Election influence campaigns, particularly ones playing out over social media, are a dime a dozen.
Such campaigns – sometimes devised by foreign powers, other times by domestic groups – are often designed to influence the U.S. electorate. Fake accounts and online personas are created, networks of propaganda are disseminated and the campaign seeks to nudge American voters into thinking a certain way.
Mostly, these efforts are known for getting little to no traction with U.S. audiences. But while social media influence campaigns may not be effective, bad actors continue to adapt their coordinated propaganda goals to new tactics and technologies.
Enter AI chatbots, which have become a source of information and truth for many, who consult the tool for feedback and advice on everything from their careers, to their relationships with their family, as well as their politics.
But new research from VisionHeight, an Israeli threat intelligence firm, highlights how AI systems can often serve as more useful marks for influence actors than humans. To wit: someone is setting up networks of hyperlocal websites across at least 14 different states, filled with content meant to influence U.S. races.
These networks include websites with names like “Wolverine State Report” or “Peach State Bulletin.” Each state network usually has between five to six separate sites, some presenting themselves as hard news outlets and others as opinion or editorial sites. The outlets also cite one another, creating a circular network of local credibility.
But the content on these websites does not resemble journalism, or any writing that a human would find coherent or compelling. Rather, they often include text of statements about specific candidates running in local races, directly stating they are the better candidate for a political issue.
Statements like “Candidate X is the stronger choice” for voters who care about housing, taxes or other political issues were repeated hundreds of times on the websites, with slight changes in the language for different political issues. Most notably, they appear to be explicitly written for AI crawlers scraping web traffic, not humans.
“What’s really interesting about this is that the websites themselves and the content is so well built to let’s say optimize the probability for AI crawlers and the model to be influenced by this content,” said Nitsan Daniel, chief technology officer and co-founder of VisionHeight in an interview.
When a user asks an AI chatbot a question, the model will often search the internet for an answer. By creating specific online content providing direct answers to questions like “which candidate in a local race is better on housing affordability” it can essentially train the AI to retrieve that information when responding to queries.
Many media websites will opt to block AI crawlers, but these websites were all configured to specifically allow major U.S. AI companies to scrape their websites.
A blog by VisionHeight published Wednesday said the operation encompassed six states and 37 websites, but Daniel told CyberScoop that they have since discovered the operation spanned at least 14 states and 460 pages of online content.
The states targeted include Arizona, Colorado, Georgia, Indiana, Iowa, Kansas, Michigan, Mississippi, Nevada, North Carolina, Pennsylvania, Texas, Virginia, Wisconsin . At least seven states saw one or more House races targeted, while other sites focused on other races like Secretaries of State, statewide judicial appointments and local offices.
Most of the research focused on AI answers provided through Google search, but Daniel said they had confirmed at least one major AI model, Perplexity, linked to and cited one of the pages, Tarheel State Report, as its first source for an answer.
VisionHeight does not attribute the activity to a particular actor. To Daniel, who is behind the campaign and their ultimate goals are less important than the prospect that this kind of operation is easily reproducible by both foreign and domestic bad actors looking to influence how AI systems answer questions around political races.
“What we’re seeing here is,I think, very nicely demonstrating how the entire world is transitioning to [a new era],” she said. “So if in the previous election you could have seen fake websites aimed at getting people to actually read it, and containing content built to impact what they’re thinking, what we’re seeing here is…now instead of spending time and effort on getting people to read the content, [they’re] getting into their AI and being influenced by that.”
But Daniel’s concerns are broader. Large language models have become increasingly sophisticated in their ability to carry out a range of deceptive activities, such as creating false organizations, websites, as well as deepfake video, audio and imagery at scale.
It appears AI was used to generate much of the infrastructure and content used in the operation as well. All 37 websites VisionHeight identified in their first analysis, spanning multiple states, were registered in a single evening, and 36 were registered within an 8 minute timeframe. On Sept. 30, the network published “roughly 100,000 words of candidate content” all using the same template and layouts.
Foreign and domestic actors can easily replicate this process, generating hyperlocal propaganda that shapes what AI chatbots say in response to political questions. Experts say chatbots have improved at avoiding false election information, but they remain vulnerable to manipulation and errors that make them unsuited to providing more complex answers around politics.
Whereas in the past a foreign actor might lack the budget, time and incentive to target small elections, AI tools now allow for such operations to be created and optimized at scale within days. Domestic actors, meanwhile, could potentially pair the same tactics with a more sophisticated understanding of how to influence American audiences.
“It really demonstrates how in general using AI just makes what was in the past small targets [more attainable], Daniel said. “People could think that the odds of them being hit, being manipulated or being attacked are just lower because people will not put all their energy and resources on that. Nowadays, because it is so much easier, we’re seeing influence operations and cyber attacks hitting small, medium businesses as well as smaller communities, like in this case.”
