Operation “A2Z”: Multilingual influence activity

This case study was originally published in OpenAI’s October 2024⁠(opens in a new window) report.

We banned a previously unreported cluster of accounts that were using our API to create comments that were then posted on X and Facebook. Many of these comments praised Azerbaijan or defended its human-rights record, but it also focused on a wide range of other topics, potentially suggesting a commercially run operation. Given the frequency with which it praised Azerbaijan and its attempt to use AI through multiple phases of the operation, we have dubbed this network “A2Z”.

Like the Russian-language Telegram operation that we exposed in May and dubbed “Bad Grammar”, this operation used our models to enable social media commenting. It leveraged AI to manage fake social-media personas, generate bios, analyze posts and comments, draft replies in many languages, and proofread them. The responses were then posted on X or Facebook. Most of the content was in the form of short comments, but it also included stylized images. These often used the style of 1930s posters: as such, they appear designed to attract attention and engagement, rather than to deceive. However, typical posts with these stylized images only received 0–5 engagements each.

This use of AI enabled the operation to manage many social media accounts at once: we identified around 150 accounts across X and Facebook that matched this activity, with more suspected accounts. It also enabled the operation to sometimes engage in comment threads with real people on the internet. Occasionally, we observed short conversations between real people and the fake accounts, where the fakes’ replies were generated using our models.

A pre-AI operation on this scale would likely have required a large team of trolls, with all the costs and leak risks associated with such an endeavor. However, this operation’s reliance on AI also made it unusually vulnerable to our disruption. Because it leveraged AI at so many links in the killchain, our takedown broke many links in the chain at once. After we disrupted this activity in early June, the social media accounts that we had identified as being part of this operation stopped posting throughout the election periods in the EU, UK and France. Some resumed posting in late August. A small number of their posts bore indications that they were likely generated by AI. The content that bore such indications did not come from our models.

This campaign generated short comments that focused on a wide range of political themes. The most prominent was praise for the government of Azerbaijan and its role in domestic, regional and international politics—for example, promoting unity between the countries of Central Asia, or hosting the UN Climate Change Conference. Accounts in English and Italian praised Azerbaijan’s role as an energy supplier to Europe—sometimes in response to criticism of the Azeri government’s human-rights record.

Other strands of activity focused on the benefits and evolution of AI, financial markets, ecological issues, cryptocurrencies, and tech more broadly. One cluster focused on the United Arab Emirates, portraying it as a stable investment destination, and often contrasting this with claims of political instability in the United States.

Some fake personas focused on politics in Europe or the United States. The ideology of this activity varied from region to region. For example, one X account focused on the United States posed as a liberal and criticized former US President Trump, while some Facebook accounts that posted in French criticized President Macron and supported the National Rally (RN) party. Sometimes, this criticism focused on domestic issues to argue that the country in question should not intervene in international issues, including Russia’s invasion of Ukraine.

This operation was highly active on Facebook and X, with likely hundreds of accounts. On X, some of its accounts had the blue checkmark of paid verification. Of the approximately 150 accounts that we sampled across both platforms, we did not identify any with significant numbers of followers: the largest following on X we identified during our investigation was 222 followers, more typical figures were in the mid-teens to low twenties, and typical posts on X received single-digit engagements. Similarly, the highest number of reactions to a Facebook post we observed during our investigation was 36, and more typical figures were in the range of 0-5. However, we did identify some occasions where the operation’s posts attracted replies from real people. These were not always positive, and sometimes included real people contradicting the fake accounts, but they do show at least some ability to engage audiences on multiple platforms, in multiple languages, and on multiple topics.

Using the Breakout Scale to assess the impact of IO, which rates them on a scale of 1 (lowest) to 6 (highest), we would assess this operation as being at the top end of Category Two, with a risk of breaking out into Category Three: it was marked by posting activity on multiple platforms, with some evidence that real people were engaging with its content. However, after we banned this operation from using our models and shared information with industry peers, the social media accounts that we had identified fell silent for many weeks. This operation thus highlights the increased capability that AI usage can give operators, but also the increased vulnerability to disruption that their reliance on an AI model brings.