Daily, tens of millions of items of faux content material are produced. Movies, audio clips, posts, articles, generated by synthetic intelligence, distributed at industrial scale, aimed toward shifting public opinion throughout whole nations. The individuals producing them are sometimes outdoors the nation being focused. The individuals receiving them nearly by no means know they’re pretend. They usually do not know how they’re made.
A number of years in the past, troll farms labored like this: whole buildings full of individuals, shifts, desks and employees paid to put in writing posts, create pretend profiles, remark and choose fights in on-line discussions. It was costly, sluggish, and in the long run, the actual affect was marginal. These buildings nonetheless exist at this time, largely in India, cut up between groups specializing in scams and groups devoted to disinformation. They work on fee they usually’re largely AI consultants now. They not write the articles themselves and not do graphic design or picture enhancing. They’ve AI brokers do every thing: brokers they create, configure, instruct, and supervise. A whole bunch of 1000’s of autonomous brokers that do in a single hour what used to take weeks of human labor. Troll farms have turn into AI farms, producing artificial content material at industrial scale.
The report “From Trolls to Generative AI: Russia’s Disinformation Evolution,” revealed in February of 2026 by the Centre for Worldwide Governance Innovation (CIGI), tells one in all these tales, particularly about disinformation campaigns originating from Russia. Networks like CopyCop, a disinformation operation linked to the GRU (Russian army intelligence), use uncensored open-source language fashions like modified variations of Llama 3, put in on their very own servers, to rework press articles into political propaganda and distribute it throughout a whole lot of faux web sites with out leaving a hint. As a result of the fashions run domestically, there’s no watermark and no log. The mannequin runs on their {hardware}, inside their borders, outdoors any Western jurisdiction.
The paper “How malicious AI swarms can threaten democracy,” revealed in Science in January 2026 describes nicely what’s coming: coordinated swarms of AI brokers with persistent identities, reminiscence, and the flexibility to adapt in actual time to individuals’s reactions. The authors name them “malicious AI swarms.” Absolutely autonomous brokers, every producing unique content material, each totally different, each tailored to context.
They’ll simulate actual communities that seem credible, they usually construct what we are able to name artificial consensus: the phantasm that an opinion is extensively shared, {that a} place is held by the bulk, when in actuality it’s a single operator talking by 1000’s of masks.
It really works as a result of we people have bugs too, and the swarms exploit them at a scale that was by no means attainable earlier than or that may have required monumental human sources.
One bug is known as the bandwagon impact. Mixed with one other bug, illusory reality: repetition plus obvious supply independence equals perceived reality. So if we see the identical place expressed by totally different sources, in several contexts, with totally different phrases, on totally different platforms, we register it as widespread. And if we understand it as widespread, we take into account it extra credible. And if we take into account it credible, we are likely to align with it.
Swarms of autonomous brokers exploit each mechanisms on the identical time, at industrial scale.
What most individuals nonetheless haven’t grasped is the dimensions. We had been used to automation: A system that despatched 100 thousand equivalent emails, at most altering the title and little else, or made simply as many posts and comparable feedback with minor variations. It automated the publishing, however at its core it was recognizable spam. Our psychological mannequin remains to be that one: If it’s automated, it’s generic. If it’s generic, you possibly can spot it. However that’s a notion error constructed on years of expertise when AI brokers didn’t exist. That mannequin is over. These brokers not match the idea of automation, as a result of they make selections, they transform the textual content based mostly on the recipient. They mixture information from heterogeneous sources in actual time: social profiles, public data, leaked databases that you could now purchase for a couple of {dollars} on any darkish internet market. Billions of private data are already on the market, scattered throughout a whole lot of breaches collected through the years, and AI can cross-reference them, reconcile them, and construct a coherent profile of a single particular person in seconds. The computational value is negligible: a couple of cents in tokens to generate a superbly customized message. Take into account {that a} single agent with entry to a language mannequin and a few leak databases can produce 1000’s of distinctive items of content material per day, every calibrated for a distinct particular person. Multiply that by 100 thousand brokers working in parallel, twenty-four hours a day, and you’ve got the dimensions of what’s occurring.
One other legacy from the previous: “I’m simply an bizarre particular person, why would anybody hassle creating content material particularly to persuade me?” That will have been as soon as true. Immediately, no person is dropping time as a result of these brokers don’t get drained, don’t sleep, and do nothing else: discover connections, mixture information, produce false content material calibrated for every of us. The previous demographic profiling is over. That is surgical media concentrating on at industrial scale.
However the capability to reply and deny just isn’t at industrial scale. If a whole lot of 1000’s of coordinated brokers unfold a video of a politician saying one thing they by no means mentioned, that politician can deny all of it they need. The video is there. Thousands and thousands of individuals have seen it. The denial arrives later, arrives slower, and can by no means attain the identical scale. It arrives in a world the place no person is aware of what’s true anymore.
If the identical swarms unfold the information {that a} head of state has died, and the information is fake, that head of state could make all of the movies they wish to show they’re alive. These movies will in all probability be dismissed as deepfakes. As a result of the swarm’s narrative bought there first, took root, and at that time any proof on the contrary seems to be fabricated.
Whoever controls the swarms at this time controls the model of the details. Whoever tries to push again is already at an obstacle as a result of they should show that an actual video is actual in a world the place everybody has discovered that movies may be pretend.
The attackers are sometimes outdoors the nation being hit. Teams aligned with governments that wish to shift public opinion out of the country, or that focus on particular demographics. Younger individuals, for instance, utilizing platforms which might be typically owned by these very nations.
All of this can be a large risk to democracy as a result of democracy operates on some premises, together with that folks kind opinions based mostly on actual data, focus on with one another, after which resolve. If the knowledge is fabricated, if the controversy is populated by entities that don’t exist, if the consensus we understand is artificial, that premise collapses. And with it, all the mechanism. Elections turn into the results of who has the perfect swarms, not who has the perfect concepts. Public debate turns into a efficiency the place a lot of the voices are generated, and public opinion stops being public and turns into the product of whoever has the sources to fabricate it.
We grew up considering that threats to democracy got here from coups, censorship, or regime propaganda broadcast on tv or in nationwide newspapers. These had been actual threats, however they had been at the very least seen. They had been issues you may establish and battle. Now the risk is greater and, above all, invisible, customized, and it operates contained in the very channels we use to tell ourselves, to debate, to take part. It contaminates data from inside, to the purpose the place no person is aware of which voices are actual and that are machines.
What can we do? Watermarking? Sample detection? Sadly, they don’t work. The foremost AI platforms can embed markers in content material generated by their fashions, true. However the individuals constructing autonomous swarms don’t use business platforms. They use open-source fashions with fine-tuning and capabilities that may’t be managed from outdoors. They usually typically haven’t any authorized obligation to do something as a result of there aren’t any world legal guidelines that may impose watermarking on each pc on this planet. The result’s paradoxical: The content material produced by those that comply with the foundations stays marked, and the content material produced by those that wish to trigger hurt stays free.
Sample detection techniques have the identical limits. They work for some time, then as soon as the detection patterns are recognized, the swarms adapt. They’re designed to do precisely that.
And the platforms the place all of this circulates have a monetary incentive to show a blind eye. Inside Meta paperwork made public by Reuters in November 2025 estimated that roughly 10% of Meta’s world 2024 income, about $16 billion, got here from promoting for scams and prohibited merchandise. Fifteen billion high-risk advertisements served on common each day to customers. The utmost income Meta was prepared to sacrifice to behave in opposition to suspicious advertisers was 0.15% of complete income: $135 million out of $90 billion. When a platform’s enterprise mannequin will depend on advert quantity, eradicating the fraudulent ones has a price that no person needs to pay. I believe Meta just isn’t alone on this.
Regulation doesn’t remedy this drawback both. I’ve labored on the European AI framework, the GPAI process drive, the Italian AI regulation, and I’ve introduced my perspective to the UK Parliament. I’ve been in these rooms. Europe has the AI Act, the GPAI Code of Follow is presently being drafted, and has a regulatory equipment that’s extra superior than another bloc on this planet. The US has no federal regulation, and twenty-eight states have tried to legislate with transparency necessities that quantity to nice print. However even probably the most bold European framework has a structural restrict: The assaults come from nations that reply to none of those guidelines. You may regulate your platforms, your builders, your firms. You may’t regulate a constructing in Saint Petersburg, Shenzhen, or New Delhi, the place somebody is instructing swarms of brokers on open-source fashions working on native servers, outdoors any jurisdiction.
A method out is to return to the repute of sources. Editors, information organizations, journalists with a reputation and a face. Folks and organizations which have an expert observe report to defend and that threat one thing after they get it flawed. Positive, they will have political leanings they usually could make errors. However they’ve a constraint that no AI agent will ever have: public accountability. A system that generates tens of millions of items of false content material solutions to nobody. An editor solutions to their viewers, to the regulation, to their repute. That constraint is the one filter that also holds, and defending it’s the solely factor we are able to do proper now, whereas the legal guidelines attempt to meet up with a know-how that strikes sooner than any legislative course of on this planet.
Are we fully on the mercy of AI swarms or can we battle again?
Machines shouldn’t get to overpower people, particularly when what’s at stake is how we govern ourselves. The antibodies exist. We have to activate them.
The extra individuals perceive how swarms work, the much less efficient they turn into. A swarm that manufactures pretend consensus solely works if the individuals receiving it don’t know artificial consensus exists. A bit like deepfakes. We learn about them now and we regularly spot them. When you see the way it works, it’s tougher to fall for it.
Then we want funding in tradition. In spreading digital literacy, which isn’t studying how you can use a pc, however studying to know the social and cultural results of the digital world. It means educating in faculties how you can confirm a supply and what the indicators of manipulated content material are. It means stopping the observe of treating media literacy as a faculty undertaking and beginning to deal with it as democratic infrastructure, on the identical degree as bridges and hospitals. It means funding impartial journalism as an alternative of letting it die, strangled by the identical mechanisms that reward false content material as a result of it generates extra engagement. It means demanding that platforms give totally different visibility to those that have a verifiable repute versus those that have none.
As a result of consciousness is the one antibody that scales on the identical velocity because the risk. And in contrast to regulation or detection techniques, consciousness doesn’t should be imposed. It may be constructed, taught, shared, and unfold from individual to individual.
Earlier than sharing a chunk of content material, test the place it comes from. Earlier than reacting to a video or an announcement, cease. Ask your self whether or not the supply has a reputation, a historical past, one thing to lose. Deal with every bit of content material as doubtlessly artificial till a reputable, accountable supply confirms it. These are habits, not applied sciences. They value nothing they usually work instantly.
Lastly, we want the assistance and collaboration of the tech neighborhood. Those that design platforms, write code, and make selections about how feeds and rating algorithms work are making selections that instantly form the knowledge ecosystem. These are selections with democratic penalties. The individuals making them understand it. Many have recognized it for years. That is the second to cease treating it as another person’s drawback and to resolve which facet you’re on. As a result of the swarms will not be ready.
We will do that. The instruments exist, the data is there, and the risk is obvious sufficient that pretending to not see it’s already a selection. The query is whether or not we act now, whereas the window remains to be open, or later, when the harm will likely be tougher to reverse.
