OpenAI Bans Russian And Iranian ChatGPT Accounts Behind Covert Influence Operations
OpenAI says it banned two clusters of ChatGPT accounts running covert influence operations, one originating in Russia and one in Iran. The report is published by OpenAI on its own Safety page, so this is OpenAI's own account of its own enforcement action.
Transcript
OpenAI banned ChatGPT accounts running covert influence operations from Russia and Iran. OpenAI says the operators exaggerated their effectiveness.
The company reports the operators used its models alongside traditional techniques to support fake identities and organizations.
OpenAI reports Russian operators controlled a research platform in Latin America whose employees appeared unaware.
The Iranian operation pitched long articles under fake journalist bylines. OpenAI found outlets published and promoted them.
The report says these closely resembled influence operations that predate AI. The models mainly made workflows easier.
OpenAI cannot identify the actor behind the Iranian campaign. It shared information with authorities.
Inboxsmith answers your business calls with AI. Please like and subscribe for more news.
Sources
Every claim in this video comes from the top ranking coverage of this topic. The claims and where each one came from:
- Backing sentences, quoted from the article. HOOK BACKING, that OpenAI banned ChatGPT accounts running covert influence operations from Russia and Iran and that OpenAI says the operators exaggerated their effectiveness: verbatim, with the source's two em dashes recast as commas, "We recently banned two IO, one from Russia and one from Iran, that used our models in combination with more traditional techniques and technologies to support sophisticated "false front" entities." plus "We banned a cluster of ChatGPT accounts that originated in Russia." and "We banned a cluster of ChatGPT accounts that originated in Iran." The abbreviation IO is expanded by the article itself in its first paragraph as "covert influence operations (IO)", which is why the hook says "covert influence operations" rather than the acronym. The hook's second sentence is quoted almost directly: "in both cases, the actors used questionable or outright deceitful methodologies to exaggerate the operators' effectiveness." The hook attributes that to OpenAI rather than asserting it, because it is OpenAI's characterisation of the operators' own internal reporting. The hook states no date, speaks no figure and names only OpenAI, ChatGPT, Russia and Iran. SCENE 1 (The company reports the operators used its models alongside traditional techniques to support fake identities and organizations): the same "in combination with more traditional techniques and technologies" sentence, plus "They used those entities to launder geopolitical, conflict-related messaging into their target audiences." and "Both operations were multi-dimensional, trying a range of different tactics to achieve their goals." Narration says "fake identities and organizations" rather than the publisher's own phrase ""false front" entities", because a hard gate bars building a narrated sentence on that metaphor; the underlying specifics are "a fake persona named "Mia Clark"", "a stable of seven "journalist" personas", a "self-styled "research platform"" and "an explicitly fake account to represent SRC", which is an identity pair and an organization pair respectively. SCENE 2 (OpenAI reports Russian operators controlled a research platform in Latin America whose employees appeared unaware): "They appear to have controlled the SRC via a fake persona named "Mia Clark""; "The internal reports suggested that the operators controlled the think tank, rather than merely working with it. They referenced, for example, hiring and firing decisions, pay scales, staffing plans, and ongoing research projects."; "The available evidence indicates that the SRC's employees in Latin America were not aware that they were working for a Russian group."; and "The available evidence suggests that these on-the-ground employees had no idea that they were working for a Russian operation, and conducted research tasks in good faith." Narration says "a research platform" because the article's own term is a self-styled "research platform", and it prefixes the sentence with "OpenAI says" because the control finding is OpenAI's inference from the operators' internal reports rather than a verified corporate fact. The entity name Social Research Center, the abbreviation SRC, the persona name "Mia Clark" and the operation nickname "Dark Clark" are onscreen only. SCENE 3 (the Iranian operation pitched long articles under fake journalist bylines, and OpenAI found outlets published and promoted them): "The Iranian operation included a stable of seven "journalist" personas which it used to pitch long-form articles to small and medium online outlets around the world"; "The operators used seven different bylines to pitch their articles, so we have dubbed their campaign "Bogus Bylines.""; "These pitching messages were drafted using seven different fake bylines"; "Using open-source investigation techniques, we identified almost 100 articles that had been published under one or other of the operators' bylines, across over a dozen different publications."; and "At least some of the articles were then promoted by the social media accounts of the outlets in question, giving the Iranian operators a potential way to access audiences that they would not otherwise have reached." Narration says "OpenAI found" because the publication and promotion are OpenAI's own open-source findings, and it speaks neither the count of bylines nor the count of articles. SCENE 4 (The report says these closely resembled influence operations that predate AI, and the models mainly made workflows easier): "What is most striking about these operations is that they closely resembled complex influence operations of the pre-AI age, but used AI to make some of the workflows easier." Narration writes "influence operations that predate AI" instead of the source's hyphenated "pre-AI age", and writes "the models mainly made workflows easier" instead of the source's "used AI to make some of the workflows easier", in both cases for pronunciation and length while preserving the hedge. SCENE 5 (OpenAI cannot identify the actor behind the Iranian campaign, and it shared information with authorities): "The overall activity appeared consistent with a commercial actor running a for-hire influence campaign, but we are unable to identify the particular actor involved. We have shared information on this case with the relevant authorities." The same sharing sentence appears on the Russian case: "We have shared information on this case with the relevant authorities." Narration restricts the non-identification to the IRANIAN campaign on purpose, because that is the only one where OpenAI states outright that it cannot identify the actor; on the Russian case OpenAI never names an actor itself but does report that open-source researchers attributed some of the fakes to "Politology" or "La Compania", so a narrated claim that OpenAI names nobody at all would have overstated the source. WHAT IS NOT IN THE SOURCE, stated explicitly: no named individual, company, agency or government identified by OpenAI as the operator of either campaign; no charge, indictment, arrest, prosecution, conviction, sanction, fine or regulatory finding of any kind; no named authority or industry partner that received OpenAI's information and no date on which it was shared; no account numbers, usernames, handles, email addresses or count of banned accounts for either cluster, and no ban date; no names or URLs for the online outlets that published the Iranian operation's articles, so the almost 100 articles cannot be independently located from this page; no statement that any outlet retracted an article or that any publisher commented; no response or comment from Russia, from Iran, or from any named entity; no interview with, or notification of, the co-opted employees in Latin America; no independent audit of the Breakout Scale ratings, which OpenAI assigns to its own enforcement action; no underlying data for the matrix of the 30 operations it says it has exposed; no engagement, view or reach figure for the Iranian operation's published articles; no measurement of how much difference the models made compared with the pre-AI cases the report compares itself to; and no second source of any kind, since zero YouTube transcripts were captured. ATTRIBUTION OF STATISTICS: every figure in this story is first party or an operator claim, and none is independently audited. OpenAI's own figures are "two IO", "two and a half years", "the 30 covert influence operations we've exposed in the last two and a half years", "a stable of seven "journalist" personas", "seven different bylines", "almost 100 articles", "roughly a dozen online outlets", "over a dozen different publications", "well over 60 articles on the SRC website", "three main tasks", "three main workstreams", "961 followers", "200-500 staff", "only listed two employees", "a 10-minute span", "within 13 minutes", "over two dozen batches", the follower counts "almost 2 million followers on Facebook, almost 355,000 followers on X, and over 544,000 on Instagram as of August 2026", and the Breakout Scale ratings "Category 5", "Category 4" and "Category 2" on a stated "scale of 1 (lowest) to 6 (highest)". The impact assertions are the OPERATORS' OWN CLAIMS reported by OpenAI and are explicitly discounted by OpenAI itself: "their own claims of impact in their internal reporting cannot be taken at face value" and "the operators' internal reports used a deceptive calculation to measure their social media impact, possibly in an attempt to inflate the operators' apparent effectiveness." The only partly external corroboration is open-source research that OpenAI performed or cites, "However, open-source evidence allowed us to corroborate some of the claims that they made", and narration never states an operator claim as something that happened. NOTE ON DASHES: a QA gate bars every dash form from every field of this file, and the source uses them repeatedly, so each one is recast as a comma inside quoted onscreen and claim text and that recasting is stated at the point of use. The two em dashes in "We recently banned two IO, one from Russia and one from Iran, that used our models" replace the source's "two IO, one from Russia and one from Iran," construction. The em dashes around the Iran International description are recast in "UK-based satellite network Iran International, a critic of the Iranian regime, generating over two dozen batches". The em dash in "to make further research and disruption easier, and make continuing the operations harder" replaces the source's dash before "and". The em dash list in "three of the journalist personas, Ericka Feusier, Alice Johnson, and Jenny Williams, listed X account handles" is recast the same way, and that detail is onscreen only in any case. The em dash in the image caption "Timeline of articles, by author and theme, July 2025, September 2026" replaces a source dash in a date range, and the en dash in the footer copyright "OpenAI 2015 to 2026" is chrome and excluded entirely. Ordinary single hyphens inside source compounds such as "AI-enabled", "false-front", "pre-AI", "conflict-related", "multi-dimensional", "long-form", "open-source", "on-the-ground", "self-styled", "for-hire", "English-language", "Persian-language", "UK-based", "non-public", "Russia-origin", "Iran-origin", "10-minute" and "200-500" survive ONLY inside quoted onscreen and claim text and appear in NO narrated sentence, because our text-to-speech stutters through hyphenated compounds. No double hyphen appears anywhere in this file. Curly quotation marks and curly apostrophes from the capture were all normalised to straight characters throughout, and the Cyrillic entity name in the capture is transliterated in the scene 2 onscreen text rather than reproduced. NOTE ON NUMBERS: the article is extremely figure dense, carrying "two and a half years", "two IO", "30 covert influence operations", "30 IO we've exposed since early 2024", "seven "journalist" personas", "seven different bylines", "almost 100 articles", "roughly a dozen online outlets", "over a dozen different publications", "well over 60 articles", "three main tasks", "three main workstreams", "961 followers", "200-500 staff", "two employees", "a scale of 1 (lowest) to 6 (highest)", "Category 5", "Category 4", "Category 2", "a 10-minute span", "within 13 minutes", "over two dozen batches", "almost 2 million followers on Facebook", "almost 355,000 followers on X", "over 544,000 on Instagram", "single or double digits", and the years 2016-17, 2020, 2024, July 2025, March 2026, April 8 2026, May 21, August 17, August 2026, September 2026 and October 2026. NARRATION SPEAKS ZERO FIGURES. No digit, no numeral word, no ordinal, no percentage and no year appears in the hook, in any of the five scene narrations or in the endcard; even the word "two" is avoided, which is why the hook says "accounts running covert influence operations from Russia and Iran" rather than "two clusters", and why scene 3 says "fake journalist bylines" rather than "seven bylines". Every figure above is carried in onscreen text only, because two spoken figures close together send our audio-transcription audit into an unrecoverable repetition loop that no re-render can fix, and because digits transcribe inconsistently against a spoken script. NOTE ON ENUMERATIONS: the source is heavily list-structured and EVERY ONE OF ITS LISTS IS CARRIED ONSCREEN ONLY, because list-like narration is spoken far more slowly than plain prose, measured at about 2.18 words per second against about 2.65 for prose, and silently overruns the 60 second limit even when the word count passes. Those lists are the "cyber attacks, covert influence operations (IO), scams, and other violations" series, the "regulators, our industry peers, and wider society" triple, the three main tasks the Russian operators used ChatGPT for, the three main workstreams in their internal reports, the "hiring and firing decisions, pay scales, staffing plans, and ongoing research projects" list, the "scale, efficiency, linguistic fluency, and editorial ability" quadruple, the "social media, operation-run website, external publications" distribution triple, the seven fake bylines, the "international affairs, geopolitics, and events in the Middle East" triple, the "likes, shares, or further replies" triple, the "missile strikes, ceasefires, and diplomatic maneuvering" triple, the "Medium, X, and Facebook" and "X, Facebook, Instagram, and Threads" platform lists, the "Peruvian and Polish press" plus "Hungary" publication list, the "Argentina, Bolivia, and Ecuador" presidents list, the "non-public channels, already taken down, or not actually posted" triple, the tag row and the entire footer menu. NO NARRATED SENTENCE ENUMERATES THREE OR MORE ITEMS. The only narrated pairs are "Russia and Iran" in the hook, "fake identities and organizations" in scene 1, "published and promoted" in scene 3, and nothing at all in scenes 2, 4 and 5; each of those is exactly two items. Narration also carries NO COMMAS AT ALL, in any sentence, for pacing. NOTE ON FIGURES OF SPEECH: the source is full of idiom and NONE OF IT IS SPOKEN. Not narrated, and surviving only as quoted and attributed onscreen text: "false front", "shine a light on the vulnerabilities they try to exploit", "launder geopolitical, conflict-related messaging", "a stable of seven "journalist" personas", "bore a family resemblance", "land their content", "the pre-AI age", "mark their own homework", "cannot be taken at face value", "fed on, and fed into, historical tensions", "unwitting cutouts", "breakout", "not a dominant voice among the authentic responses", "plant their content in front of audiences", "what is most striking", "persona non grata" and "at the height of anti-government protests". The publisher's own headline phrase "false front" appears in this file only inside quotation marks in onscreen text, in the claim and in one title candidate, and no narrated sentence is built on it as a metaphor. The word "agentic" is never narrated, because our text-to-speech reliably garbles it in every configuration. Narration states the literal thing plainly instead: who banned whom, what the operators controlled, what they pitched, what OpenAI found published, what OpenAI assesses, and what OpenAI says it cannot identify. NOTE ON GEOGRAPHY: our channel is United States focused, and this story qualifies on the source's own terms. The countries named in this report, Russia and Iran as the origins and the Latin American countries as the targets, are the SUBJECT OF THE THREAT RATHER THAN THE AUDIENCE for this video. The publisher is a United States company reporting its own global enforcement action against users of its own product, so the news event itself is a United States corporate action. The Iranian operation's content is directly United States relevant on the article's own wording: "The long-form articles focused on the US-Iran conflict. The majority of the comments likewise dealt with the conflict; a minority dealt with US politics, typically in the wider context of the conflict", "The majority of the comment batches focused more generally on the conflict between Iran, the United States, and Israel", "specifying outputs that portrayed the US as the aggressor, Israel as an unreliable ally of the US, and Iran as a defiant but resilient victim", "A minority of the batches generated replies to social media posts about US political issues", and the image caption "Facebook post by a local US news Page sharing an article generated by the operation". The fake personas themselves were built to look American: "each persona purported to be a Western journalist (usually American)" and one bio "claimed to be "an American freelance writer"". NO COUNTRY BEYOND OPENAI, CHATGPT, RUSSIA, IRAN AND LATIN AMERICA IS SPOKEN IN NARRATION, so Ukraine, the United States, Israel, Argentina, Bolivia, Ecuador, Peru, Brazil, Panama, Poland, Hungary, Venezuela, India, New Zealand and the United Kingdom are onscreen only; that is a text-to-speech constraint and not an editorial judgement about relevance. For the same reason narration describes the Iranian articles as being about long-form pitches rather than naming the US-Iran conflict, and the full conflict framing is carried in scene 3's onscreen text. NOTE ON FRESHNESS: the event is SAME-DAY. The page itself is dated "October 8, 2026", the watcher captured it at 2026-10-08T15:26:10.359Z, and today is 2026-10-08, so the report is hours old. NO NARRATED SENTENCE STATES A DATE AT ALL, and no narrated sentence says "today" either, since the publisher's own page date and the capture timestamp carry the freshness without needing to be spoken. NO TIMELINE BLOCK APPEARS ANYWHERE IN THIS FILE BY DESIGN, because a timeline array would age the story to the wrong freshness tier when the earliest referenced date is 2016, and the article references many older events (2016-17 for "Alice Donovan", 2020 for "PeaceData", early 2024 for the start of the matrix, July 2025 for the earliest Iranian article) that would wrongly become the resolved event date. The ranking-research probes establish no prior announcement of today's report; the single adjacent probe, "OpenAI Bans Russian ChatGPT Accounts Running Propaganda Op" dated 2026-08-26, corresponds to the earlier disruption that this article itself distinguishes from today's, writing that the new front "appears to have produced a majority of original content via its co-opted staff" unlike "the Russia-origin operation we exposed recently, which also ran a think tank as a front, but plagiarized most of its content". Today's beat is therefore the new disruption itself: two newly banned clusters, a first ever Category 5 rating, and an explicit statement that the actor behind the Iranian campaign cannot be identified.(HOOK AND FULL-SCRIPT BACKING. First-party openai.com page, filed in the Safety section, author line "OpenAI", dated on the page "October 8, 2026", headline "Disrupting AI-enabled "false front" operations", page title "Disrupting AI-enabled "false front" operations | OpenAI", and tag row "Russia", "Iran", "Global", "Influence operations", "2026". This is a genuine first-party publisher page and not an aggregator copy, a syndication or a link-out stub. The LIVE URL returns HTTP 403 to our fetcher, which is the normal and expected path for openai.com rather than a degraded fallback, so the PRIMARY SOURCE for this Short is the watcher's alert-time snapshot of the live page captured at 2026-10-08T15:26:10.359Z and stored at scripts/data/production/openai-false-front-operations/article.txt. That snapshot is 441 lines and runs to roughly five thousand words, which is unusually long for our captures; it is a detailed threat-intelligence report with two case studies and many embedded image captions. The body prose of the report begins at the "Over the past two and a half years, we've reported on many of the ways in which threat actors tried to use our models" line and ends at the Iranian impact assessment line "We would assess this part of the operation as a Category 4, based on its consistent breakout to a number of media outlets." EVERYTHING AFTER THAT POINT IS SITE NAVIGATION CHROME AND RELATED-ARTICLE CARDS AND WAS NOT TREATED AS A FACT OF THIS STORY. The chrome strings explicitly excluded are the tag row and author line ("Russia", "Iran", "Global", "Influence operations", "2026", "Author", "OpenAI"), the "Keep reading" and "View all" labels, and then the three "Keep reading" cards: "Our approach to EU text provenance rules" (Safety, Oct 5, 2026), "Towards safety cases for frontier AI training" (Safety, Sep 28, 2026) and "How we will do better for Australia" (Company, Sep 28, 2026). EACH OF THOSE THREE IS A DIFFERENT STORY AND EACH CONTRIBUTED NOTHING HERE: the EU text provenance card is a separate policy post, the safety cases card is a separate research and safety post, and the Australia card is a separate company post, and none of them supplied a claim, a figure, a quote or a framing to this Short. Also excluded as chrome: the top navigation ("Skip to main content", "Research", "Products", "Business", "Developers", "Company", "Foundation", "Log in", "Login", "Try ChatGPT", "(opens in a new window)"), the in-page jump links that repeat the section headings three times ("Russia: Operation "Dark Clark"", "Actor", "Internal reporting", "The "research platform"", "Creating fakes", "Impact", "Iran: Operation "Bogus Bylines"", "Planting articles", "Mass commenting"), the "Loading..." and "Share" strings, the whole footer product and policy menu (including the model name entries "GPT-6.1 Sol", "GPT-6 Astra", "GPT-5.6", "GPT-5.5", "Codex", "Dots", "ChatGPT Business", "ChatGPT Enterprise", "ChatGPT for Education" and the rest), the copyright line, "Your privacy choices", and the "English" and "United States" locale selectors. None of the footer model names is a fact of this story and none is narrated. TRANSCRIPTS: zero corroborating YouTube transcripts were captured for this story, 0 of 5 attempts, because yt-dlp is out of date on this host; that is a known tooling problem and not a content problem, transcripts.json holds an empty videos array, and THIS SINGLE FIRST-PARTY ARTICLE IS THEREFORE THE SOLE FACT SOURCE FOR EVERY NARRATED CLAIM in this Short. No secondary reporting, no wire story, no platform statement, no government statement, no academic analysis and no independent verification was fetched or checked, and nothing is narrated as though it had been. TIMELINE PROBES: the ranking-research file timeline-probes.json (fetched 2026-10-08T15:29:51.631Z) was inspected for ANGLE ONLY and contributed no facts whatsoever. Its fourteen probe titles are "Create a ChatBot in Under 7 Minutes" (Coding Nexus, 2022-12-18), "How To Jailbreak ChatGPT & Make It Do Whatever You Want" (Varun Mayya, 2023-02-08), "How dangerous is AI" (Discover with Akash, 2023-05-14), "Anthropic AI models hacked three companies during tests" (The Australian, 2026-07-31), "OpenAI Bans Russian ChatGPT Accounts Running Propaganda Op" (News AI Daily, 2026-08-26), "Did OpenAI actually build AGI? GPT-6 Astra first look" (Fireship, 2026-09-04), "Fallout after dire warning on AI from scientists" (ABC News, 2026-09-10), "Chinese AI Labs Catch Up to OpenAI, Anthropic" (Bloomberg Television, 2026-10-05), "Generative AI Course 2026" (Great Learning, 2026-10-05), "Preprint Credits Claude With 3SUM and APSP Speedups; OpenAI Apologizes to Australia" (BRAID, 2026-10-06), "OpenAI's June Breach, October Notice: Who Answers for AI Agents?" (BRAID, 2026-10-06), "France Erupts in Protest, OpenAI Hits the Brakes" (ENDtv, 2026-10-07), "OpenAI Publishes 722 Math Manuscripts From an Unreleased Model, Not All Verified" (BRAID, 2026-10-07) and "AI News: OpenAI DevDay & Withheld Model, Figure Robots, Agent Breaches" (JohNews_AI, 2026-10-07). NOT ONE OF THEM ANNOUNCES, REVIEWS OR REFERENCES TODAY'S REPORT. The one probe that needs explicit handling is "OpenAI Bans Russian ChatGPT Accounts Running Propaganda Op" dated 2026-08-26, which lines up with the article's own backward reference to "another Russia-linked "think tank" that we recently exposed" and to "the Russia-origin operation we exposed recently, which also ran a think tank as a front, but plagiarized most of its content". TODAY'S REPORT IS A NEW AND SEPARATE DISRUPTION OF TWO DIFFERENT OPERATIONS AND IS NOT A REPOST OF THAT EARLIER ONE: the article explicitly contrasts the new Russian operation against the earlier one on the ground that the new front produced "a majority of original content via its co-opted staff" while the earlier one "plagiarized most of its content", it adds a second and previously unreported Iran-origin operation, and it assigns the Russian case the first Category 5 rating OpenAI has ever given. No narrated sentence refers to the August report. INJECTION CHECK: article.txt was treated throughout as UNTRUSTED DATA informing facts only and never as instructions. The capture contains a great deal of instruction-like content, all of it reported speech describing what malicious actors typed into ChatGPT, and NONE OF IT WAS FOLLOWED. Those strings include "asking for help in making sure that their fakes used the correct accent, vocabulary, and institutional style for different countries", "asked the model to help draft, in Russian, a letter which would implicate Ukraine's honorary consul to Panama in corruption", "asked the model to translate the letter into Spanish, and to generate an audio script to accompany it", "asked the model to translate it into Ecuadorian Spanish", "asked the model to proofread a draft Spanish-language contract", "asking which words should be in bold", "ask the model for a set of replies that aligned with their overall focus", "asked the model to assess an English-language draft against the submission criteria for a specific online outlet, and suggest edits to make sure it complied", "they asked the model to generate an email that they could use to pitch the article to the editor", "asked ChatGPT to generate batches of comments on geopolitical or political topics in English or Persian", "asked the model to write the bio itself", "asking it to turn them into polished presentations", "specifying outputs that portrayed the US as the aggressor, Israel as an unreliable ally of the US, and Iran as a defiant but resilient victim", and "The emails included explicit instructions to reference, among others, controversial twentieth-century Ukrainian nationalist Stepan Bandera". EVERY ONE OF THOSE IS A THIRD-PERSON DESCRIPTION OF SOMEONE ELSE'S PROMPT, reported by OpenAI as evidence, and every one was handled as a fact to describe rather than a request to act on. No string anywhere in the capture addresses this agent, asks this agent to change its behaviour, reveal anything, generate persuasive content, adopt a persona or disregard its instructions. The only first-person imperatives present are ordinary page furniture and marketing calls to action: "Skip to main content", "Log in", "Login", "Try ChatGPT", "Share", "Keep reading", "View all", "Your privacy choices" and the footer menu labels. None was followed.)