TechLetters Insights. AI propaganda factories: from State actors to bedroom micro‑actors

AI will transform propaganda and information influence.

There are justified fears that AI will be used to craft propaganda and run influence operations. AI is good at generating content and highly adaptable. From the World Economic Forum to senior policymakers, these concerns are voiced often. They can lack rigour or detail, but the message is the same: this is a new capability. Based on my study, I can attest that fully automatic or autonomous AI “propaganda factories” are now possible. Such activity can be run at scale by state actors, but also by private actors, small teams, or even individuals at home.

Contrary to the popular fear that the main risk comes from large, closed, third-party systems such as ChatGPT or Claude, the real issue lies elsewhere. Server-side models are powerful, but poorly suited to sustained operations for a simple reason: they are too easy to detect, rate-limit, or shut down, wasting an attacker’s resources. This is also why we should not expect serious threat-actor activity to be neatly described in periodic cyber-threat reports. The consequential activity will be elsewhere.

The real leverage sits with local language models — small, open-weight systems anyone can download and run on their own machines or closed clusters. This shift lowers cost, removes external oversight, and makes activity harder to observe. I set out to test feasibility in clear terms and to show what this implies for defence and policy.

This post is about my new research.

What’s the impact?

Influence systems can generate dynamic content while mimicking fixed personas. Personas can be specified mechanically — for example, “far-left/far-right”, “male/female”, “sarcastic/condescending”, “teen/adult”. Hundreds of such configurations are possible, suitable for bots or artificial engagement agents on social platforms and discussion boards. A local language model is then instructed to write as that persona. Drafts are quality-checked by an automated evaluator; if they meet the bar, they are posted to engage people — often without readers realising the exchange is with synthetic content used for influence, political activity, or simply to consume human attention.

In my study I show that these personas are stable. They faithfully mimic ideological positions, including extremist voices, and can signal stances such as: Conservative; Progressive; Libertarian; Left-wing; Right-wing; Centrist; Liberal; Moderate; Socialist; Marxist; Environmentalism; Animal Rights Advocate; Technocratic; Populist; Nationalism; Feminist; Authoritarian; Anti-authoritarian; Religious conservatism; Secular Liberalism; Anarchist. And many more.

Crucially, it is not the brand of model that governs behaviour or performance. It is the persona design and surrounding rules. When the same persona participates in a back-and-forth thread, it tends to express its chosen ideology more tightly and more explicitly than in a first-turn reply.

The architecture of fully autonomous AI propaganda systems

Think of a continuum. At one end sits the manual set-up where a human operator writes and posts, perhaps using AI to draft or translate, but a person still decides what to say and when. Output varies by individual, scale is limited, and attribution is easier. In the middle is the semi-automatic mode: a human designs how the content is to be crafted, generate it using the AI model, and a human still remains in the loop to select and schedule. A simple controller can score drafts with a local evaluator and queue the best, lifting throughput and smoothing tone.

Here is where it gets interesting, and—in line with the research described here— is already possible in 2025.

At the far end is the fully automatic system. Here the machinery generates content, evaluates it, selects or rewrites it, schedules publication, maintains threaded replies. All without a human in the loop. A human sets the policy design, rules, objectives, and that’s it. The moving parts are straightforward: a local generator (one or more small models), an evaluator to score the content, a controller that approves the content and orchestrates the posting of it, short-term memory/logs to preserve context and avoid repeats, a scheduler/posting interface (perhaps a browser-embedded agent), and an optimiser to measure what content works, and what may be improved. All fully automatically. The human operator can go to sleep, or get a tea and a cheesecake. The technical building blocks now exist - an adversary with adequate resources could deploy operational systems fast.

This design may run today on ordinary commodity hardware, like the one I used in my study, with open models in use; no cloud or API subscriptions are required. Invincibly, or very hard, to outside auditors. It can be easily scaled to be adapted to professional cyber threat actors for offensive uses.

My study informs the defence.

Implications for defence and policy

We need to stop treating posts, or even networks of accounts, as isolated artefacts and read them as conversational-interactions. In practice that means following threads and timelines. The useful signals live at this level: how a stance changes (or refuses to) within a single exchange; whether a persona drifts as topics shift; how quickly an account replies and whether its cadence is oddly regular; and whether distinctive turns of phrase recur weeks apart. Once the back-and-forth begins, constraints tighten and the system’s “voice” may become more uniform, revealing the artificiality.

Coordination is the next tell. Orchestrated systems leave timing and routing fingerprints. You see bursts of near-simultaneous replies across multiple accounts, posting windows that line up a little too neatly, and templates that reappear with only light paraphrase.

For attribution, follow the plumbing. Models can be swapped in an afternoon; the orchestrator and infrastructure are stickier. It’s the infrastructure like the IP addresses of servers, and similar indicators that matters and that may ultimately help disrupt an operation, scheduler behaviour, reuse of network proxies, the traces of browser automation or similar. These are the features that connect activity over time and across accounts.

Research and practice need common yardsticks. We should share auditable evaluators and metrics so that results can be compared honestly. Platforms, for their part, should retain conversation-level telemetry, within privacy law, to allow independent auditing of behaviour over time.

Refrain from the over-focus on model AI safety. The genie is out of the bottle, and frontier, third-party, closed models are unlikely to be used operationally in such activities. Policy should be pragmatic. Once model weights are public, bans on general-purpose tools are performative at best. The emphasis should be on transparency, auditing, intelligence, and on disrupting the coordination layer where campaigns actually scale.

Summary

Capabilities will continue to move towards the edge. Open models are the future of AI propaganda. They are powerful, capable, readily available, their use may be totally opaque. On defence, priorities are robust analytics, and measurements like challenge–response probes that reveal automation. Next-generation influence campaigns are going to be challenging to defuse. When such an activity—conversational persona bots— are released to users by market actors, regulations like the EU AI Act would require clearly marking that such a bot persona account is not real. This is not the case for determined threat actors who would not be labelling their artificial creations.

Welcome to the era of AI propaganda. It’s fair to expect that many State actors are already experimenting or developing such capabilities. Expect this to bring fruits as early as in 2026.