle to reach real audiences, the content developed by these individual actors was distributed through media outlets’ established channels. Where we matched individual Claude-produced output against published content, results ranged from a Telegram post with roughly 2,000 views to the aired broadcast copy. We’re not able to determine what share of the outlets’ total output passed through the pipelines that involved Claude.

Key findings

• A former Sputnik Moldova editor-in-chief used Claude to turn Romanian and Moldovan news, polling data, and opposition social media posts into Russian language articles that were ultimately published on Sputnik Moldova’s Telegram channel and on RIA Novosti, and amplified across a network of Russian and Moldovan outlets to manufacture false verification loops. The same story was echoed across different outlets so it appeared to be independently confirmed.
• The same actor amplified fabricated, defamatory claims about Moldova’s president Maia Sandu ahead of the country’s most recent major national vote, the 2025 Moldovan parliamentary election held on September 28, 2025.
• A contractor with links to Russia pulled content directly from Telegram channels and leveraged Claude to write Latin American Spanish articles for Sputnik en Español and for Telegram channel with handle @ATodaPotencia. Under the editorial watch of a Sputnik Mundo presenter and producer, the contractor also fed the output produced to a supposedly independent Telegram that reframes Kremlin-aligned narratives so they look like authentic local commentary.
• An employee of a Russian state-owned media outlet used Claude to build content meant for live broadcasts, specifically handling tickers, screen captions, voiceover scripts, and short headlines using inputs from Russian newswires, SVR (the civilian foreign intelligence agency), and the Defence Ministry. In at least one confirmed instance, this material actually made it to Russian airwaves.

In each operation, Claude was integrated into an already running, professionally edited pipeline as the sub-editor layer, taking a single staffer’s output well beyond what they could produce unaided.

Disruption and mitigations

We identified these accounts through our internal detections, banned the accounts associated with all four operations, and shared indicators with industry and research partners.

GTG-34001: Disrupting Iranian state-aligned influence operations on Claude—the ICCO, the Islamic Propaganda Office, and the Bina Observatory

We identified and removed three Iranian state-aligned accounts that were using Claude to set up influence operations campaigns. The people behind them were planning and prepping content to support what they called a “soft war” or “cognitive warfare” program. In their own words, this was a non-military plan to shape public opinion at home and abroad. Our investigation found that each operation was run by an actor working within or on behalf of a named Iranian state propaganda institution. The entities include the Islamic Culture and Communications Organization (ICCO) under the Ministry of Culture and Islamic Guidance, the Islamic Propaganda Office of Khorasan Razavi, running a cognitive warfare command room out of a Mashhad seminary distributing content aligned with IRGC narratives, and the Islamic Propaganda Organization’s Bina Cultural Observatory.

In each case, the operation relied on Claude to build campaign plans, doctrine manuals, persona systems, target databases, and ministerial planning documentation. Using the model in this manner allowed them to generate complex organizational frameworks and assets that would otherwise have required a fully staffed program office to produce. The actors also focused heavily on attribution laundering; they engineered content so that state-backed narratives appeared as independent voices. As the ICCO actor put it, their role as cultural attachés was “not to be the narrator, but the director” of these narratives.

The actors took deliberate steps to hide who they were and where they were coming from. Access to Claude from within Iran is blocked, so they used VPNs and foreign phone numbers to register and verify accounts. Nevertheless, in conversation, they repeatedly named their locations, institutions, and roles. Those disclosures, as well as institutionally branded document footers and open-source corroboration of the individuals involved, tied each operation to its Iranian state-aligned institution.

Our investigations also found some of the activity disseminated on other platforms. For example, we observed content being distributed through distribution channels sympathetic to IRGC narratives.

Using the Breakout Scale, we would assess this operation as Category Three (multiple platforms, with content observed disseminated by IRGC-aligned channels on Eitaa and other platforms.)

Key findings

• The actors across all the three operations explicitly tied their campaigns to Iran’s state doctrine of “Jihad al-Tabyin,” or explanatory jihad. Under this concept, Iranian institutions produce propaganda as both a religious and strategic duty. Language related to this state doctrine appeared directly inside the actor’s sessions and internal planning documents.
• The network produced ministerial deliverables carrying official ICCO branding. These deliverables detailed a nine-part international influence portfolio and complete organizational plans for the funeral of the Supreme Leader of Iran.
• Publicly available sources corroborated the roles of the strategic architect and commander leading the Mashhad command room. These leaders operated “Manjanegh” (Catapult), a multi-province content factory that used dozens of activists to repackage Iranian security services’ public reporting under specific personas without links to Iran’s security services. The network amplified this content through paid campaigns across more than 100 Iranian platform channels, including those tied to the IRGC.
• We linked the operation to a director-level official at the Bina Cultural Observatory in Iran, verifying the connection through publicly available sources and account telemetry. The actor generated messaging in the official voice of an IRGC spokesperson across multiple conversational threads. During a specific campaign surrounding the 2026 US-Israel-Iran war, the network attributed false claims to Western research institutions (including CSIS, Brookings, and RAND). Both of these tactics served to make state-backed messages appear more credible.
• The network deployed aggressive counter-narrative content targeting the Bahá’í, a persecuted religious minority, as well as target databases naming international officials and Iranian opposition figures.

Attack lifecycle and AI usage

We confirmed that the actors used Claude as the main administrative and operational layer of these three Iranian propaganda operations:

• First, they used Claude to build content related to doctrine and ideology. The actors made guidebooks on how to manage and operate their digital operations which included the operating manuals, coded project portfolios, persona systems, early warning protocols, and amplification timing schemes for the influence operation.
• Second, the network used Claude to transform official government intelligence bulletins into tailored content. It worked in Farsi, Arabic, Urdu, Malay, Spanish, and English, with a broader plan targeting 20 languages.
• Third, they used Claude to launder attribution, making posts seem to come from foreign writers or independent news sources, and hashtag campaigns that appeared as though they were started by ordinary citizens.
• Fourth, the actors shared their content across several Iranian domestic platforms like Eitaa, Bale, and Rubika, as well as X/Twitter, Instagram, Telegram, TikTok, YouTube, and the ICCO cultural attaché network.

Disruption and mitigations

We identified these accounts through our internal investigations, banned the accounts associated with all three operations, and shared the relevant indicators with industry and research partners.

GTG-54006: Disrupting an automated pro-Awami League fake-news operation on Claude targeting rural Bangladesh

We identified and removed a sustained, automated disinformation network that used Claude to generate fabricated Bengali-language news in Bangladesh. The operation focused on promoting Bangladesh’s Awami League party and attacking its opponents. Because the Awami League party has been out of power since the July 2024 uprising, the network’s activity was on behalf of an opposition party rather than the government. The actors were fully aware of their deceptive tactics, writing in their internal communications that “no one knows the news is fake.”

A single actor based in Gaibandha District in Bangladesh ran the operation, rotating through 29 Claude accounts to evade platform limits and detection. The actor used a custom software program named “fake_news_3.py” to connect directly to Claude, which was coded to generate content in fixed batches of 15 headlines, 3 detailed fabricated stories, and 15 image-generation prompts. According to the actor, the output was meant to feed a continuous cycle of Facebook Live, YouTube, and TikTok livestreams targeted at rural Awami League supporters with limited literacy.

The actor generated at least 1,500 headlines, 300 false narratives and 1,500 image prompts. Because Claude does not have an image generation feature yet, these prompts were probably exported to other AI frontier models to create the visual content used in the false narratives.

The operation was run out of Bangladesh and targeted domestic audiences with content designed to benefit the Awami League interests. Despite this narrative alignment, our investigation found no proof that the party itself was involved in directing or funding the network’s activity.

Our investigation showed that the campaign’s videos surfaced on multiple Bangladesh-focused channels and profiles across all three social media platforms. We were unable to identify the specific channels that published the entire output. Furthermore, we found no evidence that the content reached a wider audience outside of these accounts.

Using the Breakout Scale, we would assess this operation as Category Three (multiple platforms, with videos matching the operation’s output observed on multiple Bangladesh focused channels and accounts across social media platforms.)

Key findings

• The actor internally described the operation’s output as “fake news” calibrated to be “hot and aggressive” and simple enough “so even village people understand.” The actor explicitly targeted the audience under the assumption that they believed the content was authentic news.
• The operation’s content was uniformly pro-Awami League and targeted the Bangladesh Nationalist Party (BNP), Jamaat-e-Islami, the National Citizens Committee, the interim government, and student protest leaders. The network used fabricated smear campaigns to accuse these opponents of being foreign agents and advancing Taliban-style governance.
• The actor created a separate upload script that functioned as a YouTube bulk-post script through its API. The script was designed to publish videos on a schedule that was set a month ahead of time through a separate third-party continuous integration service.
• Some content narratives created by the network also aligned with pro-Indian geopolitical interests. However, we found no evidence of any state direction or funding behind this activity.

Attack lifecycle and AI usage

Once set up, the operation ran semi-autonomously with minimal human oversight. A custom program called Claude’s API to generate standardized batches of fabricated Bengali content, including headlines, detailed narratives, and matching image prompts. The program was also tuned with emotionally charged topics designed to target rural audiences with lower literacy levels. The output moved through fixed cloud-storage folders, was converted to audio and video, and a second script queued the videos to YouTube months in advance.

Disruption and mitigations

We found this activity as part of our internal investigations and banned the accounts associated with this operation. We expect the actors behind this activity to try to create new accounts to continue their activity, so we’ve built detections around its behavioral signatures to stop this from happening again. As in the other operations described here, we shared indicators with the relevant distribution platforms and other partners.

GTG-84006: Disrupting a distributed MEK/NCRI-aligned influence operation that used a shared AI agent to impersonate real people and recruit inside Iran

We identified and removed a distributed influence operation that targeted Iranian audiences inside the country and abroad. To deceive users, the operation impersonated a real-world activist by tasking the shared AI agent to clone the activist’s personal Telegram account, then instructing it in Persian that it was now that person. The actor directed Claude to read roughly 8,400 of his Telegram posts to copy his writing style, and then used it to run live political conversations with his contacts. To our knowledge, these contacts did not know they were speaking with an AI-assisted account.

Although the actors did not share account infrastructure or show visible signs of coordination, our investigations linked this activity to People’s Mojahedin Organization of Iran (PMOI/MEK), and its political front, the National Council of Resistance of Iran (NCRI).

Our investigation showed that at least four individuals running this campaign work for official NCRI media outlets. The operation relied on staffed NCRI/MEK media properties across multiple platforms, including broadcast television, satellite and shortwave radio, Instagram, Telegram, and X/Twitter. While the presence of committee approval loops and notes about MEK leadership suggest central tasking is likely, we are not able to verify the level of centralized control.

Using the Breakout Scale, we would assess this operation as Category Two (multiple platforms, with distribution through the network’s own NCRI media properties and amplifier accounts.)

Key findings

• The operation successfully scraped over 500 social media channels to build detailed profiles of individuals inside Iran. They then grouped these targets by city, age, occupation, political alignment, and arrest history likely to help them tailor their messages to the specific audiences.
• The network analyzed roughly 51,944 archived messages from these conversations to build detailed psychographic dossiers on dozens of specific individuals in Iran. To spread their message further, the impersonation accounts also sent a fabricated breaking news headline to more than 30 contacts simultaneously.
• To promote NCRI president Maryam Rajavi’s ten-point plan, the network created AI-generated avatars for each article. The actors animated these avatars, gave them Persian audio, and styled them to look like average Iranians, while intentionally hiding the fact that they were AI-generated.
• The people behind the campaign used an automated pipeline to run networks of Instagram accounts that coordinated their posting schedules. They adjusted the content to fit different target audiences. To hide their true motives, initial posts intentionally avoided naming the Mojahedin, making the group’s propaganda look like unaffiliated, neutral news.
• The operation focused its messaging on the Iranian government, monarchist groups, and the Pahlavi camp. The actors spread a fabricated video attacking a member of the Pahlavi family and used the “Neither Shah Nor Sheikh” framing against the targets. This content was designed to strengthen the MEK’s position in the Iranian opposition.

Attack lifecycle and AI usage

The network relied on Claude to support all phases of its influence operation. The actors managed these tasks using a shared AI agent platform, where each workspace maintained its own long-term memory files. Over time they updated these files with specific instructions, such as lists of banned words, approved sources, account management rules, and ways to avoid detection. This allowed the agent to keep producing content without a human user directing each session. One actor loaded MEK founding doctrine into the model’s memory as “strategic base data” for others within the operation to reuse.

The human management behind this operation was highly structured. This included an approval loop by a dedicated committee and a formal review process from content correctors to managers. Throughout their communication, the actors repeatedly used the phrase “per our contract” and made regular references to the MEK leadership. We found that the same operational playbook was applied uniformly across all workspaces.

A majority of the output was Persian-first as it swapped the organic 2022 protest slogan «زن، زندگی، آزادی» (“Woman, Life, Freedom”) for the MEK variant «زن، مقاومت، آزادی» (“Woman, Resistance, Freedom”).

Disruption and mitigations

We found this activity as part of our internal investigations and banned the accounts. At this point, we are not able to independently confirm how much authentic engagement was drawn by the network’s amplification accounts.

GTG-54004: Disrupting a domestic coordinated inauthentic behavior campaign in Kenya

We identified and removed an account that was used by a single actor to mass-produce Kenyan political content. The operation was built to look like spontaneous, grassroots public sentiment. The actor used Claude across several sessions to generate batches of exactly 50 tweets, explicitly instructing the model to make posts look like spontaneous grassroots commentary rather than a coordinated campaign.

The network focused its messaging on key Kenyan political issues and figures. A large portion of the AI-generated tweets praised Energy Cabinet Secretary Opiyo Wandayi for stopping a scheduled Kenya Power electricity tariff hike, using the hashtags #PowerReliefKE and #PoweringTheNewKenya to boost visibility. Additionally, the network pushed stories claiming that Kenya’s United Opposition coalition was breaking apart before the 2027 general election, directly targeting politicians Rigathi Gachagua and former president Uhuru Kenyatta.

Separately, the actor ran the identical AI workflow for Kenyan retail brands under a marketing persona, “SHANKI”/“Elkins Marketer.” We found no evidence of government involvement, and the activity appears consistent with an entirely domestic Kenyan operation.

Our investigation revealed a highly structured political astroturfing effort that pushed identical, unified messages regarding the tariff increase across different conversations. We evaluated the impact of the network using the Breakout Scale and classified it as Category One. The activity was completely isolated within the network of fake accounts and local influences on a single platform, failing to reach or influence any real people.

While we do not know the exact real-world identity of the people behind this operation, we believe this was a local Kenyan political astroturfing campaign. The network’s pro-administration tone and specific hashtags suggest it was plausibly aligned with the ruling coalition, though we have not identified the exact organization responsible.

Key findings

• The operation used a single playbook to amplify both pro-government and anti-opposition narratives. Boosting the incumbent administration while undermining the opposition’s viability in this way is consistent with a single, coordinated electoral communications effort.
• The template used here was also used, verbatim, for the marketing of retail brands, including a promotional broadcast that was repackaged as organic tweets with links inserted on every fifth post. This fits into a commonly-observed pattern in Kenya where agencies pay local influencers to manipulate narratives.
• The operation frequently used Claude to humanize and refine batches of 50 pre-drafted topics and tweets, showing that the model’s main value to the network was volume and the appearance of authenticity. The core ideological messages were completely decided by the actors before Claude was used.

Attack lifecycle and AI usage

The actor supplied the topic, talking points, and hashtags, and used Claude to convert them into 50 themed, character-counted posts formatted for cross-platform publishing and dissemination. In several sessions, these were packaged as an interactive copy-all widget ready for deployment.

Disruption and mitigations

Based on a tip shared by OpenAI about recidivist activity on their platform, we conducted an internal investigation into suspected coordinated inauthentic behavior in Kenya and identified this operation. We removed the account and the organization behind it, and built detections around its behavioral signature.

GTG-84002: Disrupting a UAE-directed influence operation targeting the Muslim Brotherhood, Sudan conflict, and UN accountability mechanisms

We identified and removed an account used by a single actor to run a sustained influence operation against the Muslim Brotherhood. The actor leveraged Claude to maintain an AI persona named “Deadshot” hosted on their own private platform. Embedded inside the system’s setup was a master doctrine file that instructed Claude to repeat the same mission across hundreds of sessions: “a coordinated transatlantic and regional operation to dismantle the Muslim Brotherhood globally.”

The operation was split across five closely connected lines of activity. The actor managed each stream simultaneously, ensuring that narrative generation, technical obfuscation, and tactical target selection were completely synchronized across the entire campaign.

• They built and managed a network of approximately 300 inauthentic influencer social media accounts.
• They created a front NGO that copied a real Swiss organization’s identity and published state-authored human-rights reports under it.
• They ghost-wrote official testimonies with the goal of having them delivered by two people at the 62nd session of the UN Human Rights Council. The content was engineered with specific restrictions ensuring that neither speech mentioned the UAE.
• They thoroughly researched and profiled 18 members of the European Parliament and prominent journalists. They built out detailed personal files on these lawmakers and reporters.
• They compiled counter-accountability dossiers on UN Special Rapporteurs who had criticized the conduct of the UAE in Sudan.

Although the operation was built so that it could not be traced back to the actors, our investigation linked it with high confidence to UAE government officials. The doctrine file also named senior UAE officials as the intended recipients of the work. According to our findings, the actor also funded the social media network that amplified the content.

We cannot confirm whether any of the testimonies or compiled target dossiers successfully reached their intended audiences.

Using the Breakout Scale, we would assess this activity as Category Three, with the activity running across several social media platforms. A higher category would require evidence of broad public attention or policy impact, which we are not able to confirm.

Key findings

• The social media amplification network was centrally funded and coordinated. Internal reporting called the network’s “independence” its “greatest strategic asset,” thus admitting it was attempting to hide its state-directed nature.
• The actor borrowed the identity of a real Sudanese human rights organization and ghost-wrote complete UN testimony for two named individuals, so that materials serving a party to the Sudan conflict would reach the UN as from independent local witnesses, rather than state messaging.

Attack lifecycle and AI usage

The operational workflow took real-world topics and their own pre-made political doctrine files, and then used Claude to turn the whole thing into official-looking intelligence briefs, cloned identity reports, ghost-written testimony, and individually profiled targeting lists, several prepared for direct delivery to senior UAE officials.

Disruption and mitigations

We found this activity as part of our internal investigations and banned the accounts. We have also built detections around the documented behavioral signature to block any future related activity. We have also shared indicators to support action by the other industry partners.

Back to top