AI Models as Tools and Targets in Foreign State Disinformation Campaigns

Two parallel developments in mid-2026 show AI models being used both as tools for and potential resistors of foreign state influence operations. OpenAI identified and banned two PRC-linked clusters of ChatGPT accounts that generated covert social media content targeting US debates over AI infrastructure costs and trade tariffs; neither campaign showed measurable public opinion impact beyond its own generated activity [1]. Estonia's Language Institute, working with civil defense collective Propastop, published a ranked benchmark assessing how well major commercial LLMs resist 14 categories of Russian strategic narratives, tested in three languages with adversarial prompts and calibrated against expert assessments [2]. The two developments together show AI platforms self-policing offensive misuse while at least one government with direct exposure to foreign information operations has begun independently measuring commercial LLM behavior under propaganda pressure.

AI infrastructure has become a subject of foreign influence operations, not just a medium for them — the PRC campaigns specifically targeted public narratives about US AI data centers and AI policy [1]. Estonia's benchmark illustrates a government treating LLM propaganda resistance as a measurable, auditable property rather than a matter of trust in developer self-policing alone [2].

Two threads have developed concurrently in mid-2026 around AI models as instruments and objects of foreign state influence activity.

On the offensive use side, OpenAI published a threat report on June 10, 2026, disclosing that it had identified and banned two clusters of ChatGPT accounts linked to PRC-origin operators [1]. The first, labeled 'Data Center Bandwagon,' generated social media content falsely claiming that AI data center construction was raising electricity prices for ordinary families. The second, 'Tech and Tariffs,' produced content criticizing US trade tariffs while explicitly instructing the model to exclude Xi Jinping from outputs and center criticism on President Trump. OpenAI assessed that neither operation achieved measurable public opinion impact beyond its own generated activity, but noted that the campaigns were specifically probing narratives against US AI infrastructure — a foundation of US technological and economic position, in OpenAI's framing [1]. OpenAI characterized the publication as a public-interest disclosure to help governments, industry, and civil society identify and disrupt future attempts.

On the defensive measurement side, Estonia's Language Institute (EKI) and the volunteer civil defense collective Propastop published a benchmark on June 4, 2026, ranking major LLMs on their resistance to Russian propaganda [2]. The benchmark covers 14 categories of Russian strategic narratives — including justifications for the war in Ukraine, denial of Soviet occupation of the Baltic states, and framing of NATO's historical role — and was administered in English, Estonian, and Russian. Model responses were scored by a separate AI judge calibrated against Propastop expert assessments. Tests included neutral control questions, questions with embedded propaganda assumptions, and adversarial prompts specifically designed to elicit explicit misinformation [2].

Taken together, these developments show two different governmental and institutional responses to the same underlying problem: that large language models can serve as content factories for influence operations, and that their default behavior under propaganda-laden prompts varies meaningfully across models and languages. OpenAI's self-reporting and Estonia's external benchmarking represent complementary but structurally distinct approaches — one relies on the platform to detect and disclose misuse after the fact, the other attempts to measure model vulnerability before deployment in adversarial conditions.