Iran and China run influence campaigns using autonomous AI that no longer requires human operators

Summary

According to a report corroborated by findings from Recorded Future and RFE/RL, and analyzed by the New York Times, Iran and China have transitioned to fully autonomous AI-driven influence campaigns. In these operations, agents create personas, culturally adapt messages, and adjust content in real time without requiring human operator input for every decision.

Why it matters

This represents a qualitative leap from AI-assisted state disinformation to autonomous AI state disinformation. This transition erases the behavioral and linguistic traces that current detection systems rely on. The structural issue is that commercial large language model (LLM) APIs, which any marketing firm can access, are being turned into attack tools by state actors. Meanwhile, existing regulatory frameworks (such as the EU Digital Services Act and FTC directives) target published content rather than the production pipelines, leaving a significant enforcement gap.

Highlights

• The decision-maker is now autonomy. AI agents complete the disinformation loop without human intervention: creating personas, adapting culturally and linguistically, and adjusting messages in real time based on engagement.
• Defense mechanisms are structurally weak. Watermarking fails because perpetrators can bypass watermarked platforms. Furthermore, the detection arms race favors the attacker, who only needs to succeed once.
• API-level regulation is the least mature defense layer. While OpenAI and Anthropic have disrupted campaigns, reporting is voluntary, standards are lacking, and there is no state mandate covering the production pipelines.

Critical take

This text is more of a synthesis of news from the NYT, Recorded Future, RFE/RL, and OpenAI than an original journalistic piece. It also oversimplifies by grouping very different cases under a single 'autonomous AI' umbrella. For instance, advanced Iranian APT groups and a single Chinese tech company's ChatGPT comment campaign are lumped together. The reference to the 'kill-switch' issue in California also seems like a tangent. Moreover, the article weakens its own thesis by noting that these campaigns operate on standard commercial APIs rather than boundary-pushing models.