OpenAI bans show AI’s growing back-office role in influence operations

AI lowered production costs, but people still provided distribution

Across both cases, AI reduced the cost of language work, administrative coordination and persona maintenance. Distribution still depended on human systems.

In the Russian case, OpenAI said operators used ChatGPT most heavily to draft and update internal reports, including reports to an unknown superior on campaign activity across Latin America.¹ Those reports described workstreams intended to damage Ukraine’s reputation, influence domestic politics in countries including Argentina and Bolivia, and manage the Social Research Center front.¹

CyberScoop reported that the Russia-linked cluster appeared to control the Social Research Center through the fake persona “Mia Clark.” It also reported that ChatGPT-assisted reports discussed wage scales and hiring and firing decisions—evidence OpenAI treated as suggesting operational control rather than arms-length observation.²

That is a different misuse pattern from the familiar image of AI flooding platforms with synthetic posts. In “Dark Clark,” the model appears to have functioned as a staff officer, translator, editor and report writer. It helped operators package their activity for supervisors, adapt language to local contexts and, in some cases, draft materials later tied to fake documents or audio scripts.¹⁶

In the Iranian case, the workflow was more recognizably editorial. Operators used ChatGPT to refine long-form English-language articles, assess drafts against submission requirements, generate pitch emails and create social-media comments after publication.¹⁴ TokenPost reported that the “Bogus Bylines” campaign used seven fabricated journalist identities, generated material in Persian and English, and placed nearly 100 articles across more than a dozen online publications.⁷

The model helped with polish and persistence. But the decisive step was still external validation: an editor had to accept a submission, an outlet had to publish it, and the byline had to appear plausible enough to survive routine review.

False fronts remain the core capability

OpenAI framed both cases as “false front” operations: efforts to hide the real sponsor behind an entity or persona that appears independent.¹ That framing is important. AI did not replace the front; it made the front cheaper to maintain.

The Russian operation’s Social Research Center appears to have been designed as a durable institutional cover. OpenAI said the available evidence indicated that employees in Latin America were likely unaware they were working for a Russian group, and that the center produced a majority of original content through co-opted staff.¹ AFP, via RTL Today, reported that OpenAI described this as the most complex front identity it had disrupted in two and a half years.⁶

This use of unwitting cutouts matters for defenders. A front staffed by real people and producing real research outputs can look more credible than a disposable fake news site or botnet. It may also pass platform and editorial checks that focus narrowly on account authenticity rather than beneficial ownership, editorial control or hidden sponsorship.

The Iran-origin operation used a different kind of front: individual credibility rather than institutional credibility. OpenAI said the seven fake bylines claimed to be Western journalists and often focused on international politics, the Middle East, human rights or conflict.¹ CNN reported that roughly 100 articles by seven fake journalists ran in about a dozen outlets, and that operators prompted ChatGPT in Farsi to tweak articles and editorial pitches and generate social-media comments.⁴

The common denominator was identity laundering. In one case, a think tank provided the wrapper. In the other, fake journalists did. In both, AI helped operators sustain the language, tone and administrative workload needed to keep the wrapper believable.

Narrative laundering outperformed fake engagement

The operations also underline an emerging hierarchy of impact. Social media remains useful for amplification, but OpenAI’s assessment suggests that publication through external outlets can create more potential reach than fake accounts posting directly.¹

OpenAI said the Iran-origin operation generated batches of social-media comments, generally related to the U.S.-Iran war, but that none appeared to have produced substantial engagement through likes, shares or replies.¹ By contrast, the article-placement workflow produced almost 100 published or syndicated articles across roughly a dozen outlets.¹⁷ CNN noted that one outlet that carried material, Middle East Monitor, had nearly 2 million Facebook followers, giving even non-mainstream outlets meaningful distribution potential.⁴

NPR’s report highlighted the same asymmetry: campaigns that placed false narratives in established media appeared to reach wider audiences than campaigns relying on fake social-media accounts.³ The report also quoted expert context describing this as narrative laundering—using fake stories or personas to spread propaganda through channels that appear more legitimate than the original operators.³

That distinction should shape platform policy. If AI misuse is treated mainly as a spam or bot problem, defenses may miss the higher-impact pathway: AI-assisted preparation of material that later enters the information environment through real editors, real outlets, real researchers or real local contractors.

Internal reporting is part of the threat surface

One of the more consequential details in OpenAI’s report is also one of the least visible to the public: internal reporting. Both operations used ChatGPT to draft internal reports, and OpenAI said both used questionable or deceptive methods to inflate their apparent effectiveness.¹

That suggests AI tools can serve two audiences at once. Externally, they help refine messages, pitches and personas. Internally, they help operators summarize activity, claim credit, justify budgets and persuade sponsors or clients that a campaign is working. In the Russia-origin case, OpenAI said operators sometimes tried to take credit for activity that appeared unrelated to their own operation.¹

For influence-for-hire ecosystems, that reporting layer may be especially important. OpenAI said the Iran-origin activity appeared consistent with a commercial actor running a for-hire influence campaign, though it did not identify the actor or confirm government involvement.¹⁴ If contractors can use AI to manufacture polished impact reports as well as polished propaganda, sponsors may have a harder time distinguishing actual influence from embellished deliverables.

The policy problem extends beyond model outputs

The cases show why AI safety controls are necessary but insufficient. OpenAI banned the account clusters and shared information with relevant authorities.¹ Bloomberg Law summarized the enforcement action as bans against two covert influence operations that used ChatGPT for geopolitical influence tasks, including fake leaked documents and audio scripts in the Russian case.⁵

But many vulnerabilities sat outside the model provider’s perimeter. Editorial systems accepted submissions from personas that were not what they claimed to be. Social platforms hosted backstopping accounts. A local research front allegedly relied on people who did not know who ultimately controlled the project. Public institutions and fact-checkers were forced into reactive denial cycles after planted claims spread far enough to merit response.¹²⁶

Unite.AI’s analysis noted OpenAI’s comparison to earlier pre-AI false-front operations, including the fake journalist persona “Alice Donovan” and the “PeaceData” outlet that recruited unwitting journalists.⁸ The comparison keeps the novelty in proportion. The tradecraft is not new. What is new is the efficiency with which operators can maintain language quality, tailor pitches, produce summaries, localize materials and run multiple identities at once.

What defenders should take from the cases

For security teams, the operational lesson is to monitor the workflow, not just the content. Signals may include repeated editorial submissions from thinly backstopped personas, biographies that reuse themes across outlets, social accounts whose transparency data conflicts with claimed identity, and research organizations with opaque control structures or implausible staffing claims.

For platform-policy teams, enforcement should connect identity, provenance and distribution. A fake journalist persona may look low-impact on social media but high-impact if its articles are landing in external publications. A think-tank account may look benign if judged only by engagement metrics, yet matter if it provides cover for local recruitment, expert outreach or narrative placement.

For news organizations and civil-society outlets, the cases argue for stronger contributor verification, especially for unsolicited geopolitical commentary. The aim is not to block outside voices. It is to verify that a purported freelancer, researcher or analyst is a real person or accountable institution, and that the submission is not part of a concealed state-linked or for-hire campaign.

The most consequential AI misuse in these operations was not mass automation in public view. It was operational support behind the scenes: making fronts more fluent, personas more manageable, reports more polished and pitches easier to send. Distribution still depended on human trust. AI made that trust cheaper to exploit.