AI INFLUENCE OPERATIONS: MORE CAPACITY, UNPROVEN PERSUASION

BLUF: On October 5, 2026, Renée DiResta published two analyses: one in Lawfare, built on threat reports released by frontier AI companies and social media platforms, and one in Foreign Affairs with Josh A. Goldstein. The shared finding is a gap. There is abundant evidence that generative and agentic AI increase the capacity of influence operations: more content, more personas, more continuous operation. There is much less evidence that those operations change public opinion. For organizations, the practical conclusion is not to relax. Capacity now lets small actors run sustained, multi-channel campaigns against a brand or executive cheaply. The defensive advantage lies in detecting early and in having trusted voices already in place, since the same analysis finds that AI cannot manufacture trusted distributors.

What Is Reported

The account below follows the two articles, both published October 5. We have not independently reviewed the underlying threat reports.

Production has changed. Per the Lawfare piece, actors linked to Iran, Russia, China and others, along with commercial firms selling influence as a service, use AI to write and translate propaganda, create personas, mimic target audiences and produce content at scale.

Operations are changing too. The author describes four kinds of work: generation, operational support, workflow orchestration and the beginnings of autonomous execution. In her phrasing, generative AI scales content and agentic AI scales operations. One example cited from Anthropic's reporting involves operators sharing an AI agent whose memory files held banned words, approved sources and detection-evasion rules, so content kept flowing without a person directing each session.

Campaigns are integrated. The Foreign Affairs piece describes "full-spectrum propaganda": state media, official accounts, paid influencers, fake personas, hacked accounts and bot networks working as one system, each channel lending credibility to the others. Its opening example is the spring 2026 hijacking of Bluesky accounts to spread content about Ukraine, which Clemson University researchers attributed to the Social Design Agency, a Russian firm sanctioned by the US Treasury.

What Is Established, and What Is Not

Established, per the cited reporting: AI is widely used inside influence operations, and it raises their volume, speed and persistence. These conclusions rest on reports from AI companies and platforms, which have their own visibility limits and incentives.

Not established: that AI-generated influence changes opinions at scale. Lawfare states this directly. The two claims should not be merged. A campaign can be large and still land with nobody who matters.

Why the Persuasion Gap Matters for Organizations

Influence needs distribution as well as content. A false story about a company has effect when it reaches people who trust the messenger: a journalist, an analyst, an industry peer, an AI assistant that cites it. AI can generate the story. It cannot, per this analysis, generate the trust.

That reframes the risk. The question for a brand, fund or executive is not "can someone produce a thousand hostile posts?" They can, at low cost. The question is "which of those posts get picked up by a source that carries weight?" Exposure concentrates at the points where fringe claims cross into credible channels.

Where Exposure Concentrates

• Quotable intermediaries. Official-looking outlets quoting fake accounts make a fringe claim seem normal, as the full-spectrum model describes.
• Search and AI answers. If low-quality content fills a gap on a topic where little credible material exists, it can shape what summaries surface. This is the same dynamic behind AI answer poisoning.
• Executives and named individuals. Personas built to mimic a target audience work best against people with thin or ambiguous public records.

What to Change

Monitor for crossover, not volume. Counting hostile posts measures the attacker's output. Track whether a claim reaches a journalist, a regulator, an investor or an AI answer. That is the moment it becomes a problem.

Fill the credible record on your key topics. Where accurate, well-sourced material exists, fabricated claims have less room. Gaps invite fabrication.

Pre-establish trusted voices. Spokespeople, third-party experts and verified channels should exist before an incident. Trust cannot be built mid-campaign.

Attribute carefully. Coordinated activity is often hard to attribute. Respond to the narrative and its reach, and treat attribution as a separate, slower question.

Set escalation thresholds in advance. Decide what level of pickup triggers legal, communications or security action, so the response is not improvised.

Confidence and Caveats

High confidence that the two articles say what is summarized here, since both are directly from named publishers on the same day. Moderate confidence in the underlying trend, because it relies on platform and AI-company disclosures. Low confidence on persuasion effects, which the source itself describes as an open question. Our reading of what this means for organizations is analysis, not a finding from those articles.

Frequently Asked Questions

Does AI make influence operations more effective? It makes them cheaper, faster and more persistent. According to DiResta's October 5 analysis, there is much less evidence that it changes public opinion.

What is full-spectrum propaganda? A term from Goldstein and DiResta for campaigns that combine overt messaging, covert personas, paid influencers and hacked accounts so each channel reinforces the others.

What is the difference between generative and agentic AI in influence operations? In the Lawfare piece's framing, generative AI scales content, while agentic AI scales the operation itself, including coordination and execution.

What should a company monitor? Whether hostile claims reach credible sources such as journalists, regulators, investors and AI answers, not just how many posts exist.