AI Edge Briefing
Topics / topic

Influence Ops

15 items across 14 editions. First seen Fri 11 Sep, last seen Wed 28 Oct. Traced across 2 weekly reviews.

How this story has evolved

From the week in review: the connections, developments and open questions filed under Influence Ops, newest week first.

Week of 5–11 October 2026

Development · Thu 8 Oct, Fri 9 Oct
OpenAI bans a Russian network it rates its first Category 5 operation and an Iranian one that placed about 100 articles

OpenAI said on 8 October that it banned two clusters of ChatGPT accounts, one originating in Russia, which it names "Dark Clark", and one in Iran, which it names "Bogus Bylines". It rates Dark Clark Category 5 on its 1-to-6 Breakout Scale — the first Category 5 operation it has disrupted since it began reporting — and Bogus Bylines Category 4 for its article-planting workstream and Category 2 for its commenting workstream. OpenAI called Dark Clark "the most complex attempt to run a front identity that we've disrupted over the past two and a half years".

Week of 7–13 September 2026

Development · Thu 10 Sep, Fri 11 Sep
Anthropic threat report: a Russian espionage actor automated attacks on more than 20 organisations; an influence-for-hire network published 8,913 articles

Anthropic published "Detecting and countering misuse of AI: September 2026" on 10 September, covering activity disrupted between December 2025 and August 2026 across seven harm areas. GTG-20006, whose attribution Anthropic says "is consistent with public reporting linking the actor to Midnight Blizzard", appeared in operations against "more than 20 distinct organizations" — government ministries, defence and intelligence bodies, embassies and defence-industrial companies "concentrated in Ukraine and Europe but extending to the Middle East and maritime related government agencies in Asia".

Wednesday, 28 October 2026

AP: AI-manipulated videos linked to Russia misuse real people's names to attack two Senate candidates harmfulSingle source

Associated Press via KWTX
  • AP reports social media videos believed to be produced with AI and linked to Russia are misusing real people's names and photographs to spread disinformation about Senate candidates Sherrod Brown in Ohio and James Talarico in Texas. The Ohio video is styled as a newscast and includes pictures of Haya Akbik, a former Brown intern, and other former staff; Akbik told AP the claims attributed to her are "completely made up" and said "It's my name, it's my reputation, making this allegation, and it's just completely false."
  • Dartmouth's Hany Farid told AP his analyses indicated both videos were likely generated or manipulated with AI; he called the Brown video a "fairly low-tech fake" and said the Talarico video "is consistent with previous disinformation campaigns released close to Election Day". Clemson's Darren Linvill found that accounts sharing the new material had also shared earlier content from the Russian network known as Storm-1516, which targeted Kamala Harris and Tim Walz two years ago.
  • The attribution is characterised as likely, not confirmed. X took down the initial posts and suspended the users for violating its rules, but copies were still findable on Tuesday, some with hundreds of shares. CISA did not respond to AP's request for comment and the Russian Embassy did not immediately respond; AP notes it has denied interfering in US elections in the past.
Influence OpsDeepfakesElectionsThreat Intel

Thursday, 22 October 2026

Researchers tie deepfake videos accusing a Texas Senate candidate of assault to Russian group Storm-1516 harmfulSingle source

Politico via Yahoo News·Straight Arrow News
  • Politico reports that "Information operations analysis company Graphika released findings Wednesday that Storm-1516 — a Russian-linked influence group active since 2023 — created and posted deepfake videos on X accusing Texas Senate candidate James Talarico of sexual assault."
  • Straight Arrow News reports the posts drew "more than 500,000 views and hundreds of comments on X," that the "Zyon Lewis" account was created in September with four posts before the allegation, and that one amplifying account has more than 185,000 followers. It quotes Clemson professor Darren Linvill saying the post "follows the Russian playbook" and was "immediately shared by 15 marketing bots," and cites researchers at antibot4navalny calling it "one of the few Storm-1516's campaigns (so far) targeting the US midterms."
  • The reach went beyond social media. Straight Arrow News attributes the Storm-1516 link to the Gnida Project, and the campaign's significance is that a fabricated accusation against a named candidate was seeded through an account impersonating a real former student weeks before a US midterm election.
  • Graphika's own report was not published to its public reports index at the time of writing, so the attribution rests on Politico's and Straight Arrow News's accounts of it alongside the Gnida Project's work. Neither outlet gives a forensic detection score, and X has not said whether the account or videos were removed.
DeepfakesInfluence OpsElectionsThreat Intel

Monday, 19 October 2026

Bloomberg review: Russian-linked Matryoshka network aimed 130 fabricated videos at US midterm candidates harmfulSingle sourceUpdate

Kyiv Post
  • Kyiv Post, relaying a Bloomberg News review, says Bloomberg examined 130 fabricated videos and doctored newspaper front pages circulated between 10 September and 9 October 2026 and attributed to the network tracked as Matryoshka, also called Operation Overload. Kyiv Post describes the campaign as "focused almost exclusively on Democratic contenders".
  • The material targeted Democratic candidates in 20 of the 35 US Senate races and 29 of the 36 gubernatorial contests on the 3 November ballot, naming Texas Senate nominee James Talarico and Georgia Senator Jon Ossoff. Talarico's spokesperson denied the claim made against him, and Kyiv Post says no public records substantiate the claim about Ossoff.
  • The clips use synthetic likenesses of Robert De Niro, Julia Roberts and Cher, and impersonate ABC News and CBS News broadcasts. Antibot4Navalny, which monitors Kremlin-aligned networks, says views "can jump as high as 200,000 within the first hour but then quickly plateau", a pattern Kyiv Post attributes to bot networks manipulating view counts.
  • Kyiv Post says the US open-source intelligence firms Graphika and dTeam corroborated the findings. The underlying Bloomberg investigation published before this window and bloomberg.com could not be opened from here; the figures above are quoted as Kyiv Post relays them.
Influence OpsDeepfakesElectionsThreat Intel

Friday, 16 October 2026

UK Electoral Commission building deepfake flagging system; May pilot scanned 3 million posts and flagged 147 mixedSingle source

Tech Policy Press
  • Tech Policy Press reports Electoral Commission CEO Vijay Rangarajan saying the Commission is developing an AI system that analyses social media posts in real time, flags likely deepfakes for staff review, and notifies affected candidates or parties ideally within three hours of first appearance.
  • In a May 2026 local election pilot the article reports about 3 million posts analysed, 147 posts flagged, and 10 judged "really quite misleading" after human review and referred to social media companies or police. Rangarajan said those posts did not have a major effect.
  • Rangarajan is reported to have said the Commission faces roughly 30,000 to 40,000 attacks a month, sometimes peaking around 10,000 a day, including botnets, phishing and mass emails.
  • He is also reported to have said the Commission detected signs of "algorithmic bias" in at least one UK election, likely involving a social media company he did not name, and that the UK has no current legislative tool for this problem. The remarks were made at a panel during the Conservative Party conference; no system documentation, false-positive rate or launch date has been published.
UKDeepfakesElectionsInfluence Ops

Thursday, 15 October 2026

Anthropic says 0.01% of sampled US Claude conversations asked whom or what to vote for, and adds state-specific voting information mixedCompany claim

Anthropic
  • In a sample of 250,000 US Claude.ai conversations from September 21 to 27, 2026, Anthropic says about 5.75% touched politics, policy or social issues, about 0.51% elections or voting, about 0.01% asked whom or what to vote for, and about 0.002% violated its election-integrity policies.
  • Anthropic says it is adding official voting information from Democracy Works, so US users asking where to vote or what ID to bring "will now get an answer specific to their state", keeping its TurboVote banner, and showing "the latest official numbers" on election night and after. It says Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 are "our most evenhanded to date, scoring 99%" on its own evaluation.
  • It also names gaps: red-teaming with the Institute for Strategic Dialogue and the McCain Institute found Claude "reliably refused a single harmful request" but could miss campaigns split into smaller tasks, and Anthropic says Sonnet 4.5 "didn't always hedge evenly", being more likely to soften right-leaning arguments. Every figure is Anthropic's own measurement of its own product.
AnthropicElectionsInfluence Ops

Tuesday, 13 October 2026

DFRLab finds four coordinated inauthentic networks amplifying war fears before Armenia's June election harmfulSingle source

DFRLab
  • DFRLab and partners identify four networks of coordinated, often inauthentic Facebook pages and websites, plus synchronised Telegram channels, pushing claims that hundreds of thousands of Azerbaijanis would come to Armenia and that the 7 June 2026 election would bring war. Several assets stopped posting on 9 June, two days after the vote.
  • On the volume: the "300,000 Azerbaijanis" narrative ran at about 78 posts a week from January to late April, nearly quadrupled in the week of 27 April, and peaked at 1,344 mentions in the week of 25–31 May, with nearly 80% of all mentions falling in the campaign's last six weeks. About 41% of all "warmongering" mentions fell between 9 and 29 March.
  • The coordination signals are mechanical: Network 2 was over 50 pages reposting the same outlet with identical texts often within the same minute; the Telegram pair @abovyanarman and @armsens published the same object within a minute 572 times between 8 May and 14 June, 374 of them in the same second. DFRLab says Facebook labelled some Network 1 pages as using AI-generated content, and that three domains carried AI-generated logos "created in the same ChatGPT session, seven minutes apart, on May 12, 2026."
  • DFRLab states that coordination and inauthenticity are assessed separately and that a shared developer alone does not establish common control. It does not attribute the networks to a sponsor, and the AI component is confined to logos and platform labelling rather than the narratives themselves.
Influence OpsElections

Saturday, 10 October 2026

OpenAI says an Iranian influence campaign placed about 100 fake articles under seven bylines harmfulUpdate

The Washington Post (Yahoo News)
  • The Washington Post reports that OpenAI said on Thursday the campaign "placed about 100 fake articles across at least 20 news outlets", using seven bylines, generated by users based in Iran who sent instructions to ChatGPT in Persian. Many of the articles highlighted negative effects of US military action in Iran on Americans.
  • One outlet was the Port St. Joe Star, a weekly in Gulf County, Florida, which has a population of about 15,000. It ran an op-ed under the byline "Ervin Hoskins"; publisher David Adlerstein said it was pitched by PeaceVoice, an Oregon think tank that had sent the paper content for "years", and that he did not feel a need to verify the column's origin or the author's identity. The same byline appeared on Daily Kos and Middle East Monitor, which together have more than 3 million Facebook followers.
  • OpenAI said the activity "appeared consistent with a commercial actor running a for-hire influence campaign, but we are unable to identify the particular actor involved", that it banned the accounts and blocks access to ChatGPT from Iran, and that it shared information on the case with relevant authorities. The author photo on the Star's column was generated with OpenAI's tools, according to the company's own verification tool.
  • Middle East Monitor and Daily Kos said they had taken down the articles and were reviewing their processes; Daily Kos founder Markos Moulitsas called the campaign "incredibly corrosive". No audience or engagement figures for the fake articles are given. The Post notes that it has a content partnership with OpenAI. This adds detail to the Iranian network OpenAI disrupted in the report covered in yesterday's edition.
OpenAIInfluence OpsThreat Intel

Friday, 9 October 2026

OpenAI bans Russian and Iranian "false front" networks, rating the Russian one its first Category 5 operation harmfulCompany claim

CyberScoop·Unite.AI
  • OpenAI says it banned two clusters of ChatGPT accounts: one originating in Russia, which it names "Dark Clark", and one originating in Iran, which it names "Bogus Bylines". It rates Dark Clark Category 5 on its 1-to-6 Breakout Scale — the first Category 5 operation it has disrupted since it began reporting — and Bogus Bylines Category 4 for its article-planting workstream and Category 2 for its commenting workstream.
  • The Iranian cluster ran seven invented reporters posing as Western journalists; OpenAI identified almost 100 articles published or syndicated under those bylines across roughly a dozen small and medium outlets, the earliest dated July 2025 and the latest October 2026. The accounts were prompted in Persian, produced Persian and English content, and used VPNs to obscure location.
  • Dark Clark was named after a fake persona, "Mia Clark", presented as the leader of a purported think tank called the Social Research Center. CyberScoop reports the group focused on harming Ukraine's reputation in Latin America and involved itself in politics in Argentina and Bolivia, and that its activity included fake audio clips, one impersonating the Ukrainian consul in Ecuador. OpenAI called it "the most complex attempt to run a front identity that we've disrupted over the past two and a half years".
  • OpenAI did not attribute either campaign to a specific government agency; it noted the Russian operators showed particular interest in Politology, described as a successor to the Wagner Group, and said the Iranian campaign looked like "a commercial actor running a for-hire influence campaign". CyberScoop reports most campaigns OpenAI tracks rate 1 or 2, that the Iranian stories drew little engagement, and that the reach of these two prompted fact-checks and official denials in Latin America. OpenAI's own report page returned HTTP 403 to this briefing's fetchers, so every figure above comes from the two reports that quote it.
OpenAIInfluence OpsThreat Intel

Thursday, 8 October 2026

EU, Canadian and Lithuanian sponsor logos taped over at Vilnius disinformation conference; France the only state sponsor left harmfulSingle source

Tech Policy Press
  • The #Disinfo2026 conference, run by the nonprofit EU DisinfoLab and focused on foreign information manipulation and interference, opened on 7 October in Vilnius. Tech Policy Press reports the logos of three government sponsors — the European External Action Service, Canada and Lithuania — were covered with tape just before the event.
  • The EEAS said it removed its logo because of the programme's content, saying some discussions "do not align with the official positions held by the EU", while its representatives still presented research. Global Affairs Canada continues to participate but revised its involvement in several panels after session framings changed. France is the only remaining government sponsor and reaffirmed its support.
  • One contested session asked whether the US itself could be considered a source of foreign information manipulation in Europe. Speaker Adam Fivenson called the conference an "island of civil society sanity", and no speakers withdrew.
  • EU DisinfoLab, the Lithuanian government and the US State Department did not comment before publication. An update to the piece says The Guardian reported the Trump administration urged several countries to drop sponsorship; that report could not be opened for this edition and is not confirmed here.
Influence OpsEU AI ActElectionsUS Federal Policy

Wednesday, 30 September 2026

DFRLab traces a fabricated Politico story about Armenian tomatoes across 380+ posts and 18 languages in 29 hours harmfulSingle source

DFRLab
  • DFRLab collected more than 380 posts across Telegram, X, Facebook and VK between 22 and 31 July 2026, spreading into 18 languages within 29 hours; 197 posts appeared on 23 July alone, and it identified 493 posts on X. The first post it found was on 22 July 2026 at 16:08 CET on the Telegram channel @indeec_1937, with a second wave on 27 July.
  • DFRLab links the amplification to the Russian operation tracked as Storm-1516, writing that "74 [X] accounts have a documented history of reposting or quoting content from campaigns that we have attributed to Storm-1516 targeting Armenia". On X, 62 accounts posted more than once.
  • The operation used a digitally altered photograph of Ursula von der Leyen casting a ballot, edited to show tomato-throwing. DFRLab documents no deepfake and no synthetic video or audio in this campaign — the manipulation was a doctored still and a fake news-outlet byline, which is worth registering against the assumption that influence operations have moved wholesale to generative video.
  • This is DFRLab's own attribution and counting; no platform has confirmed the account network, and the events described took place in July.
Influence OpsDeepfakesThreat Intel

Monday, 21 September 2026

Taiwan's justice ministry orders a deepfake crackdown before year-end local elections mixedSingle source

Taipei Times
  • The Taipei Times reports that Taiwan's Ministry of Justice said authorities would crack down on deepfake election content ahead of the year-end local elections, with law enforcement to "step up forensic tracing, take down deepfake content promptly, and strictly investigate and hold perpetrators accountable in accordance with the law".
  • The ministry said agencies would track emerging deepfake trends, enhance intelligence analysis and "cooperate with national security forces to counter foreign cognitive warfare", and work with news outlets, major digital platforms and messaging apps on fast removal.
  • Under the Civil Servants Election and Recall Act, people who disseminate deepfake audio or video misinformation targeting election candidates "may face a maximum penalty of seven years in prison", and platform operators who fail to comply with removal orders also face penalties.
  • Cases cited include an AI-generated video of DPP Changhua County commissioner candidate Chen Su-yueh, and the questioning of former KMT New Media Department director Wei Chun-yu over an allegedly AI-faked voice of President William Lai. Only one outlet has this, and the Taipei Times does not publish a clock time, so the exact posting time could not be confirmed.
DeepfakesElectionsInfluence Ops

Friday, 18 September 2026

DFRLab ties a Baltic influence campaign to Russian military intelligence and finds Grok Imagine used to fake a soldier video harmfulSingle source

DFRLab
  • DFRLab reported on 17 September that an operation it tracks as Storm-1516 ran four false narratives against Estonia, Lithuania and Latvia from 30 July to 17 August 2026, and that the operation is "publicly attributed to Russia's military intelligence" with technical links to project Lakhta.
  • The fourth campaign used "X's Grok Imagine video-generation tool" to create "a short video from a photo of a Latvian soldier" supporting a false claim that only twenty-five percent of young men called up for military service report as required. DFRLab says approximately two-thirds of those who receive conscription notices attend the required medical examination.
  • DFRLab measured "275 mentions across X, Telegram, Facebook, TikTok, Instagram, VKontakte, and Pravda Network webpages" and analysed "1,651 unique X accounts", of which 105, or approximately 6.4 percent, amplified more than one campaign. At least two cloned media websites impersonated The Defense Post and EUobserver.
  • Reach was uneven: Lithuanian-language Facebook posts on one narrative drew 423 engagements against 17 for English-language posts. DFRLab is the only organisation to have published this analysis.
Influence OpsDeepfakesxAIThreat Intel

Citizen Lab: Israeli firm BlackCore trained Angolan government staff for 14 weeks to run AI-assisted fake-persona operations harmful

Citizen Lab·The Record
  • Citizen Lab reported on 17 September that BlackCore, an Israeli influence-for-hire company, ran "more than 14 uninterrupted weeks of training and practical operation" for Angolan government employees, beginning 19 January 2026, having advertised an intensive four-week course.
  • Citizen Lab says the operation "deployed clusters of fake, automated accounts that used AI to mass-produce contextually relevant comments designed to artificially boost engagement", and that operatives used AI-generated imagery for persona profile pictures. It identifies at least five named personas across Facebook, Instagram and TikTok, and says BlackCore claims to control "several thousands of social media sockpuppet accounts".
  • The Record reports participants produced more than 40 pieces of content through a fictitious outlet called "Agita News", and that some deceptive Facebook posts drew roughly 50,000 likes.
  • Meta published an adversarial threat report on 27 August 2026 describing the network as "an influence-for-hire operation, likely run on behalf of a number of distinct clients"; Citizen Lab assesses it was "highly likely" operated by BlackCore. Citizen Lab says BlackCore did not name the Angolan trainees anywhere in the documentation it analysed.
Influence OpsDeepfakesThreat IntelSurveillance

Saturday, 12 September 2026

Defense One: Anthropic found a Russian group using Claude to build drone targeting that detonates without a human in the loop harmfulCompany claimUpdate

Defense One·Anthropic
  • Defense One reported on 11 September at 06:53 pm ET that, per Anthropic, a Russian "freelance" group tracked as GTG-27005 used Claude to build a model letting a drone "select targets (including a 'person' target class) and issue detonation commands without a human in the loop", plus software for autonomous drone-to-drone communication to improve targeting.
  • The group had not deployed the system operationally but conducted "real hardware-in-the-loop testing within their sessions" — the step between a design document and a fielded weapon.
  • A second group, GTG-84005, used Claude to extract census and public information to tailor messaging at specific audiences in Malaysia, where Defense One says it "laundered Russian and Chinese state media as independent reporting".
  • Defense One sets this against reductions in US counter-influence capacity: Attorney General Pam Bondi dissolved the FBI's Foreign Influence Task Force, Secretary of State Marco Rubio shuttered the State Department's Counter Foreign Information Manipulation and Interference hub, and the 2025 White House AI Action Plan removed references to misinformation. The attribution and capability claims are Anthropic's and are not independently verified.
AI in weapons targetingAnthropicAutonomous WeaponsInfluence OpsThreat IntelMilitary

Friday, 11 September 2026

Anthropic report: commercial influence-as-a-service operation published 8,913 articles in ~20 languages across 70 fake news sites harmful

Anthropic
  • GTG-54002, which Anthropic attributes to a France-based firm it calls LKM Company, ran "approximately 70 fabricated news websites," 70 matching X/Twitter accounts and more than 250 inauthentic commenting accounts, and "published at least 8,913 articles in about 20 languages" across six continents, with the United States, Brazil, France and the Democratic Republic of Congo among the targets.
  • A separate cluster, GTG-84005, attributed to Istanbul-based BBS Bilisim Teknolojileri, managed "roughly a thousand fake X/Twitter social media accounts" and profiled voters across "all 222 Malaysian parliamentary constituencies" using census and electoral data, exploiting race, religion and royalty as wedge issues.
  • What is new here is the business model: manipulation sold as a commercial service to clients, rather than run in-house by a state. Anthropic rates both operations Category Two on the Breakout Scale — meaning no measured spread beyond the operations' own platforms — so reach should not be inferred from article counts.
  • The article and account totals are Anthropic's counts of activity on its platform, not an independent audit of the networks.
AnthropicInfluence OpsThreat IntelElections