AI-Driven Information Warfare: Disinformation and Psychological Manipulation
8 December 2025
Summary
Artificial Intelligence (AI) weaponisation reached critical thresholds in 2025, with over 50% of web content now AI-generated, bot traffic surpassing human activity at 51%, and deepfake incidents in Q1 2025 exceeding all of 2024.
The systematic contamination of AI training data creates self-reinforcing cycles where compromised systems train future AI on adversarial content, whilst attackers maintain decisive asymmetric advantages.
Despite over 260 AI bills enacted globally and the European Union (EU) AI Act, regulatory responses remain fragmented across jurisdictions, enabling transnational threat actors to exploit compliance gaps.
Without fundamental changes to trust and verification mechanisms, AI-powered disinformation is poised to outpace detection capabilities, with cascading effects on democratic governance and information ecosystem integrity.
Context
The Pravda Network represents a strategic shift from convincing individual users to poisoning the information infrastructure they depend upon. By March 2025, the network had contaminated major AI chatbots, with 33% of responses containing Pravda narratives. This approach exploits the fundamental tension between AI systems' need for vast training data and their inability to verify source credibility at scale. Each contaminated chatbot response can potentially influence thousands of users who trust AI systems as neutral information sources, whilst simultaneously generating new training data that perpetuates contamination in future AI iterations. The revelation that researchers discovered this contamination only through systematic testing suggests the actual scope of compromise likely exceeds documented cases.
The Golaxy system revealed how AI enables the transition from mass propaganda to precision influence operations. By maintaining detailed profiles on United States (US) lawmakers and thousands of influencers, the system demonstrates that actors now possess the capability to generate personalised, persuasive content at scale, a combination previously impossible due to resource constraints. The August 2025 exposure by Vanderbilt University researchers underscores how democratic systems' information transparency enables adversaries to collect targeting data through open sources, whilst authoritarian states restrict equivalent access. This structural asymmetry is further emphasised by OpenAI's disruption of four China-linked operations between March and June 2025, including "Sneer Review", which generated social media comments across multiple platforms to simulate organic engagement.
The Integration of AI deepfakes with military operations during the "Twelve-Day War" between Iran and Israel demonstrates how synthetic media collapses the distinction between information warfare and kinetic combat. AI-generated videos of fabricated missile strikes on Tel Aviv and downed F-35 jets spread across platforms in five languages within hours. Similarly, Israel's Operation PRISONBREAK deployed deepfake content within one hour of actual strikes, indicating that even democratic states now treat AI-enabled psychological operations as essential military capabilities, normalising synthetic media warfare regardless of governance model.
Extremist targeting of minors represents a distinct but related threat. The 2,000 extremist links identified by Europol targeting minors across 16 European countries in May 2025 demonstrate how AI eliminates the recruitment bottleneck that previously constrained extremist networks. Traditional radicalisation required sustained human interaction, a resource-intensive process that limited scalability. However, AI-generated personalised content enables simultaneous targeting of thousands of vulnerable individuals with messaging adapted to each target's psychological profile, digital behaviour, and social context. 'Violence-as-a-Service' platforms like 764/Com Networks specifically target minors aged 8-17, identifying them on mainstream platforms and grooming them through psychological coercion to perform self-harm and violence, with acts shared within online communities. This represents evolution from ideological recruitment to direct violence incitement at algorithmic speed.
Implications and Analysis
Systematic Erosion of Epistemic Foundations
The contamination of AI training data and chatbot outputs represents a qualitatively different threat than traditional disinformation campaigns. When major chatbot responses contain state-sponsored propaganda, the issue transcends individual deception to poisoning the knowledge infrastructure itself. Users consulting AI systems for information verification unwittingly amplify adversarial narratives, creating self-reinforcing cycles where contaminated outputs become training data for future iterations. This progressively degrades the reliability of information retrieval systems that modern societies depend upon for decision-making.
This approach exploits trust relationships in ways that traditional content moderation cannot address, as contamination occurs at the training data level rather than in final content distribution. Attackers need not convince individual users directly, but instead compromise the systems that they trust. Adding on to this, the shift to precision influence operations further compounds the challenge. When AI generates personalised content that exploits individual psychological vulnerabilities, traditional countermeasures like fact-checking, media literacy campaigns, and counter-narratives become inadequate. Detection mechanisms designed for mass disinformation cannot scale to monitor individualised content tailored to millions of targets simultaneously.
Asymmetric Advantage Favouring Attackers
The technical and economic dynamics of AI-driven information warfare heavily favour attackers. Creating convincing deepfakes costs significantly less than developing and maintaining detection systems. Moreover, attackers benefit from inherent asymmetries where a single undetected deepfake can cause significant damage, whilst defence requires near-perfect detection rates to maintain information ecosystem integrity.
More importantly, AI-enabled capability democratisation creates a ratchet effect. Once capabilities diffuse to lower-skilled actors, defensive organisations face simultaneous threats from both sophisticated actors and newly empowered non-state networks. This breaks the historical security equilibrium where defensive investment could concentrate on a limited number of highly skilled adversaries.
The small window of audio required for voice cloning attacks also exemplifies how AI reduces attack requirements whilst increasing defensive complexity. Organisations must verify authenticity through multiple independent channels for routine communications, imposing substantial operational costs. This creates a verification paradox: Societies face an impossible choice between implementing universal verification protocols that paralyse operations or accepting contaminated information to maintain operational pace. Critical time-sensitive decisions like medical emergencies, counter-terrorism, crisis response, and breaking news become impossible under universal verification requirements, yet proceeding without verification invites exploitation.
Compounding Cross-Domain Vulnerabilities
The convergence of state and extremist AI weaponisation creates compounding vulnerabilities where threats reinforce one another. State-sponsored disinformation erodes institutional trust, creating environments where extremist narratives gain traction. When information ecosystems are contaminated, extremist groups exploit the confusion to position their ideologies as alternative frameworks for understanding reality.
The targeting of minors exemplifies overlapping vulnerabilities. Minors, whose psychological development remains incomplete, are particularly susceptible to manipulation that traditional safeguards cannot address. When coerced into documenting self-harm or violence, this content becomes training data for AI systems whilst traumatising other young viewers, creating cyclical harm. This demographic targeting represents strategic investment: Current minors will reach voting age, military service, and positions of authority, carrying exploitable psychological vulnerabilities for decades.
The psychological impact extends across all demographics. Adults face epistemic learned helplessness, abandoning truth-seeking when verification seems impossible, whilst information tribalism intensifies as individuals retreat to trusted ideological enclaves. Chronic anxiety about authenticity erodes mental health and social cohesion, as the cognitive burden of questioning every piece of media becomes unsustainable. The result is a population increasingly unable to form the shared understanding necessary for democratic deliberation.
Structural Democratic Disadvantage
Democratic systems face a permanent structural disadvantage in information warfare. Democratic transparency, like public records, voting data, lawmaker communications, and media pluralism, provides adversaries with targeting data, whilst authoritarian states restrict equivalent access. The Golaxy system exemplifies this asymmetry: It exploits openly available information to build detailed psychological profiles of US officials, whilst counterparts remain opaque to equivalent analysis.
This represents not a temporary capability gap but a fundamental feature of governance models. Democracies cannot restrict information flows without undermining their core principles, creating an unsolvable dilemma. Authoritarian adversaries face no equivalent constraint; information control is inherent to their governance structure. This ensures offensive psychological operations will consistently favour authoritarian actors, regardless of defensive technological advances.
More importantly, the normalisation of synthetic media warfare across governance models eliminates prospects for international restraint. When democracies deploy military deepfakes alongside authoritarian adversaries, civilian populations are left permanently unable to trust visual evidence during conflicts.
Regulatory Fragmentation and Implementation Gaps
The 260 AI bills enacted globally paradoxically weaken defensive capabilities through regulatory fragmentation. Legitimate AI developers face multiplicative compliance costs across incompatible jurisdictions, constraining resources for security improvements. Meanwhile, adversarial actors compartmentalise operations to exploit gaps, developing models in permissive regions, hosting infrastructure in uncooperative states, and targeting victims in heavily regulated markets.
Enforcement capabilities lag substantially behind legislative mandates. When the Pravda Network operates across hundreds of domains and Chinese influence operations target US lawmakers from mainland China, no single jurisdiction possesses adequate authority to disrupt operations. Attribution challenges further undermine accountability: Determining who created disinformation, which intermediaries amplified it, how it entered training datasets, and whether reproduction constitutes negligence involves distinct legal jurisdictions with incompatible standards.
Forecast
Short-term (Now - 3 months)
Detection-generation capability gaps will likely widen as adversaries refine contamination techniques. Organisations face a realistic possibility of increased deepfake incidents, forcing the adoption of zero-trust verification protocols that impose substantial operational costs and degrade response times.
State-sponsored influence operations targeting democratic elections and policymakers will likely intensify, exploiting regulatory enforcement gaps.
Extremist networks' targeting of minors will likely expand across jurisdictions and platforms, overwhelming counter-terrorism resources operating at human pace against algorithmic-speed operations.
Medium-term (3-12 months)
AI-powered disinformation will likely achieve decisive advantage over detection capabilities by late 2026, forcing governments and organisations into permanently reactive postures.
Training data poisoning will highly likely worsen as contaminated AI outputs become inputs for next-generation systems, accelerating epistemic infrastructure degradation.
The EU AI Act will likely drive high-risk AI development to permissive jurisdictions, whilst extremist recruitment operations scale to industrial levels.
Long-term (>1 year)
Information ecosystem collapse becomes a realistic possibility by 2027-2028 without fundamental restructuring of authentication and verification mechanisms, as synthetic content ratios exceed 70-80% and detection systems face systematic compromise.
Democratic governance will likely face sustained degradation through 2027-2029 as precision influence operations combine with mass exposure to contaminated information systems, eroding capacity for evidence-based policymaking.
Coordinated international response frameworks remain unlikely before 2028, as misalignment between globally operating threat actors and nationally constrained regulatory mechanisms creates structural impediments favouring authoritarian actors.
