OpenAI Says It Disrupted Its First "Category 5" Influence Operation — and AI Was the Junior Partner

OpenAI says it has banned two covert influence operations — one originating in Russia, one in Iran — that used ChatGPT to support elaborate "false front" entities, including a think tank staffed by people who allegedly did not know who they worked for and a stable of seven fabricated journalist bylines. The company rates the Russian network a Category 5 on the six-point IO Breakout Scale, the first operation at that level it says it has disrupted since it began publishing threat reports two and a half years ago. The most instructive finding for anyone building or defending AI products is how modest the AI component was: the Russian operators used the models mostly to write status reports to their own bosses.

Two operations, old playbooks

OpenAI's framing is unusually blunt about novelty, or the lack of it. Both networks, the company says, closely resembled complex influence operations from the pre-AI era and used models to smooth particular workflows rather than to invent new ones. OpenAI explicitly draws the lineage: the Iranian fake-journalist personas resemble "Alice Donovan," a Russian military intelligence front whose articles ran in Western outlets in 2016-17, while the Russian think-tank structure resembles "PeaceData," a fake news outlet exposed by Meta in 2020 that co-opted unwitting journalists.

The Russia-origin cluster, which OpenAI nicknamed "Dark Clark" after a fake persona called "Mia Clark," targeted Latin America. According to OpenAI, much of the activity aimed to damage Ukraine's reputation in the region, with additional work directed at domestic politics in Argentina, Bolivia and Ecuador. Most operators prompted in Russian; one prompted in Spanish but appeared to be in Russia. Because OpenAI does not allow access from Russia, the operators used VPNs — a reminder that geographic blocking is a speed bump, not a control.

The Iran-origin cluster, dubbed "Bogus Bylines," prompted in Persian and produced content in Persian and English, also behind VPNs. OpenAI says it used the models to refine long-form articles and editorial pitches, generate batches of social media comments — mostly about the US-Iran conflict — and polish internal reports. The company says it identified almost 100 articles published or syndicated in connection with the operation, and rates it Category 4. Further detail on the Iranian network's reach is not available in the portion of the report reviewed here.

The surprising workload: bureaucracy

The detail most worth sitting with is that, in the majority of cases, OpenAI says it did not observe the Russian operators using its models to create campaign content at all. The dominant use was drafting and updating regular internal reports to an unknown superior, covering three workstreams: denigrating Ukraine and disrupting recruitment for its armed forces, interfering in domestic politics in Bolivia and Argentina, and managing the front think tank, the Social Research Center.

Those reports, OpenAI says, were rich in operational detail — pay scales, hiring and firing, research projects, claimed fakes and their results. They were also, by OpenAI's assessment, systematically inflated. In one case the operators claimed credit for arguments made by Argentina's foreign minister at a United Nations committee on the Falkland/Malvinas islands; OpenAI notes those arguments have been Argentina's official position for years. In another, the operators claimed Brazilian coverage of a captured fighter reproduced their messaging when the report quoted the man's own video. OpenAI's dry conclusion: the operators appeared to be running an influence operation on their own employers.

For security teams, that is a usable signal. If a meaningful share of adversarial AI usage is self-promotional paperwork rather than payload generation, detection surfaces shift. It also complicates impact assessment, since the primary evidence of what these groups did comes from people with a direct incentive to exaggerate.

What OpenAI could and could not corroborate

OpenAI is careful here, and the caution is warranted. It says the operators' claims cannot be taken at face value, and that some claimed fakes did not appear in open-source searches — possibly because they were spread privately, removed, or never posted.

Several claims did check out against public evidence, however. OpenAI says the operators described using a spoofed email address from a Lima education authority to prompt Peruvian schools to hold Ukraine-themed events referencing the nationalist figure Stepan Bandera, then planting stories about those events in Peruvian and Polish media; the company says open-source searches found matching coverage in both, plus an English-language outlet in Hungary, and reaction from a Polish MEP. A similar email scheme targeted schools in Ecuador. Other claimed fakes — audio attributed to Ukraine's consul in Ecuador, a fabricated water-shutoff warning in Bolivia during protests, a forged contract alleging Ecuadorians were being recruited to fight in Ukraine — matched content, fact checks or official denials that researchers later found online.

OpenAI also ties two earlier campaigns targeting Argentina's president to "Politology" or "La Compania," described in public reporting as a successor to Wagner Group and other entities founded by Yevgeniy Prigozhin. Notably, the operators repeatedly asked the models to translate or explain public reporting about those entities.

The real distribution insight

Across the 30 covert influence operations OpenAI says it has exposed since early 2024, the pattern it highlights is about distribution, not generation: operations that place content in genuine media outlets achieve far higher potential reach than those relying on fake social accounts. Both networks here landed material in mainstream outlets, and not all of that material came from OpenAI's models.

That reframes the defensive problem. The exploited vulnerability is editorial trust — commissioning editors at small and mid-sized outlets, researchers accepting interview requests, and in the Russian case, Latin American staff who OpenAI says appeared to believe in good faith they were working for a legitimate research platform producing over 60 largely original articles. OpenAI contrasts this with another recent Russia-linked think-tank front that mostly plagiarized its output, calling Dark Clark the most complex front identity it has disrupted.

Caveats

OpenAI does not disclose how many accounts were banned, when detection occurred, how long the networks operated on its platform, or what signals triggered investigation. Its reporting captures only its own slice of the activity — the operations used other tools and channels, and the company says it shared information with relevant authorities without specifying which. The Breakout Scale measures potential reach, not persuasion or behavior change; a fact check and a ministerial denial prove a fake traveled, not that anyone's views moved.

The company's stated theory of change is disclosure itself: both "Alice Donovan" and "PeaceData" stopped after exposure, and OpenAI argues covert fronts are structurally fragile once named. That is plausible, and also unfalsifiable in the short term — personnel and methods tend to resurface under new branding.

What to watch

• Whether other model providers corroborate these clusters. Single-vendor telemetry cannot show whether operators simply distributed workloads across several AI services.
• Whether small and mid-sized publishers adopt harder verification for unsolicited pitches and freelance bylines, the actual chokepoint in both cases.
• Whether the Social Research Center's co-opted staff and similar front-entity employment models become a recognized recruitment risk, as OpenAI's framing suggests.
• Whether "AI for internal reporting" shows up in future threat reports as a durable pattern, and whether it proves detectable at scale.
• Whether any Category 5 assessment is independently validated — the rating currently rests largely on OpenAI's reading of operator claims plus open-source matching.