Claim-to-source matrix

Human planners retain strategic control while AI assists with research, translation, production, audience analysis, simulation, or measurement inside an established influence workflow.

Human-led psychological or strategic-influence activity in which AI supports bounded stages such as information synthesis, translation, content drafting, simulation, distribution support, or evaluation.

Fully autonomous systems choosing political objectives without human direction; transparent public communication is not automatically a psychological operation merely because AI assisted its production.

AI can reduce production friction and accelerate feedback loops while human operators retain strategic intent and accountability.

The immediate change is organizational: tasks that once required large multilingual teams can be performed faster and at lower cost.

The same systems can support lawful public communication or deceptive operations, so intent, attribution, consent, and oversight remain decisive.

Faster synthesis of large information collections.

Low-cost translation and localization, with continuing cultural-error risk.

Rapid generation of multiple media variants.

Simulation and message comparison before release, although synthetic audiences are not proof of real-world effects.

Near-real-time monitoring that can encourage overreaction to weak engagement signals.

Confirmed real-world use: Reports from platforms and public authorities describe AI used for drafting, translation, persona support, research, and technical assistance in covert influence activity.

Demonstrated technical capability: Controlled studies show that conversational models can be persuasive under bounded conditions, especially when given target information.

Effect remains uncertain: High output, reach, or engagement does not establish durable belief or behavior change.

Machine-assisted audience and narrative analysis.

Human-reviewed generation and localization.

Synthetic pretesting and scenario comparison.

Automated scheduling and measurement.

Human approval and deployment remain the defining control point.

STOIC / “Zero Zeno” Confirmed AI assistance A commercial influence-for-hire operation used AI to generate articles, comments, and persona material across several countries. Platform threat reporting confirmed AI use and disrupted the activity. The report describes low organic engagement despite high production volume. Whether the campaign changed attitudes or behavior among people who saw it remains unestablished.

Doppelgänger Confirmed AI assistance A Russian-aligned operation used AI-supported translation, rewriting, and short-form content around cloned or deceptive media properties. Public technical reporting documented the campaign and multilingual dissemination infrastructure. Production scale and cross-language reach were observable. Long-term persuasive effects and the contribution of AI relative to established human tradecraft remain uncertain.

Hallucinated or culturally inappropriate content can create strategic backfire.

Automation bias can cause operators to over-trust weak audience models.

Faster production can overwhelm verification and moderation capacity.

Attribution becomes harder when operations are outsourced or distributed.

Current systems do not reliably understand cultural context.

Synthetic audience simulations can amplify the assumptions placed into them.

Engagement metrics are poor proxies for belief or behavior.

Human strategic direction and infrastructure remain central in documented cases.

Indicator: Synchronized multilingual narrative changes across many accounts or sites. Caveat: Coordination can also reflect legitimate campaigns or shared news events.

Indicator: Repeated artifacts showing model instructions or safety refusals in published content. Caveat: This is strong evidence of automation error but not proof of a specific sponsor.

Indicator: Rapid content pivots immediately following audience reactions. Caveat: Professional communications teams also adapt quickly.

Maintain human legal and editorial approval for high-impact communications.

Use independent source verification rather than model-generated citations.

Audit audience models for cultural and sampling bias.

Separate reach, engagement, attitude, and behavior metrics.

Invest in network-level detection and transparent takedown reporting.

How much AI changes outcomes rather than production volume.

When synthetic audience simulations generalize to real populations.

How outsourced influence-for-hire markets change responsibility and attribution.

Which oversight structures prevent automation bias in state and commercial settings.

Generative systems create or substantially transform propaganda text, images, audio, video, memes, documents, or synthetic news formats for an organized objective.

Organized persuasive communication in which AI generates or substantially transforms content intended to advance a political, military, ideological, commercial, or organizational objective.

All synthetic media, satire, ordinary advertising, or accidental misinformation; propaganda requires organized purpose and context.

Generative AI sharply lowers the cost of producing plausible, localized propaganda and contributes to uncertainty about authentic evidence.

AI changes the economics of propaganda by making variation, translation, and rapid crisis response inexpensive.

The broader harm includes the liar’s dividend: authentic evidence can be dismissed as synthetic once audiences know convincing fakes are possible.

Industrial-scale text and media production.

Rapid localization across languages and communities.

Fast response during breaking-news information gaps.

High-volume variation that defeats simple duplicate matching.

Creation of synthetic “news” formats and fabricated documentary artifacts.

Confirmed real-world use: Threat reporting and investigations document AI-generated or AI-rewritten propaganda in state-aligned operations and election-related incidents.

Demonstrated persuasion: Controlled experiments cited by the report found AI-generated propaganda could be about as persuasive as human-written material in the tested settings.

Population effects uncertain: Distribution and engagement do not establish durable political or behavioral change.

Automated article and social-post generation.

Synthetic image, audio, and video production.

Localization and rhetorical reframing.

Artificial consensus through many variants.

Credibility laundering through familiar media formats.

CopyCop / DC Weekly Confirmed AI assistance A network used generative systems to rewrite and expand news-like content in support of strategic narratives. Researchers identified a transition to AI-assisted rewriting and model artifacts in published material. Output volume and topic breadth increased; experimental work found retained short-term persuasiveness. The degree of durable attitude or voting change remains unknown.

New Hampshire primary robocall Confirmed synthetic audio Voters received robocalls using a cloned presidential voice that told them not to participate in the primary. Investigations attributed the call operation and established use of voice cloning. Thousands of calls were placed and enforcement action followed. The number of voters whose behavior changed cannot be reliably isolated.

Volume can outpace verification and newsroom response.

Synthetic content can exploit crisis timing and existing prejudice.

False accusations of deepfakery can shield authentic misconduct.

Labels and detectors can create false confidence or reduce trust in accurate content.

High volume often produces little organic engagement.

AI output can contain factual and cultural errors.

Quality varies substantially by modality and human oversight.

Persuasion effects depend on source, prior belief, timing, and context.

Indicator: Large clusters of stylistically varied content repeating one narrative. Caveat: Shared themes can also arise organically after major events.

Indicator: Synthetic media without a verifiable source trail. Caveat: Missing provenance does not prove fabrication.

Indicator: News-like sites with copied layouts, weak ownership records, and coordinated distribution. Caveat: Each signal requires corroboration before attribution.

Publish authentic media through trusted, signed channels.

Use narrative-level triage instead of attempting to debunk every variant.

Preserve evidence and disclose attribution confidence.

Support provenance while acknowledging metadata stripping and false negatives.

Teach audiences that AI labels and detection scores are not verdicts.

Long-term behavioral impact of AI-generated propaganda.

How disclosure labels affect true and false content differently.

Robust provenance after reposting, compression, or screenshotting.

How generative media changes the liar’s dividend across political contexts.

AI systems tailor messages or interactions to information collected or inferred about a person, then may adapt the communication using ongoing feedback.

Organized attempts to influence a person using collected or inferred attributes, tailored communication, and adaptive feedback.

User-directed customization and transparent recommendations that support the user’s stated goal without covert vulnerability exploitation.

The most established harm is covert data asymmetry and vulnerability exploitation, not reliable “mind control” through personality targeting.

Even weak profiling can be intrusive, discriminatory, and difficult to contest when it shapes political, financial, or interpersonal treatment.

Generative systems make individualized communication inexpensive, but the claimed persuasive advantage of psychographic matching is much less certain than marketing narratives suggest.

Automates individualized message drafting.

Combines many data sources into inferred profiles.

Adapts tone and content after each response.

Tests message variants continuously.

Can target temporary distress or life events rather than stable traits.

Confirmed profiling and targeting: Commercial and political systems routinely segment and personalize based on behavioral and demographic data.

Demonstrated generic AI persuasion: LLM-generated messages can be persuasive in controlled settings.

Personalization advantage contested: The report cites meta-analytic and experimental evidence that the incremental benefit of personality-based targeting may approach zero after correcting methodological problems.

Collection of demographic, behavioral, network, and contextual data.

Inference of interests or temporary vulnerability.

Message selection or generation.

Feedback-based optimization.

Cross-platform identity and data linkage.

Cambridge Analytica Data use confirmed; persuasive effect unproven Facebook data was harvested and used for political profiling and targeting claims. Large-scale data-protection violations and covert processing were documented. Regulatory and public-trust consequences were substantial. Investigations did not establish that psychographic targeting changed the Brexit or U.S. election result.

LLM political microtargeting experiment Controlled experiment Researchers compared generic and individually tailored political messages generated by language models. AI-generated messages were persuasive in the study. Tailored messages did not show a statistically reliable advantage over generic AI messages. Longer multi-turn interaction and different populations require further study.

Covert processing undermines informed choice.

Weak inferences can produce discriminatory stereotypes.

Temporary distress can be exploited at high-stakes moments.

Personalization can fragment the public sphere and make scrutiny difficult.

Personality inference from digital traces is weaker than commonly claimed.

Emotion recognition from faces or voices lacks reliable scientific foundation.

Models may confuse correlation with causation.

Targets and auditors often cannot see the messages delivered to others.

Indicator: Messages make unusually specific reference to private or recent life events. Caveat: The detail could come from ordinary account history, a breach, or human knowledge.

Indicator: A system changes framing or pressure immediately after hesitation. Caveat: Adaptive customer support can behave similarly without manipulative intent.

Indicator: Users receive materially different political claims without a public archive. Caveat: Variation alone does not establish harmful targeting.

Data minimization and restrictions on sensitive inference.

Transparent “why am I seeing this?” explanations.

Public political-ad libraries with meaningful targeting information.

Independent audits and researcher access.

Prohibit or strictly limit emotion inference and exploitation of vulnerable groups.

Make contextual rather than behavioral advertising the default where feasible.

Multi-turn adaptive persuasion outside laboratory settings.

Effects on vulnerable subgroups rather than population averages.

Auditing personalized messages without collecting more sensitive data.

How temporary life events alter susceptibility and risk.

Goal-directed software agents observe, remember, plan, communicate, use tools, and adapt toward an influence objective with varying degrees of human supervision.

Software systems that pursue an influence-related goal through repeated communication or online action with limited ongoing direction.

Simple scheduled bots, human-authored posts distributed automatically, or ordinary customer-service systems with tightly bounded rules.

Agentic systems combine communication with memory and action, but current long-horizon reliability is much weaker than fluent short-term behavior suggests.

Agents can sustain many interactions and connect language generation to tools, accounts, and data.

The risk grows with memory, permissions, coordination, and the ability to revise strategies, but fluent messages should not be mistaken for durable autonomy.

Persistent memory and persona continuity.

Planning loops and tool invocation.

Continuous interaction at machine scale.

Coordination among specialized agents.

Feedback-based strategy revision in bounded environments.

Short-term capabilities established: Models generate persuasive text, use tools, and sustain bounded multi-turn interaction.

Sandboxed coordination demonstrated: Synthetic social networks and laboratory multi-agent systems show role division and emergent interaction.

Long-horizon autonomy speculative: Multi-month strategic coherence, infrastructure management, and reliable evasion without human intervention remain unsupported.

Observation and profile maintenance.

Working and long-term memory.

Plan–act–evaluate loops.

Bounded external tool access.

Role division among multiple agents.

Chirper.ai synthetic social network Demonstrated in a sandboxed platform Thousands of LLM-driven accounts interacted in a synthetic social network after initial configuration. Researchers observed large-scale autonomous posting and social-network patterns. The system demonstrated synthetic interaction and emergent toxic behavior. It did not prove reliable deployment or moderation evasion on real social platforms.

PRC-linked AI debate operations Confirmed AI use; low autonomy Operators used AI to generate and adapt content around U.S. technology and trade debates. Platform threat reporting documented the use of AI services. The activity demonstrated human-directed generation and research assistance. The models did not independently operate accounts or set strategy; real autonomy was low.

Tool permissions can turn persuasive interaction into real action.

Persistent memory can accumulate sensitive information or be poisoned.

Multi-agent coordination can fabricate social proof.

Long-running agents can drift, hallucinate, or become sycophantic.

Attention and reasoning degrade across long tasks.

Memory retrieval can become stale or noisy.

Models are vulnerable to prompt injection and goal drift.

Real-world campaigns still require human infrastructure and oversight.

Indicator: Persistent accounts exhibit abrupt memory or persona discontinuities. Caveat: Humans and legitimate bots can also change behavior.

Indicator: Accounts divide roles in a highly regular interaction pattern. Caveat: Formal organizations may coordinate lawfully.

Indicator: Tool actions occur at machine speed or outside plausible human schedules. Caveat: Scheduled accessibility and support tools can look similar.

Require clear AI identity disclosure.

Use least-privilege, short-lived tool permissions.

Limit execution steps and require reauthorization.

Keep immutable audit records without storing private content unnecessarily.

Provide emergency suspension and state rollback.

Evaluate agents in sandboxes rather than on unwitting populations.

Reliable measurement of long-horizon strategic coherence.

Detection of agents that deliberately vary behavior.

Governance responsibility across model provider, developer, deployer, and platform.

Safe evaluation of persuasion without exposing real users.

Fabricated identities use generated images, biographies, voices, and language to appear human, gain trust, infiltrate communities, or manufacture consensus.

Fabricated or substantially fictional identities presented as real people, experts, organizations, witnesses, activists, journalists, or community members for a deceptive objective.

Transparent avatars, ordinary pseudonyms used by real people, satire, disclosed role-play, and legitimate accessibility bots.

AI lowers the cost of maintaining convincing fictional identities while automated detection can wrongly accuse legitimate anonymous or non-native users.

People normally default to assuming social partners are genuine, and online environments provide fewer cues for checking identity.

Synthetic identity networks can borrow credibility from one another, while overbroad identity verification can endanger whistleblowers and dissidents.

Creates unique face and voice assets.

Maintains biographies and linguistic style.

Localizes personas across cultures and languages.

Generates routine background activity.

Allows many identities to interact and reinforce one another.

Confirmed identity fabrication: Investigations document AI-generated profile images, synthetic presenters, and deepfake-assisted remote impersonation.

Scaled persona generation demonstrated: Research systems can generate diverse persona populations, although realism and long-term consistency vary.

Long-term credibility uneven: Physical-world records, live interaction, and coherent history remain difficult to fabricate consistently.

Generated identity assets.

Fabricated biography and credentials.

Language and cultural mirroring.

Networked credibility and artificial consensus.

Cross-platform reuse or identity theft.

Oliver Taylor Synthetic identity confirmed; text assistance alleged A nonexistent “student journalist” published accusations through recognized outlets using a generated profile image. Investigators found the person did not exist and the image showed GAN-generation indicators. The persona obtained publication and reputational reach. Whether article text was AI-generated was not conclusively established.

DPRK remote-worker infiltration Confirmed AI-assisted identity deception Operatives used false or stolen identities, AI-generated images, and remote-interview deception to obtain employment. Public corporate and government reporting documented infiltrations and synthetic identity assets. Some operatives reached enterprise onboarding and network access. Public reporting does not reveal every tool or the full scale of successful placements.

Fabricated experts or community members can gain trust and launder claims.

Networks can manufacture popularity and agreement.

Identity assets support fraud and enterprise access.

AI detectors can discriminate against non-native and neurodivergent users.

Long-term biographical consistency remains fragile.

Live video and offline verification can expose anomalies.

Authentic humans may share the same linguistic or behavioral signals as models.