AI PsyOps: Artificial Intelligence and the Transformation of Psychological Warfare

Full report

On this page

Executive assessment

Assessment date: October 2026 Scope: State, military, intelligence, political, commercial, and non-state influence activity using or plausibly capable of using artificial intelligence. Analytic standard: Publicly available evidence only. “AI PsyOps” is used here as an analytical umbrella, not as a universally accepted doctrinal term.

Bottom-line assessment

Artificial intelligence is already operational in influence operations, but the strongest public evidence shows something more incremental—and in some ways more consequential—than the popular image of autonomous “mind-control” systems. Russia-, China-, Iran-, and commercially linked networks have demonstrably used generative AI for text production, translation, synthetic personas, profile imagery, audio, video, memes, research, and scaling of social-media operations. U.S. law-enforcement agencies disrupted a Russian-sponsored generative-AI-enhanced bot farm in 2024; the U.S. Justice Department documented AI-assisted components in the Russian “Doppelganger” influence infrastructure; Microsoft, OpenAI, Graphika, Meta, and U.S. intelligence reporting have independently observed state-linked actors incorporating generative AI into influence workflows.

What is not publicly demonstrated is equally important. There is no strong open-source evidence, as of October 2026, of a state operating a fully autonomous, end-to-end system that continuously profiles populations, selects psychological vulnerabilities, conducts millions of individualized persuasive conversations, experimentally optimizes them in real time, and demonstrably changes strategic behavior at scale without substantial human direction. OpenAI's threat reporting has repeatedly characterized malicious actors as adding AI to existing playbooks rather than obtaining qualitatively new offensive powers; its first major 2024 report found that the five influence operations it disrupted had not achieved significant breakout into authentic audiences. Microsoft likewise reported in 2024 that it had seen little evidence that the AI-generated influence content it tracked was actually swaying audiences.

The crucial distinction is therefore between capability, deployment, reach, persuasion, behavior, and strategic effect. AI has clearly improved the first two and often the third. Controlled experiments increasingly show that modern language models can persuade people under some conditions, particularly in interactive or personalized settings. Yet laboratory persuasion does not establish real-world electoral conversion, political mobilization, military demoralization, or durable strategic change. Indeed, the broader political-science literature has historically found many campaign persuasion effects to be small or fleeting, including a meta-analysis of field experiments that estimated essentially zero average persuasive effect on candidate choice in U.S. general elections.

The most plausible transformation is therefore from broadcast propaganda toward industrialized influence production: faster sensing of discourse, lower-cost multilingual content generation, greater persona persistence, synthetic audio/video, machine-assisted audience segmentation, and potentially interactive one-to-one persuasion. The major unresolved question is whether these components will become tightly integrated into closed feedback loops capable of optimizing for psychological or behavioral outcomes rather than merely engagement.

Evidence-rating scheme

A useful intelligence rule throughout this subject is:

Authenticating a synthetic artifact is not the same as proving coordination; proving coordination is not the same as attributing an actor; attributing an actor is not the same as proving sponsor intent; proving intent is not the same as demonstrating effect.

Key findings

Foundations, evolution, and historical timeline

What the terminology actually means

The vocabulary surrounding influence is notoriously imprecise. Treating every false statement, unpopular opinion, recommendation algorithm, covert advertisement, troll, or viral meme as a “PsyOp” makes the concept analytically useless.

Psychological operations, or PSYOP, are best understood here as planned activities intended to influence the perceptions, attitudes, emotions, reasoning, decisions, or behavior of a selected audience in support of an actor's objectives. Historically, this has included leaflets, broadcasts, rumor, front organizations, forged documents, demonstrations, and targeted communications. The defining feature is not falsity: a psychological operation may use truthful, selectively framed, misleading, or fabricated information.

Information operations are broader. Modern military usage increasingly treats the information environment as a domain in which actors combine communications, cyber activity, deception, electronic capabilities, operational actions, and other means to influence perceptions and decision-making. RAND notes that the U.S. Department of Defense has increasingly used “operations in the information environment” to describe coordinated actions aimed at perceptions, attitudes, and decisions.

Cognitive warfare is a newer and less standardized umbrella term focusing specifically on cognition: how people attend to, interpret, remember, emotionally process, and act on information. It is useful as an analytical concept but should not be treated as if there were one universally accepted NATO, legal, or scientific definition. Russian strategic literature similarly uses a broader concept of “information confrontation,” which RAND characterizes as a continuous strategic contest extending into peacetime rather than a discrete wartime propaganda function.

Perception management refers to efforts to shape the way an audience interprets reality through framing, selective disclosure, signaling, concealment, repetition, deception, or orchestration of events. It overlaps with public diplomacy, strategic communications, deception, propaganda, and PSYOP; the term is therefore useful descriptively but weak as a precise attribution category.

Computational propaganda is narrower and especially relevant to the digital transition. Oxford Internet Institute research uses the term for the combination of social-media platforms, automated accounts, algorithms, and data-driven techniques employed to manipulate public opinion. Its global surveys documented organized social-media manipulation well before generative AI became widely available.

Finally, misinformation and disinformation are not interchangeable. The European Commission defines disinformation as false or misleading information spread intentionally to deceive or obtain political or economic gain, while misinformation can be false or misleading without deceptive intent.

“AI PsyOps,” as used in this report, therefore means influence operations in which machine-learning systems materially contribute to audience analysis, message generation, synthetic identity, distribution, optimization, interaction, or measurement. That definition does not presume that the operation is foreign, military, false, effective, or even illegal.

From active measures to algorithmic influence

Soviet “active measures” illustrate that many supposedly novel features of contemporary information warfare have old precedents. CIA historian Thomas Boghardt's study of the AIDS disinformation campaign describes a Soviet ecosystem involving intelligence services, media outlets, allied services, front mechanisms, and deliberate attempts to anchor falsehoods in seemingly independent sources. Soviet specialists explicitly considered target-audience fears, concerns, and expectations when designing disinformation.

What changed with the internet was not the basic psychology but the cost structure and feedback speed. Print and broadcasting largely delivered one-to-many communications. Social media introduced inexpensive pseudonymous personas, direct audience interaction, granular advertising, network amplification, instant engagement statistics, and algorithmic distribution.

The Russian Internet Research Agency's 2016 U.S. operation is an important transitional case because it was not an AI-generated campaign, but it demonstrated the operational template that AI now makes cheaper: masquerading as members of the target society, exploiting authentic political divisions, organizing around identity groups, maintaining numerous personas, creating tailored content, and measuring audience response. The bipartisan Senate Intelligence Committee concluded that IRA operators exploited divisive issues such as race and immigration and sought to provoke anger, outrage, distrust, and conflict among Americans.

The important historical continuity is therefore:

human psychological targeting → digital audience data → algorithmic distribution → automation → generative content → potentially adaptive conversation.

Cambridge Analytica belongs in this chronology but requires skepticism. The UK's Information Commissioner's Office established serious privacy, transparency, targeting, and data-governance problems in the political-data ecosystem and sanctioned Facebook under the law then applicable. That does not validate every public claim made about Cambridge Analytica's supposed ability to “psychographically control” electorates. Its significance is that political actors had already begun merging personal data, behavioral segmentation, and individualized communications before modern generative AI.

Historical timeline

This history argues against a technological-determinist narrative. AI did not invent psychological targeting, covert personas, narrative laundering, segmentation, or automated accounts. It compresses the labor and time required to perform them, while opening a genuinely new frontier in interactive personalization.

Technology, psychology, and the emerging influence ecosystem

The technology and threat landscape

The relevant technologies are best assessed according to what they actually change operationally.

Why conversational systems matter

The deepest technological discontinuity may not be fake video. Traditional propaganda has a bandwidth problem: one message must fit many people. Microtargeting improved segmentation but remained largely one-way.

A capable conversational model can instead discover objections during interaction and adapt immediately. In a 2025 Nature Human Behaviour experiment, GPT-4 showed substantial conversational persuasive ability, particularly when supplied with basic personal information about its interlocutor. The paper later received a 2026 author correction concerning a calculation, so the original headline numerical effect should not be repeated uncritically; the broader finding that personalized AI can be competitively persuasive remains important.

A separate 2025 Nature Communications study involving thousands of participants found that LLM-generated persuasive messages could measurably shift policy attitudes and performed on the order of human-written messages in the studied setting.

Matz and colleagues likewise found evidence that generative-AI messages tailored to psychological characteristics could improve persuasive performance in controlled settings. These studies establish capability, not evidence that intelligence services are already conducting millions of successful individualized political conversations.

An important counterexample prevents an overly sinister interpretation of persuasion technology. A 2024 Science study found that tailored dialogues with a large language model could durably reduce conspiracy beliefs. In other words, adaptive persuasion is morally and politically direction-neutral: the same basic capability could be used for manipulation, deradicalization, education, advertising, health communications or corrective information.

Psychological mechanisms

Repetition and familiarity. Repeated claims become easier to process and can consequently feel more truthful—the “illusory truth” effect. Experimental psychology has reproduced this effect even when people possess relevant knowledge, making cheap AI-generated paraphrases potentially useful to propagandists. The inference that AI necessarily amplifies the effect in real information environments is plausible but not directly established by these repetition experiments.

Emotion and threat. Fear, outrage, disgust and anxiety can capture attention, narrow deliberation and increase the salience of threat-related information. AI does not invent emotional propaganda, but automated generation and testing could increase the number and speed of emotionally framed variants. Evidence that negative online content is often disproportionately shared supports the importance of emotional valence, though sharing is not equivalent to believing or acting.

Fear, uncertainty and doubt. FUD often works without persuading a target that a specific claim is true. Creating uncertainty about whether anything is knowable can be strategically useful. This is especially relevant to synthetic media because the proliferation of fakes can produce a “liar's dividend”: authentic evidence can be dismissed as fabricated. Experimental political-science research published in 2025 found circumstances in which politicians benefited from claiming damaging reports were misinformation, although the effect varied with the evidence presented.

Social proof and consensus. People commonly use the apparent beliefs and behavior of others as informational cues. Botnets and synthetic personas can therefore attempt to manufacture the appearance of popularity. The operational fact that campaigns create large numbers of fictitious accounts is well documented; the magnitude of resulting attitude change is not.

Identity and motivated reasoning. The IRA's targeting of racial, ideological and social identities illustrates a recurring principle: effective influence operations frequently exploit conflicts already present in the target society rather than inventing them from nothing. The Senate investigation found sustained emphasis on divisive identity issues and efforts to intensify distrust.

Information overload and attention manipulation. An operation need not win an argument if it can occupy attention, force institutions into endless rebuttal, increase uncertainty or make the information environment costly to navigate. Generative AI particularly changes the attacker's economics here because producing thousands of plausible variants is inexpensive relative to human verification.

Algorithmic feedback. Ranking systems can create a feedback loop in which engagement affects visibility, visibility affects engagement, and highly activating content receives disproportionate exposure. The strongest caution against simplistic claims is that algorithmic effects are empirically heterogeneous. Nonetheless, a randomized 2026 study of X found that switching users onto the algorithmic feed increased engagement and shifted some political opinions toward more conservative positions, while not significantly changing every measured outcome such as affective polarization or partisan identification.

Trust erosion. Influence may target epistemic infrastructure rather than policy preference: trust in elections, journalism, public health, military leadership, courts, or even audiovisual evidence itself. Russia's documented operations have repeatedly pursued institutional distrust as an objective; however, demonstrating that a particular campaign caused aggregate trust decline requires much stronger causal evidence than documenting the campaign.

Experimental persuasion versus field effectiveness

This is the report's most important methodological distinction.

A persuasive message can succeed at several increasingly difficult levels:

production → exposure → engagement → belief change → attitude change → behavior → strategic outcome

Public evidence is strongest at the left and rapidly becomes weaker toward the right.

Controlled LLM experiments demonstrate belief or attitude movement. Yet Kalla and Broockman's meta-analysis of 40 field experiments on U.S. general-election campaigning estimated an average persuasive effect on candidate choice near zero, illustrating how difficult it can be for communication effects to survive the noisy, competitive real world.

Accordingly, claims such as “an AI deepfake went viral before an election” cannot legitimately be converted into “AI changed the election.” Exposure and causal outcome are different propositions.

Conceptual map of the emerging ecosystem

A non-operational threat model looks like this:

               PUBLIC / PRIVATE INFORMATION ENVIRONMENT
                              │
                              ▼
                    ┌─────────────────┐
                    │  SENSE / LISTEN │
                    │ discourse,      │
                    │ narratives,     │
                    │ sentiment       │
                    └────────┬────────┘
                             │
                             ▼
                    ┌─────────────────┐
                    │  AUDIENCE MODEL │
                    │ segments,       │
                    │ interests,      │
                    │ response trends │
                    └────────┬────────┘
                             │
                             ▼
                    ┌─────────────────┐
                    │ SYNTHETIC MEDIA │
                    │ text / image /  │
                    │ voice / video / │
                    │ conversation    │
                    └────────┬────────┘
                             │
                             ▼
                    ┌─────────────────┐
                    │ DISTRIBUTION    │
                    │ authentic and   │
                    │ synthetic       │
                    │ accounts/channels│
                    └────────┬────────┘
                             │
                             ▼
                    ┌─────────────────┐
                    │ PLATFORM /      │
                    │ SOCIAL DYNAMICS │
                    │ ranking, shares,│
                    │ replies, media  │
                    └────────┬────────┘
                             │
                             ▼
                    ┌─────────────────┐
                    │ OBSERVED        │
                    │ RESPONSE        │
                    │ exposure,       │
                    │ engagement,     │
                    │ surveys/signals │
                    └────────┬────────┘
                             │
                 feedback ───┘
                             ▼
                    ┌─────────────────┐
                    │ ADAPTATION      │
                    │ message/model   │
                    │ changes         │
                    └─────────────────┘

Every individual box is technologically feasible today. Several are operationally documented. What remains unproven publicly is the mature closed loop: persistent autonomous systems accurately inferring psychological response, optimizing messages against behavioral objectives, operating at large population scale, and doing so with measured strategic effectiveness.

That distinction separates a defensible threat model from science fiction.

Documented operations and evidence ratings

Russian Internet Research Agency: the pre-generative template

Actor and objective. The Russian IRA operated a broad social-media campaign around the 2016 U.S. election and beyond. The bipartisan Senate Intelligence Committee concluded that it impersonated Americans, exploited social divisions and attempted to undermine confidence in U.S. institutions while also supporting Russian political objectives.

Technology. Human-run personas, automation, targeted advertising, platform analytics and coordinated social-media activity—not modern generative AI.

Why it matters for AI PsyOps. It established the expensive human workflow AI can now partially automate: build personas, identify divisive topics, maintain different voices, generate large amounts of culturally targeted material and engage authentic users. The Senate report found deliberate exploitation of hot-button social issues and especially extensive targeting around race.

Observable outcome. Extensive exposure and authentic interaction were documented. A causal estimate of how many votes, if any, were changed is not available from the public evidence. The existence of the operation should therefore not be confused with proof that it determined the election.

Rating: Confirmed operation; Limited Evidence of decisive behavioral effect.

Spamouflage and Chinese state-linked influence

Spamouflage has evolved over years from a high-volume but often low-impact coordinated network into an early adopter of generative content. Graphika's 2019 analysis characterized the network as prolific but generally low-impact.

In February 2023, Graphika documented apparently AI-generated video presenters in pro-China Spamouflage content, representing one of the earliest publicly analyzed uses of synthetic video personas by an established state-linked influence network.

Microsoft subsequently reported that during Taiwan's January 2024 election a China-linked actor used AI-generated material, including a suspected synthetic recording involving presidential candidate Terry Gou and AI-generated news-style presenters and memes. Microsoft described this as the first time it had observed a nation-state actor using AI-generated content in an attempt to influence a foreign election, but emphasized that the material generated little convincing evidence of audience sway.

U.S. intelligence reporting in 2025 stated that pro-China online actors in 2024 had used AI-generated news anchors and fake social accounts with generated profile pictures to exploit contentious U.S. issues including immigration, abortion and drug policy.

Graphika continued to report AI-generated cartoons, articles, impersonation and manipulated event materials connected to the broader Spamouflage ecosystem in 2026, indicating persistence rather than a one-off experiment.

Rating: Strong Evidence of state-linked AI influence activity; Limited Evidence of meaningful behavioral effectiveness.

Russia's generative-AI-enhanced bot farm

In July 2024, the U.S. Justice Department and FBI announced the disruption of what they described as a Russian government-sponsored, generative-AI-enhanced social-media bot farm. The government stated that operators used AI to develop fictitious social profiles and scale their dissemination of narratives.

This case is strategically important because it demonstrates that AI can address a traditional bot-farm bottleneck: content and persona labor. Older bot networks often relied on repetitive templates, awkward language or centralized human operators. Generative systems can create more varied profile biographies and posts at lower marginal cost.

What the case does not establish publicly is that the bots became indistinguishable from long-lived humans or that their output measurably changed attitudes.

Rating: Confirmed AI-enhanced operation and disruption; behavioral effect unknown.

Russian Doppelganger operations

In September 2024, U.S. authorities seized domains associated with the Russian “Doppelganger” infrastructure. DOJ alleged that Social Design Agency, Structura and related actors operated at the direction of elements of the Russian Presidential Administration and pursued objectives including reducing international support for Ukraine, promoting pro-Russian policies and influencing U.S. audiences.

The documented playbook included cybersquatted websites mimicking legitimate news organizations, fake personas, fabricated influencer material, demographic targeting and AI-assisted narrative generation. This is closer to a hybrid influence production system than a stand-alone deepfake campaign: artificial content is embedded inside an infrastructure designed to borrow institutional credibility.

Legal precision matters. A Justice Department complaint or affidavit provides substantial evidentiary weight and can support infrastructure disruption; allegations concerning particular individuals or command relationships should not automatically be described as final judicial findings.

Rating: Strong Evidence.

OpenAI's cross-state disruption cases

OpenAI's May 2024 report is unusually useful because it compared several adversarial campaigns using the same model ecosystem. It reported disrupting five covert influence operations associated with actors from Russia, China, Iran and Israel. Operators used its models for tasks including comments, longer articles, translations, account names and biographies, research and code support.

The critical result was negative: OpenAI found no evidence that access to its models substantially increased the operations' audience reach. None achieved high breakout scores into authentic communities. That makes the report one of the strongest public pieces of evidence against claims that generative AI had already revolutionized information warfare in 2024.

By October 2025, OpenAI said it had disrupted and publicly reported dozens of malicious networks and described a recurring pattern in which actors appended AI to existing techniques primarily to improve speed and productivity rather than acquire unprecedented offensive effects.

These are vendor self-reports and therefore should not be treated as comprehensive visibility into the threat environment. They are nonetheless high-value telemetry from inside the model-provider layer.

Rating: Confirmed platform-observed use; Strong Evidence that early detected campaigns remained operationally conventional.

STOIC and commercial influence

Not all AI-enabled deceptive influence comes from states. In 2024 Meta attributed a covert network to the Tel Aviv-based political-marketing firm STOIC. Accounts posed as Americans and Canadians, including members of particular racial or religious constituencies, and posted comments concerning Israel and the Gaza war. Meta assessed some material as likely generated with generative AI. Reporting based on Meta's investigation described hundreds of Facebook accounts and dozens of Instagram accounts but relatively modest follower counts and engagement.

OpenAI separately reported disrupting an operation it called “Zero Zeno,” associated with STOIC, which used its models in the production workflow.

The case demonstrates the commercialization of influence capabilities: an actor does not need an intelligence service's technical staff if content generation, account management, analytics and political consulting can be purchased as services.

It does not justify labeling all advertising, public relations or political consulting “PsyOps.” The important boundary is covert or deceptive representation, fabricated constituency identity, manipulated provenance, and coordinated inauthentic behavior.

Rating: Strong Evidence.

Slovakia's 2023 election deepfake

Two days before Slovakia's September 2023 parliamentary election, a synthetic audio clip circulated purporting to capture Progressive Slovakia leader Michal Šimečka discussing election manipulation with a journalist. The artifact was assessed as manipulated, and its timing during the campaign's final period complicated rapid rebuttal. UNESCO uses the incident as a media-literacy case study; the EEAS subsequently cited the episode in its foreign-information-manipulation reporting.

The sensational interpretation—that this was “the first election won by a deepfake”—is unsupported. A detailed analysis published by the Harvard Kennedy School's Misinformation Review cautioned that Slovakia's political environment already featured polarization, low trust and pro-Russian narratives and argued that attributing the outcome to the deepfake oversimplifies the evidence.

The OSCE election assessment found a competitive, pluralistic election with high polarization and high turnout; it did not establish the deepfake as causally decisive.

Rating: Confirmed deepfake; creator attribution unclear; claim of decisive electoral effect Disputed.

New Hampshire Biden voice-clone robocall

Immediately before the January 2024 New Hampshire presidential primary, voters received robocalls containing an AI-generated imitation of then-President Joe Biden urging them not to vote in the primary. The FCC subsequently proposed a multi-million-dollar penalty in connection with the illegal calls, and New Hampshire's attorney general brought voter-suppression and impersonation charges against political consultant Steven Kramer.

The FCC separately ruled in February 2024 that AI-generated voices fall within the Telephone Consumer Protection Act's provisions governing artificial or prerecorded voices, closing an ambiguity that the incident had highlighted.

This is a particularly strong case because intent, synthetic modality and target behavior align clearly: the message sought a concrete action—nonparticipation in an election.

There is still no basis for claiming the call changed the primary result.

Rating: Confirmed deceptive AI-enabled political influence attempt; aggregate effect unknown.

Evidence matrix

The case record therefore supports a fairly precise conclusion: AI PsyOps exists, but “AI-generated influence” and “AI-effective influence” remain different categories.

Detection, attribution, defense, and governance

Coordinated-behavior analysis

The strongest defense against current influence operations is often not asking whether an individual post was AI-generated. It is asking whether a network behaves like a coordinated operation.

Investigators examine temporal synchronization, repeated URLs, shared infrastructure, account-creation patterns, identical or statistically related assets, synchronized hashtag use, recurring narrative templates, interaction topology and cross-platform reuse. Graphika's Spamouflage investigations and government actions against Russian networks illustrate how behavioral and infrastructure evidence can reveal campaigns even when the individual content appears ordinary.

Reliability: relatively strong when many independent behavioral indicators converge.

Limitations: sophisticated operators can decentralize activity, use real humans, hijack authentic accounts, or intentionally vary behavior. Conversely, genuine activist or fan communities can display intense coordination. Coordination is therefore not itself proof of foreign sponsorship.

Synthetic-content detection

Deepfake detectors attempt to identify statistical artifacts associated with generated speech, faces, video or image pipelines. Their weakness is generalization: a detector trained on one generator or compression environment may degrade on unseen models or real-world media transformations. Research on audio deepfake detection has explicitly found poor robustness and explainability in realistic settings.

The operational lesson is that a detector score should be treated as forensic evidence, not an oracle. Strong investigations combine model-based detection with metadata, source provenance, original recordings, speaker verification, contextual inconsistencies and chain-of-custody analysis.

Provenance and authentication

Provenance reverses the detection question. Instead of asking “Can we prove this file is fake?” it asks “Can we cryptographically establish where this file came from and what transformations occurred?”

This is generally a better long-term architecture for trusted journalism, government communications and official imagery because detection will remain an adversarial race. But provenance has an important logical limitation:

Authenticity does not equal truth.

A cryptographically authenticated photograph can be presented with a false caption; an authentic politician can lie; a synthetic artifact can be legitimate satire; and genuine content lacking credentials must not automatically be treated as false.

A 2026 cross-platform audit found that AI labeling and provenance handling had improved but remained incomplete, including inconsistent labeling of content researchers classified as deepfakes and uneven preservation of provenance signals. Because this study was a recent preprint rather than long-established consensus, its quantitative findings should be treated as provisional.

The EU AI Act now reinforces this direction legally: as of August 2026, providers and deployers face transparency obligations around identifiable AI-generated content and certain deepfakes and public-interest synthetic texts.

Bot and synthetic-persona detection

Bot detection works best at the network level. Single-account classifiers become brittle as language models make posting schedules and writing style more human-like. The FBI's 2024 Russian bot-farm disruption demonstrates the opposite side of this equation: operators used generative AI to improve fictitious personas, but infrastructure and operational evidence still allowed the network to be identified and disrupted.

The strategic implication is favorable for defenders: content quality may improve faster than operational-security discipline. A convincing post does not erase hosting records, registration artifacts, payment trails, account-recovery links, operator mistakes or correlated behavior.

Narrative propagation analysis

Narrative analysis tracks how a claim migrates from obscure channels to influencers, news outlets, political figures and mainstream discourse. This is essential because reach can be produced through “narrative laundering”: an operation seeds material, an authentic community adopts it, and later amplification no longer looks foreign.

The attribution problem becomes particularly difficult after such crossover. At that stage, repeating a foreign-origin narrative does not prove that an authentic user is an agent or even aware of the origin. The 2016 IRA record is a warning against collapsing shared opinion into operational coordination.

Platform telemetry and transparency

Platforms possess signals unavailable to outside researchers: login patterns, device fingerprints, model-use histories, payment relationships, deleted material and full interaction graphs. OpenAI's threat reports demonstrate how provider-side logs can reveal malicious workflows that would be nearly impossible to reconstruct from public posts alone.

The limitation is governance. Researchers and governments cannot simply take platform assertions on faith. Platforms have commercial incentives, different definitions of “coordinated inauthentic behavior,” unequal geographic coverage and changing transparency policies. Independent researcher access and auditable enforcement data are therefore strategically valuable.

The European Union's Digital Services Act addresses part of this problem by requiring very large platforms and search engines to assess and mitigate systemic risks affecting civic discourse and elections while taking freedom of expression into account. The Commission published election-risk guidelines in 2024 and continued updating its election-integrity framework through 2026.

Cognitive resilience and media literacy

Media literacy is necessary but should not be romanticized. Telling citizens to “look closely for weird fingers” is not a sustainable defense against rapidly improving generative models.

More durable resilience consists of source verification, knowledge of authoritative channels, lateral reading, understanding that virality is not evidence, delaying reaction to emotionally activating claims and institutional capability to authenticate official communications quickly. UNESCO's Slovakia case illustrates both the importance and difficulty of validating synthetic audio during compressed election timelines.

A major unintended consequence must also be managed: aggressive warnings about deepfakes can make people disbelieve authentic evidence. The “liar's dividend” literature shows why resilience should emphasize positive authentication, not generalized cynicism.

AI provider abuse prevention

Model providers can restrict specific abusive workflows, identify coordinated malicious accounts, monitor infrastructure and share threat indicators. OpenAI's disruptions show that this can impose real costs on influence actors.

Provider enforcement is not sufficient by itself. Open models, locally hosted systems, model substitution and ordinary non-AI tooling prevent any single company from controlling the ecosystem. Excessive monitoring also raises legitimate privacy and political-expression concerns.

Comparative defense assessment

The most robust strategy is therefore defense in depth. No synthetic detector, label, watermark, intelligence service, platform or media-literacy program can solve the problem alone.

Strategic, societal, and geopolitical risk

Democracy and national security

AI lowers the minimum resources required to conduct persistent influence. A small organization can now produce multilingual material and synthetic media at a scale that once required a large editorial or troll operation. Microsoft reports that Russia, Iran, China and other states are increasingly incorporating AI-generated or AI-enhanced material into influence activity; its 2025 reporting showed substantial growth in assessed nation-state synthetic content.

That does not mean weak actors become strategically equivalent to states. Distribution, authenticity, cultural knowledge, operational security, credible intermediaries and access to target communities still matter.

The national-security problem is thus less “AI can generate propaganda” than AI may shrink the staffing and language constraints that previously limited persistent operations across many populations simultaneously.

Freedom of expression versus information security

A democratic state cannot defend against foreign manipulation by treating controversial opinion as hostile information activity. Doing so risks converting information security into censorship or political surveillance.

The proper defensive target is therefore behavior and provenance—covert foreign direction, impersonation, fraud, account networks, undisclosed sponsorship, hacked material, manipulation of infrastructure—not mere ideological similarity.

The EU's DSA framework explicitly combines systemic-risk mitigation obligations with freedom-of-expression safeguards, reflecting this tension.

Privacy and behavioral surveillance

Adaptive persuasion becomes more powerful when paired with behavioral data. Political-data investigations before the generative-AI era already showed how browsing behavior, consumer information, social relationships and inferred interests could be brought into campaigning ecosystems. The ICO found serious transparency and data-governance shortcomings in this domain.

The escalation pathway is straightforward conceptually: AI makes it cheap to convert data about an individual into customized communication. The key governance issue is therefore not merely model safety but data access.

A system with mediocre generative capability but intimate behavioral data may be more dangerous than a frontier model operating blindly.

Public trust and the epistemic-security problem

Synthetic media creates two symmetrical risks:

1. false evidence can be believed, and
2. real evidence can be dismissed as synthetic.

The second is strategically underappreciated. Once the public expects deepfakes, authentic recordings of corruption, atrocities or military actions can be challenged without producing a genuine alternative explanation. Experimental work on the liar's dividend confirms that misinformation claims can provide political actors with defensive advantages in some contexts.

An information environment saturated with plausible synthetic material may therefore damage society even when individual fakes fail to persuade.

Military and intelligence implications

Military psychological operations traditionally face constraints of language, cultural expertise, content-production capacity, dissemination channels and assessment. Generative AI can reduce the first three, while social listening and analytics can accelerate assessment.

The more consequential possibility is integration with intelligence collection: a system that combines population-level sentiment monitoring, current battlefield events, audience segmentation and rapid content generation could significantly shorten the observe–decide–communicate cycle.

There is strong evidence that states are experimenting with components of this model, but weak public evidence that an autonomous cognitive-warfare “command system” is already operating at scale. U.S. intelligence continues to describe Russian disinformation and influence as part of its gray-zone toolkit, while previous assessments have highlighted Chinese and Russian interest in AI-enhanced influence capabilities.

Escalation and crisis instability

Synthetic communications become especially dangerous during crises because decision time collapses.

A highly convincing fake order, leader statement, battlefield surrender message, atrocity image or emergency alert may need to remain credible only for minutes to matter. The risk is not necessarily durable belief; it may be temporary confusion at the moment a decision must be made.

This creates a strategic asymmetry: debunking a falsehood eventually may be irrelevant if the intended decision window has already closed.

For this reason, militaries, governments, newsrooms and financial institutions increasingly need authenticated communications channels in addition to content detection.

Corporate and commercial influence

Corporate AI influence deserves separate treatment from national-security PsyOps.

Ordinary recommendation, personalization, advertising and customer-service systems deliberately affect behavior. Calling all of them psychological warfare would be analytically irresponsible.

The concern becomes more acute when firms or contractors use:

• undisclosed synthetic constituencies,
• fake grassroots campaigns,
• fabricated consumer or political personas,
• covert reputation attacks,
• deceptive synthetic endorsements,
• mass generated comments presented as independent public opinion.

The STOIC case demonstrates that covert influence services can be supplied commercially rather than directly by states.

Governance as of late 2026

The regulatory environment is fragmented rather than unified.

The EU AI Act, which became generally applicable in August 2026 subject to phased exceptions, imposes transparency obligations for certain AI interactions and generated/manipulated material, including deepfakes and some public-interest content.

The Digital Services Act requires major platforms to identify and mitigate systemic risks affecting electoral processes and civic discourse; the European Commission has issued specific election guidance and continued updating implementation.

The EU also integrated the strengthened Code of Practice on Disinformation into the DSA framework as a Code of Conduct in 2025.

In the United States, the FCC's 2024 ruling that AI-generated voices are covered by restrictions on artificial/prerecorded robocalls provides a targeted example of applying preexisting law to synthetic media.

At the international level, the UN Global Digital Compact provides a broader framework for digital cooperation and AI governance but is not the equivalent of a binding global prohibition on AI-enabled influence.

The resulting inference is that AI PsyOps currently sits across multiple legal regimes—privacy, election law, telecommunications, fraud, platform regulation, foreign-agent rules, national security and AI transparency—rather than inside one coherent international regime.

Future scenarios and early warning indicators

Forecasting 2027–2035 requires resisting a common error: extrapolating model capability directly into social effectiveness. Influence is a sociotechnical process. Better models matter only when connected to data, distribution, credibility, operational discipline and feedback.

Scenario A — Defensive adaptation

Plausibility: Moderate.

In this scenario, synthetic media becomes ubiquitous but less strategically disruptive because authentication and institutional response improve almost as quickly as generation.

Major newsrooms, governments, political parties and critical institutions adopt cryptographic provenance and authenticated publication channels. Platforms improve cross-platform coordination detection. Election authorities establish rapid verification mechanisms. AI-generated-content transparency rules mature, and users become accustomed to checking provenance for high-stakes material.

EU regulation already points toward this trajectory through AI-content transparency duties and DSA systemic-risk requirements.

Prerequisites. Broad authentication adoption; interoperable provenance; meaningful researcher access to platform data; rapid official communications; sustained public education; cooperation between AI providers, telecoms, platforms and election authorities.

Early warning indicators that this scenario is emerging. High-stakes institutions routinely sign authentic media; platforms preserve credentials through upload and transcoding; provenance checks become built into browsers and messaging systems; deepfake incidents are rapidly resolved without major uncertainty; independent audits show improved labeling coverage.

Likely impact. The value of generic deepfakes falls. Influence operators shift toward real hacked material, authentic proxies, contextual deception, private groups and narratives that cannot be disproven simply through media forensics.

Key uncertainty. Authentication could fragment into incompatible ecosystems or create a harmful assumption that unsigned material is automatically false. The 2026 evidence that current labeling remains incomplete shows that defensive adaptation is not automatic.

Scenario B — Persistent influence competition

Plausibility: High.

This is the baseline scenario suggested most strongly by current evidence.

Generative AI becomes a normal production tool for governments, political campaigns, intelligence-linked contractors, activists, public relations firms and malign networks alike. Synthetic content volume rises dramatically, but strategic influence remains constrained by attention scarcity and distrust.

Operations become more multilingual and persistent. Cheap synthetic presenters, voiceovers, localized text, memes and fake personas become standard. Human operators continue to select objectives, approve narratives and intervene when automated systems fail.

This is an extension of the pattern already documented by OpenAI, Microsoft, DOJ and Graphika: AI increases productivity while operators retain recognizable historical tactics.

Prerequisites. Continued availability of strong generative models; inexpensive inference; weak cross-platform information sharing; persistent geopolitical competition; large pools of compromised or disposable accounts.

Early warning indicators. More frequent AI-generated narratives associated with known operations; significant improvement in language localization; synthetic personas persisting for months or years; routine use of AI-generated audio in political contests; greater use of commercial influence contractors.

Likely impact. Attribution and verification costs rise. Journalists, intelligence services and platforms must investigate far more material. Public attention becomes more valuable, while mere content production becomes commoditized.

Key uncertainty. Saturation might reduce rather than increase marginal influence. A population exposed to overwhelming synthetic content may distrust it, ignore it, or retreat toward trusted sources.

Scenario C — Advanced cognitive warfare

Plausibility by 2035: Low-to-Moderate, but potentially high impact.

This scenario represents a genuine qualitative escalation.

AI systems cease functioning primarily as content-production assistants and become persistent adaptive influence agents. They maintain long-lived identities, participate in private conversations, remember individual preferences and objections, integrate behavioral data, monitor reactions and modify persuasion strategies over time.

At the organizational level, influence systems could integrate intelligence collection, social listening, narrative analysis, generation, distribution and measurement into tightly coupled decision cycles.

The technical components are increasingly visible separately. Controlled research demonstrates strong personalized conversational persuasion; autonomous software is becoming more capable; nation-state operators already use synthetic personas and large-scale content generation.

What remains missing is evidence of reliable, covert, population-scale integration with demonstrated field effects.

Prerequisites. Robust long-horizon agents; stable memory and persona consistency; access to rich behavioral datasets; persistent covert distribution channels; real-time multimodal generation; successful bypass of identity and provenance controls; reliable causal measurement of persuasive outcomes.

Early warning indicators would be unusually important here:

• forensic evidence of synthetic personas sustaining complex relationships for long periods without regular human intervention;
• credible demonstrations of real-time individualized persuasion using private behavioral histories;
• state or contractor systems explicitly linking social listening to automated content selection and audience-specific conversational agents;
• evidence that message selection is optimized against behavioral outcomes, not merely clicks or engagement;
• repeated field experiments showing material behavioral lift from AI personalization;
• integration of compromised private data with influence platforms;
• procurement, doctrine, budgets or organizational structures explicitly dedicated to autonomous cognitive operations;
• rapid multi-language adaptation to live political or military events;
• convincing cross-platform synthetic identities that migrate between text, voice and video while preserving continuity.

Potential impact. Such systems could make influence persistent rather than episodic. The target would not receive “propaganda messages”; the target's ordinary information environment could contain artificial interlocutors whose behavior adapts to them personally.

The most serious effect could be epistemic rather than ideological: people might become unable to know whether other apparent citizens, experts, activists or friends-of-friends represent genuine social consensus.

Key uncertainty. Human behavior may be substantially less optimizable than technology forecasts presume. Politics is shaped by identity, institutions, social relationships and events, not merely message quality. The historical difficulty of moving real voters should temper projections from laboratory persuasion.

Comparative scenario matrix

Final judgment and annotated bibliography

To what extent is AI-enabled psychological warfare already operational?

Substantially operational at the production and operational-support level; only partially demonstrated at the adaptive-persuasion level.

There is high-confidence evidence that state-linked and political actors already use AI to generate narratives, translate and rewrite material, create synthetic personas, fabricate profile pictures, produce synthetic audio/video, assist bot networks, and accelerate influence workflows. Russian, Chinese, Iranian and commercially linked operations have been publicly documented by governments, platforms and independent investigators.

It is therefore no longer accurate to describe AI-enabled psychological warfare as purely hypothetical.

But a second claim—that AI has already produced autonomous, individualized, population-scale cognitive warfare of extraordinary effectiveness—is not supported by the open evidence.

The observed reality is better summarized as:

AI is industrializing the supply side of influence faster than it has proven the demand-side ability to change minds.

How effective is it demonstrably?

Effectiveness must be scored at several layers.

Operational efficiency: High confidence, meaningful effect. AI clearly reduces the labor required for drafting, translation, variation, profile construction and synthetic media.

Content realism and volume: High confidence, meaningful effect. Synthetic images, audio, video and fluent multilingual text are now routinely accessible and have appeared in documented operations.

Reach and engagement: Mixed. Some operations reach substantial audiences, but many identified AI campaigns have remained trapped within artificial networks or attracted little genuine engagement. OpenAI, Microsoft and Graphika have repeatedly reported this limitation.

Individual persuasion: Strong experimental evidence. Modern LLMs can write persuasive messages and conduct persuasive conversations; personalization can improve performance in controlled settings.

Mass behavioral change: Low confidence. Publicly available evidence does not establish that AI-generated influence has decisively altered a national election, mass protest, military campaign, or geopolitical policy outcome. Historical field research showing weak average political-persuasion effects reinforces the need for caution.

Strategic effect: Unproven as a distinct AI advantage. A successful state influence campaign might matter strategically, but separating the contribution of AI from preexisting political polarization, authentic actors, conventional media, geopolitical events and platform algorithms is extraordinarily difficult.

What would signal meaningful escalation?

A meaningful intelligence threshold would be crossed not when more deepfakes appear, but when several of the following occur together:

Persistent autonomy. Synthetic personas reliably operate for months, maintain memory, develop relationships and adapt without frequent human intervention.

Individualized feedback. Systems tailor communication continuously to a person's responses rather than merely targeting demographic categories.

Behavioral-data fusion. Influence agents gain access to substantial private or illicitly acquired data about specific individuals.

Closed-loop experimentation. Intelligence collection, content generation, distribution and measurement become one automated feedback system.

Multimodal continuity. The same synthetic identity can converse convincingly by text, voice and video and survive attempts to verify it.

Causal field evidence. Controlled real-world studies or credible intelligence show that AI-personalized influence materially increases voting, abstention, donation, recruitment, protest, defection or other consequential behavior relative to human or nonpersonalized messaging.

Organizational institutionalization. Military, intelligence or contractor documents reveal doctrine, procurement and dedicated command structures built around autonomous adaptive cognitive operations rather than ordinary information operations assisted by AI.

Failure of authentication defenses. Provenance is routinely stripped or ignored, synthetic media cannot be resolved rapidly during crises, and authentic official communications become difficult to distinguish from hostile simulations.

No single one of these would establish a mature cognitive-warfare system. Their convergence would.

Annotated bibliography

**Thomas Boghardt, “Soviet Bloc Intelligence and Its AIDS Disinformation Campaign,” Studies in Intelligence, December 2009.** Historical CIA study of Soviet active measures and Operation INFEKTION. Particularly valuable for demonstrating that audience psychology, narrative laundering and multi-channel amplification long predate AI.

**U.S. Senate Select Committee on Intelligence, Russia's Use of Social Media, October 2019.** Bipartisan congressional investigation based partly on platform data. Establishes the scale, identity targeting and divisive objectives of the IRA's 2016 operation; essential baseline for comparing pre-generative computational propaganda with later AI-enabled campaigns.

**Oxford Internet Institute, Computational Propaganda project.** Foundational research program defining and documenting the role of automation, algorithms and social media in organized political manipulation. Useful for understanding continuity between bot-era propaganda and generative AI.

Oxford Internet Institute, global “cyber troops” inventory, July 17, 2017. Documented organized social-media manipulation capabilities in 28 countries at the time, demonstrating that industrialized digital influence was already internationally widespread before LLMs.

**UK Information Commissioner's Office, Investigation into the Use of Data Analytics in Political Campaigns, November 6, 2018.** Major regulatory investigation into political data, analytics, Facebook and Cambridge Analytica. Strong evidence for privacy and targeting concerns; also useful for separating verified data practices from exaggerated claims about psychographic mind control.

**Graphika, Deepfake It Till You Make It, February 7, 2023.** Identified AI-generated video presenters in the pro-China Spamouflage ecosystem. One of the earliest well-documented cases connecting generative video with an established state-linked influence network.

Graphika, original Spamouflage investigation, 2019. Important longitudinal reference showing that the network was prolific but historically struggled to generate meaningful authentic engagement—a useful warning that scale is not influence.

OSCE/ODIHR, Slovak Republic Election Assessment Mission report, 2023. Independent election-observation baseline for evaluating claims that an AI deepfake “swung” Slovakia's election. The report describes a highly polarized but competitive election and does not establish a deepfake as decisive.

**de Nadal and Jančárik, “Beyond the deepfake hype: AI, democracy, and ‘the Slovak case,’” Harvard Kennedy School Misinformation Review, August 22, 2024.** Particularly valuable corrective to post hoc causal claims surrounding the Slovak deepfake. Emphasizes preexisting political conditions and evidence gaps.

UNESCO, Slovakia synthetic-audio media-literacy case study. Accessible institutional account of the fake Šimečka–Tódová recording and the practical difficulties of verifying synthetic audio immediately before an election.

**European External Action Service, Second Report on Foreign Information Manipulation and Interference Threats, January 2024.** EU strategic assessment of FIMI techniques and evolving generative-AI concerns; useful for situating deepfakes inside a broader operational ecosystem.

Microsoft Threat Analysis Center, “East Asia threat actors employ unique methods,” April 4, 2024. Primary platform/intelligence reporting on China-linked AI use around Taiwan's election, including synthetic audio and AI news presenters. Notably reports little evidence that the material changed opinion.

OpenAI, “Disrupting deceptive uses of AI by covert influence operations,” May 30, 2024. Primary provider telemetry on five influence operations. Central finding: AI supported content-production workflows but did not produce major audience breakout. One of the best sources for evaluating the gap between capability and demonstrated operational effect.

Federal Communications Commission, Declaratory Ruling FCC 24-17, February 8, 2024. Establishes that AI-generated voices fall within U.S. restrictions applicable to artificial/prerecorded robocalls. Important legal response to voice cloning.

Federal Communications Commission, New Hampshire robocall enforcement action, 2024. Documents the political voice-cloning incident and proposed enforcement response, providing a rare clear example in which synthetic speech was directed toward concrete electoral behavior.

New Hampshire Department of Justice, “Steven Kramer Charged with Voter Suppression over AI-Generated President Biden Robocalls,” May 23, 2024. Primary state-law-enforcement source for the criminal allegations surrounding the New Hampshire incident.

U.S. Department of Justice / FBI, Russian generative-AI-enhanced bot-farm disruption, July 9, 2024. Landmark public case establishing operational use of generative AI to assist fictitious profiles and scale a state-sponsored social-media operation.

U.S. Department of Justice, Russian Doppelganger domain seizures, September 4, 2024. Detailed government evidence and allegations concerning cloned media outlets, fake identities, AI-assisted narratives and targeting by Russian-linked influence infrastructure. Essential for studying integration rather than isolated deepfakes.

Microsoft, “Securing U.S. elections from nation-state adversaries,” September 18, 2024. Threat-intelligence assessment covering Russian, Iranian and Chinese cyber-enabled influence activity around the 2024 U.S. election.

Microsoft Digital Defense Report 2024. Reports that Russia, Iran, China and other nation-state actors increasingly incorporated AI-generated or enhanced material into influence operations for productivity, efficiency and engagement.

Microsoft Digital Defense Report 2025. Valuable longitudinal evidence that the volume of AI-generated content attributed to nation-state actors increased substantially, while allowing comparison of sophistication and observed impact.

OpenAI threat report, October 7, 2025. Summarizes dozens of disrupted malicious networks and argues that threat actors largely attach AI to existing playbooks to improve speed rather than unlock unprecedented offensive capability. This is one of the strongest available counterweights to sensationalist “autonomous psyop” narratives.

**U.S. Office of the Director of National Intelligence, Annual Threat Assessment, 2025.** Reports Chinese use of AI-generated news anchors and synthetic profile images around divisive U.S. issues and assesses continuing expansion of malign-influence capabilities.

**U.S. Office of the Director of National Intelligence, Annual Threat Assessment, 2026.** Current strategic baseline describing Russian disinformation and influence operations as part of Moscow's continuing gray-zone toolkit.

Graphika, Spamouflage reporting, March 4, 2026. Documents continued use of AI-generated cartoons and articles in coordinated pro-China networks, evidence that generative workflows have become persistent features rather than isolated experiments.

Graphika, Spamouflage event-manipulation investigation, July 13, 2026. Shows continued experimentation with manipulated material aimed at anti-CPC events in the United States and Europe.

**Bai et al., large-language-model persuasive messaging study, Nature Communications, 2025.** Three preregistered experiments involving 4,829 participants found measurable attitude effects from LLM-generated persuasive policy messages. Strong evidence of machine persuasion under controlled conditions, but not an influence-operation field trial.

**Salvi et al., “On the conversational persuasiveness of GPT-4,” Nature Human Behaviour, 2025; author correction 2026.** One of the most important studies of personalized conversational AI persuasion. The later correction is analytically important because it cautions against repeating sensational numerical summaries without checking amended results.

**Matz et al., “The potential of generative AI for personalized persuasion,” Scientific Reports, 2024.** Experimental evidence that messages customized to psychological characteristics can increase persuasive effectiveness, relevant to the prospect of machine-scale microtargeting.

**Costello, Pennycook and Rand, “Durably reducing conspiracy beliefs through dialogues with AI,” Science, September 13, 2024.** Demonstrates that personalized AI conversation can produce durable belief change in a corrective direction. Critically shows that adaptive persuasion capability should not automatically be equated with malign influence.

Fazio et al., illusory-truth research, 2019. Experimental evidence for the effect of repetition on perceived truth, providing a psychological basis for concern about cheap high-volume narrative repetition while not itself testing generative-AI operations.

**Kalla and Broockman, “The Minimal Persuasive Effects of Campaign Contact in General Elections,” American Political Science Review, 2018.** Meta-analysis and field-experiment evidence estimating essentially zero average persuasive effect on candidate choice in U.S. general elections. Essential methodological counterweight to claims that persuasive-looking content necessarily changes votes.

**Gauthier et al., “The political effects of X's feed algorithm,” Nature, 2026.** Randomized evidence that algorithmic feed selection can change engagement and some political opinions while leaving other outcomes unchanged. Important because it demonstrates a causal role for platform mediation without implying that recommendation algorithms are themselves PsyOps.

European Commission, EU AI Act implementation overview, current through October 2026. Primary legal source establishing that AI-content transparency provisions entered application in August 2026, including requirements involving deepfakes and certain public-interest synthetic content.

European Commission, Digital Services Act election-integrity guidance and implementation materials, 2024–2026. Primary regulatory framework requiring very large online platforms and search engines to assess and mitigate systemic electoral and civic-discourse risks while respecting fundamental rights.

European Commission, Code of Practice/Conduct on Disinformation, updated 2025. Documents the integration of the strengthened disinformation code into the DSA governance architecture and provides a significant example of platform-accountability mechanisms short of direct state control of speech.

Real-world audio deepfake detection research, 2024. Research demonstrating the difficulty of generalizing audio-deepfake detectors to real-world conditions and unseen inputs. Valuable reminder that forensic classifiers should support—not replace—source verification and human investigation.

Cross-platform AI-labeling audit, 2026 preprint. Recent empirical test of synthetic-media labeling on major social platforms. Finds meaningful adoption but substantial gaps. Because it is recent and prepublication, it should be treated as provisional rather than a settled benchmark.

Overall intelligence judgment

The evidence supports neither complacency nor the claim that artificial intelligence has already produced a secret, omnipotent machinery of mass mind control.

The defensible assessment is narrower and more consequential:

AI has already entered psychological and information operations as a force multiplier. It is reducing the cost of synthetic identity, multilingual propaganda, media fabrication, bot content, research and rapid narrative production. That transition is documented at high confidence.

AI has not yet been publicly shown to deliver a corresponding revolution in strategic persuasion. Many identified operations remain low-engagement, detectable and dependent on established political divisions and distribution mechanisms. Platform investigations explicitly report cases in which increased synthetic production did not translate into authentic influence.

The capability that deserves the closest attention is not content generation but feedback-controlled personalization. Controlled science now establishes that language models can conduct individualized persuasive dialogue and adapt arguments to users. The decisive escalation would occur when that capability is fused with persistent synthetic identities, large behavioral datasets, autonomous agents, cross-platform distribution and credible field measurement.

Until evidence of that integration appears, the phrase “advanced AI cognitive warfare” should be treated as a threat model, not as a description of a proven existing system.

The most important intelligence indicator for 2027–2035 is therefore not how many AI-generated posts, bots or deepfakes are discovered. It is whether operators begin demonstrating reliable conversion of machine-generated interaction into measurable human behavior at scale. That would mark the transition from AI-assisted propaganda to something genuinely new: persistent, adaptive, computational influence infrastructure capable of learning from the populations it is trying to influence.