AI Propaganda Operations Are Attacking the Infrastructure of Public Trust

AI-generated propaganda has reached the point where a fabricated byline can move through real newsrooms, social feeds, and public debate before anyone sees the deception behind it. OpenAI’s latest disruption report shows why media platforms need to treat these campaigns as attacks on trust infrastructure.

OpenAI says it shut down two influence operations linked to Russia and Iran that used ChatGPT to build fake journalist identities, operate a false think tank, draft propaganda, and manufacture social media reactions. The cases show a shift in how influence campaigns work: the central challenge sits across the full information chain, from identity and authorship to publication, distribution, and audience response.

The Russian and Iranian campaigns used different fronts and targeted different audiences. Their methods shared a basic structure. Operators created identities that appeared independent, used AI to produce or refine material, placed that material in real information channels, and then tried to reinforce it through social discussion.

That structure matters because every stage can lend credibility to the next one. A fake journalist gives an article a byline. A real outlet gives the article a publishing history. A social account gives it the appearance of public reaction. Each step can make the original deception harder to trace.

OpenAI reported banning clusters of ChatGPT accounts associated with both campaigns. The company said the operations were among roughly 30 influence operations it had exposed over the previous two and a half years. The latest cases provide a clear warning for newsrooms, platforms, and regulators: account-level enforcement addresses the operators’ access to one tool, while the larger trust attack continues across many other systems.

OpenAI’s disruption of Russia- and Iran-linked influence operations shows how AI-assisted propaganda can exploit the entire chain through which people decide what to trust. The Iranian network allegedly used fake journalist identities to place and syndicate articles and generate social-media reactions, while the Russian operation used a covert think tank and apparently unwitting local workers to build credibility in Latin America. The central lesson is that fluent AI-generated text is only one component of the threat: the larger attack exploits identity, editorial review, distribution, engagement, and the lasting public record. Defending against it requires cross-platform detection, stronger contributor checks, evidence preservation, and corrections that reach as far as the original deception.

The Iranian operation created seven journalist personas that claimed to come from Western countries, including the United States. OpenAI identified the names as Ervin B. Hoskins, Noah Lamington, Sophia Gonzalez, Michael Harrison, Ericka Feusier, Jenny Williams, and Alice Johnson.

The personas pitched long-form articles about the US-Iran conflict and related geopolitical issues. OpenAI found almost 100 articles published or syndicated under those bylines across roughly a dozen online outlets. The outlets were generally small or medium-sized publications focused on international affairs, geopolitics, and the Middle East.

The timeline shows how the campaign adapted to events. OpenAI identified the earliest article in July 2025 and the latest in October 2026. Activity increased after the US-Iran war began earlier in the year, when audiences were searching for analysis and publishers faced intense demand for timely material.

One persona, Ervin B. Hoskins, described itself as an American freelance writer. Accounts using that identity appeared on X and Instagram. OpenAI said X transparency information connected the account through a West Asia Android app, while Instagram information placed the account in Iran. Both accounts appeared to have been suspended.

The operation also asked ChatGPT to draft comments for social media. Those comments addressed missile strikes, ceasefires, and diplomatic maneuvering. The requested framing presented the United States as the aggressor, Israel as an unreliable ally, and Iran as a defiant but resilient victim. The campaign therefore pursued two connected goals: placing articles into media channels and creating apparent grassroots reactions around them.

The Russian operation took a different route. It co-opted people in Latin America to run the Social Research Center, or SRC, a group presented as a think tank. OpenAI said the available evidence indicated that the Latin American employees did not know they were working for a Russian operation.

The SRC focused on undermining Ukraine’s reputation in Latin America and influencing local politics. The campaign targeted countries including Argentina, Bolivia, and Ecuador, while also producing material tied to political disputes elsewhere. OpenAI said the group produced more than 60 original articles through co-opted staff, and some of its material prompted fact-checks, official denials, and media coverage in Peru, Poland, Ecuador, and Bolivia.

The operators used ChatGPT to prepare internal reports, draft propaganda, write social media posts and comments, and assess the think tank’s performance. They also used VPNs to access the service despite restrictions on access from Russia.

This detail makes the SRC case especially important. The operation depended on genuine workers, local knowledge, and apparently authentic output. The employees supplied real labor and local context while the sponsor remained hidden. That model can create a more convincing public presence than a website filled entirely with machine-written copy.

OpenAI described the SRC as its most complex disrupted attempt in two and a half years to run a front identity. The operation shows how influence campaigns can combine human labor with AI assistance. ChatGPT supplied speed and administrative support. The people involved supplied local credibility.

The most consequential shift is not that propaganda can now be written faster; it is that AI makes credible-looking institutional presence cheaper to assemble and sustain. Treating this solely as a content-moderation problem mistakes the symptom for the vulnerability. Newsrooms and platforms should regard provenance, contributor verification, coordinated-behavior analysis, and public correction procedures as core security capabilities—not optional editorial safeguards reserved for exceptional cases.

Media trust depends on several linked judgments. Readers ask whether a person exists, whether the person has relevant experience, whether the publication checked the material, and whether other people are independently responding to it. Platforms, publishers, and audiences make those judgments through separate systems.

The Iran and Russia cases put pressure on each layer:

A platform that focuses only on the text misses the attack. The text may contain few obvious errors. The stronger indicators can sit in the relationships around it: repeated bylines, shared contact details, coordinated account behavior, unusual publishing patterns, location mismatches, and social accounts that appear soon after an article goes live.

Generative AI gives operators more than a faster writing assistant. It can help them maintain several identities, adapt language for different audiences, prepare internal updates, and generate large volumes of tailored material. It can also help a campaign preserve a consistent political framing across articles and comments.

Darren Linvill, a co-director of Clemson University’s Watt Family Innovation Center Media Forensics Hub, said AI helped the Iranian operation produce language that looked, felt, and read as authentic enough to reach legitimate outlets. That observation points to the central security risk. Fluency lowers the chance that a fabricated identity will be rejected at the first editorial gate.

The Russian operation shows another advantage: AI can support management. Operators asked ChatGPT to prepare reports about the campaign and evaluate the performance of a front organization. Those functions reduce the administrative burden of running a distributed operation across countries and platforms.

The resulting threat has two dimensions. More content can be produced, and the content can be adjusted to fit the expectations of a particular audience. A story aimed at readers in Latin America can use local political references. A comment aimed at US audiences can emphasize war costs or distrust of an ally. The underlying operation remains coordinated even when the public messages look separate.

OpenAI’s account bans matter because they can disrupt access, expose patterns, and preserve evidence. They also demonstrate the value of monitoring how users apply AI systems rather than examining individual prompts in isolation.

Account enforcement alone cannot repair the wider damage. The Iranian network reached external outlets. The Russian operation used unwitting workers and a public-facing think tank. Articles and comments can remain online after the original accounts disappear. Readers may encounter the material through search results, reposts, or citations long after a platform has acted.

Platforms need a security process that connects model abuse with external signals. That process should include:

These measures require cooperation among AI companies, social networks, search engines, publishers, and researchers. Each company sees only part of the operation. A fake author may look harmless to a chatbot, ordinary to a social network, and suspicious only when a researcher compares publishing dates across several outlets.

Small publications face real constraints. They often have limited staff, rely on freelance submissions, and cover international subjects from far away. Those conditions create openings for false contributors who arrive with polished copy and plausible biographies.

A practical verification process can focus on the contributor rather than trying to detect every machine-generated sentence. Editors can check whether a journalist has a verifiable work history, contact the person through an established channel, compare claimed locations with account information, and ask for reporting details that would be difficult for a fabricated identity to provide.

Editors can also examine the pitch’s path. A contributor who sends similar material to many outlets, uses several different bylines, or appears alongside coordinated social accounts deserves additional scrutiny. A publication that receives a conflict article should verify core claims through independent sources before syndicating it.

Provenance records would help. Publishers should retain submission metadata, contributor verification details, edits, source documents, and syndication paths. Those records can support corrections and investigations when a campaign is discovered months later.

The standard should apply to human-supplied and AI-assisted material alike. An outlet can permit responsible use of writing tools while requiring clear authorship, source verification, and editorial accountability. Readers need to know who stands behind a claim and how the publication checked it.

The SRC case adds a difficult human dimension. OpenAI said Latin American employees appeared unaware that a Russian group controlled the operation. Those workers may have produced original material in good faith and later find their work associated with a foreign influence campaign.

Investigations should distinguish deliberate operators from people who were deceived. Public accusations without evidence can damage journalists, researchers, translators, and contractors who were recruited through ordinary-looking organizations. Platforms and publishers should provide a way for affected workers to submit evidence, correct records, and explain their role.

That distinction also improves detection. Recruiters may present a front organization as a think tank, media project, or research consultancy. Workers may see normal assignments while sponsors direct the broader political purpose. Examining funding, management, recruitment channels, and editorial instructions can reveal the structure behind apparently local output.

The defensive model must move from judging isolated content to securing the systems that confer credibility.

A quiet takedown rarely reaches everyone who saw the original material. When a fake byline or front organization is exposed, publishers and platforms should publish clear corrections, identify the affected articles, explain the verification failure, and update search and recommendation systems where possible.

The correction should preserve useful distinctions. It should state what investigators confirmed, what remains uncertain, and which people or outlets were deceived. This approach gives readers a reliable record and reduces the chance that the exposure itself becomes another source of rumor.

Researchers and journalists also need access to enough evidence to study the operation without exposing personal information or operational details that could put people at risk. Transparency reports can include timelines, tactics, target regions, content volumes, and indicators of coordination.

The main lesson from these cases is operational. AI propaganda can attack identity systems, editorial processes, platform moderation, and public memory at the same time. A fluent article becomes dangerous when the surrounding systems mistake a fabricated source for an independent one.

Media companies already invest in account security, fraud detection, and incident response because attackers can exploit weak links. Coordinated influence campaigns require the same level of attention. They should trigger escalation paths, cross-platform analysis, evidence retention, and public reporting.

OpenAI’s findings give publishers and platforms specific warning signs: seven fabricated journalist identities, nearly 100 placed or syndicated articles, a fake think tank, unwitting regional workers, VPN access, and coordinated social commentary. Those details describe a repeatable method. The next operation may use different names and target a different war or election.

Public trust depends on making that method expensive, visible, and difficult to scale. AI companies must detect coordinated abuse. Media outlets must verify people as carefully as they verify claims. Social platforms must connect account behavior to outside publishing activity. Search and recommendation systems must respond when a source network is exposed.

The fight concerns the infrastructure that lets strangers decide which information deserves belief. Once that infrastructure becomes easy to impersonate, every publisher and platform inherits a security problem. Treating AI propaganda as a content moderation issue leaves the central vulnerability exposed.