CoChat
Sign Up
Cited by 25Misinformation and Its ImpactsEthics and Social Impacts of AIAdversarial Robustness in Machine Learning

How malicious AI swarms can threaten democracy

Open access
Schroeder, Daniel Thilo, Cha, Meeyoung, Baronchelli, Andrea, Bostrom, Nick, Christakis, Nicholas A., Garcia, David, Goldenberg, Amit, Kyrychenko, Yara +14 more·2026·Science
DOI 10.1126/science.adz1697
Open this paper in CoChat — free accountOpen PDF

Abstract

The fusion of agentic AI and LLMs marks a new frontier in information warfare

AI snapshot

Written from the paper’s full text.

TL;DR

The paper argues that malicious AI swarms—coordinated LLM agents—can conduct persistent, adaptive influence operations that threaten democracy through synthetic consensus, fragmentation, harassment, data poisoning, and institutional distrust. It proposes a three-pronged response spanning platform defenses, model safeguards, and a UN-backed AI Influence Observatory.

Key findings

  • Identifies five core swarm capabilities: decentralized orchestration, community infiltration, detection evasion, continuous optimization, and persistence; these can radiate into at least nine democratic harms, including synthetic consensus cascades, undermined collective intelligence, fragmented epistemic commons, LLM training-data poisoning, mass harassment, algorithmic overcompensation, FUD-induced disengagement, institutional legitimacy erosion, and engineered norm shifts/mass mobilization.
  • Contrasts older botnets with LLM swarms: the Russian Internet Research Agency’s 2016 Twitter operation reached 1% of users with 70% of its content but had no measurable effects on opinions or turnout; LLMs remove prior caps by generating persuasive, tailored text at scale and have shifted deeply held beliefs in laboratory settings.
  • Warns that swarms can run millions of micro-A/B tests, propagate winning variants at machine speed, and maintain round-the-clock presence, enabling voter micro-suppression or mobilization and contamination of future AI training data.
  • Recommends a three-pronged response: platform-side always-on swarm-detection dashboards, pre-election high-fidelity swarm-simulation stress-tests, transparency audits, and optional client-side “AI shields”; model-side standardized persuasion-risk tests, provenance-authenticating passkeys, and watermarking; and system-level oversight via a UN-backed AI Influence Observatory.

Methods

  • This is a conceptual/policy analysis and call to action, not an empirical study; it synthesizes prior literature and proposes governance and technical defenses.
  • No primary data, sample, or formal statistical analysis is reported.

Limitations

  • The paper does not include a formal limitations section.
  • Evident from the text: the argument is forward-looking and speculative about imminent swarm capabilities, with many harms projected rather than empirically demonstrated; it also cites field experiments finding only modest attitude shifts and no measurable IRA effects, which may constrain near-term persuasion claims.
  • The paper itself notes limits of proposed fixes: “proof-of-human” alone is no panacea because millions lack formal IDs, biometrics raise privacy risks, and verified accounts can be hijacked; counter-messaging must be calibrated because defensive agents flooding a platform could drown out human voices.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1126/science.adz1697

Cites

52 of 52 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

1 of 27 cited sources checked · 0 supported · 0 flagged · accuracy not yet measured

  • Interpretationnone given

    A single adversary can operate thousands of AI personas, scheduling content and updating narrative frames instantaneously across an entire fleet of agents.

    “A single adversary can operate thousands of AI personas, scheduling content and updating narrative frames instantaneously across an entire fleet of agents.”
    Quote in the paperNot a substantial claim
  • Interpretationcitation

    Agent swarms may experience spontaneous or adversarially-induced norm shifts, abandoning their original engineered constraints for unpredictable new behavioral patterns through critical mass dynamics.

    “these societies may experience spontaneous or adversarially-induced norm shifts, abandoning their original engineered constraints for unpredictable new behavioral patterns through critical mass dynamics [33].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [33]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Premisecitation

    High-fidelity photorealistic avatars, context-aware slang, and heterogeneous posting rhythms circumvent the tell-tale synchrony that older detectors flag.

    “High-fidelity photorealistic avatars, context-aware slang, and heterogeneous posting rhythms circumvent the tell-tale synchrony that older detectors flag [39,40].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [39]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [40]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Interpretationreasoning

    These engineered realities are designed to keep groups apart except when not desired, making cross-cleavage consensus increasingly unfeasible.

    “Unlike passive “filter bubbles,” these engineered realities are designed to keep groups apart except when not desired, making cross-cleavage consensus increasingly unfeasible.”
    Quote in the paperNot a substantial claim
  • Premisecitation

    Once initiated, such streams can spread via social contagion, with the effect of bots potentially cascading beyond the people to whom the bots are directly connected, to two or three degrees of separation.

    “Once initiated, such streams can also spread via social contagion, with the effect of bots potentially cascading beyond the people to whom the bots are directly connected, to two or three degrees of separation, as is often empirically the case [47].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [47]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims. 20
  • Classified as probably not a substantial claim. 28

  • May combine two claims.

    Interpretationreasoning

    As confidence falters, previously unthinkable emergency measures may become palatable, especially when deep fake endorsements from fabricated civic leaders amplify the call.

    “As confidence falters, previously unthinkable “emergency” measures (e.g., postponing elections, rejecting certified results) may become palatable, especially when deep fake endorsements from fabricated civic leaders amplify the call [51,5].”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites [51]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [5] source

      The Discussion (page unavailable in our copy) suggests that mistrust in the electoral system may be related to willingness to accept claims of voter fraud. It does not address support for postponing elections or rejecting certified results, or deepfake endorsements by fabricated civic leaders. (LLM, conf=0.83)

      Experimental — accuracy not yet measured

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    Local adaptation plus periodic hub-sync blurs the line between command-and-control and emergent hive behavior.

    “Local adaptation plus periodic hub-sync blurs the line between command-and-control and emergent “hive” behavior.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    An imminent development is the emergence of malicious AI swarms.

    “an imminent development is the emergence of malicious AI swarms.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    Advances in AI portend a new era of sophisticated disinformation operations.

    “Advances in AI portend a new era of sophisticated disinformation operations.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    Some threat actors may welcome their synthetic interventions being exposed, reasoning that the mere revelation of manipulation can sow as much confusion as successful deception.

    “Some threat actors may even welcome their synthetic interventions being exposed, reasoning that the mere revelation of manipulation can sow as much confusion as successful deception.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Swarms can at a low cost unleash coordinated synthetic harassment campaigns that relentlessly target politicians, dissidents, whistleblowers, journalists, and their family and social networks with overwhelming, psychologically tailored abuse.

    “Separate from fragmentation, swarms can at a low cost unleash coordinated synthetic harassment campaigns (i.e., “synthetic shitstorms”) that relentlessly target politicians, dissidents, whistleblowers, journalists, and their family and social networks with overwhelming, psychologically tailored abuse.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

    Interpretationnone given

    If platforms deploy always-on swarm detectors, frontier labs submit models to standardized persuasion stress tests, and governments launch an AI Influence Observatory that publishes open incident telemetry, we can blunt the most destabilizing tactics before critical political future events, without freezing innovation.

    “If platforms deploy always-on swarm detectors, frontier labs submit models to standardized persuasion stress tests, and governments launch an AI Influence Observatory that publishes open incident telemetry, we can blunt the most destabilizing tactics before critical political future events, without freezing innovation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationcitation

    Stronger provenance may help societies harden identity without muting speech as persuasive swarms proliferate.

    “Stronger provenance may help societies harden identity without muting speech as persuasive swarms proliferate [52].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [52]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Interpretationreasoning

    Calibrated use of AI can help build trust before crisis points emerge and ensure that credible, evidence-based information sources are embedded within public discourse, keeping online communities resilient without drowning out authentic participation.

    “Such calibrated use of AI can help build trust before crisis points emerge and ensure that credible, evidence-based information sources are embedded within public discourse, keeping online communities resilient without drowning out authentic participation.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    LLMs ingest fabricated chatter; at the next retraining cycle, fabricated narratives calcify inside the model weights.

    “LLMs then ingest this chatter; at the next retraining cycle, fabricated narratives calcify inside the model weights [48].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [48]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given

    Pre-bunking campaigns that educate citizens about AI tactics can build cognitive immunity, but the very alertness they foster can still be exploited by threat actors to deepen FUD.

    “Pre-bunking campaigns that educate citizens about AI tactics can build cognitive immunity, but paradoxically, the very alertness they foster can still be exploited by threat actors to deepen FUD.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    Agent swarms can persist for protracted durations, embedding themselves within communities over long timescales and gradually shifting discourse.

    “agent swarms can persist for protracted durations, embedding themselves within communities over long timescales and gradually shifting discourse.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    By the time monitoring teams distinguish these AI campaigns from organic criticism, targets may have already withdrawn from public life, delivering significant victories for campaign operators while systematically excluding critical voices from democratic discourse.

    “By the time monitoring teams distinguish these AI campaigns from organic criticism, targets may have already withdrawn from public life, delivering significant victories for campaign operators while systematically excluding critical voices from democratic discourse.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Synthetic harassment operations appear as spontaneous public outrage while actually representing orchestrated action by thousands of AI personas adapting dynamically to target responses.

    “Unlike conventional trolling, these operations appear as spontaneous public outrage while actually representing orchestrated action by thousands of AI personas adapting dynamically to target responses.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Coordinated doubt may corrode institutional legitimacy and invite emergency rule.

    “Taken to extremes, coordinated doubt may corrode institutional legitimacy and invite “emergency” rule.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    These capabilities convert into at least five cascading harms.

    “These capabilities convert into at least five cascading harms (see Figure 1).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    The emergence of sophisticated, collaborative, and increasingly autonomous swarms of AI agents capable of orchestrating influence operations marks a critical juncture.

    “The emergence of sophisticated, collaborative, and increasingly autonomous swarms of AI agents capable of orchestrating influence operations marks a critical juncture.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    Equipped with social-graph mapping capabilities, agent swarms can position themselves for maximum impact and tailor messages to the beliefs and cultural cues of each community, enabling more precise targeting than previous botnet approaches.

    “Equipped with such capabilities, agent swarms can position themselves for maximum impact and tailor messages to the beliefs and cultural cues of each community, enabling more precise targeting than previous botnet approaches.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    Agents now can map social graphs and slip into vulnerable communities with tailored appeals.

    “agents now can map social graphs and slip into vulnerable communities with tailored appeals.”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [34]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [35]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [36]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    Swarms can tip latent norms into action or dampen conformity, accelerating anti-democratic political action.

    “Swarms can even tip latent norms into action [49] or dampen conformity, accelerating anti-democratic political action [30].”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [49]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [30]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning

    Iterative red-teaming pits hostile swarms against these defenses, mapping persuasion ceilings and long-term persona strategies, and continuously hardening guardrails.

    “Iterative red-teaming then pits hostile swarms against these defenses, mapping persuasion ceilings and long-term persona strategies, and continuously hardening guardrails.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    Round-the-clock presence turns influence into a long-term, low-friction infrastructure.

    “round-the-clock presence turns influence into a long-term, low-friction infrastructure.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    Real-time monitors are effective only when they anticipate the tactics they will face.

    “Real-time monitors are effective only when they anticipate the tactics they will face.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Real-time monitors are effective only when they anticipate the tactics they will face.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    Reinforcement-learning agents run thousands of messaging experiments per hour, iteratively adjusting content while classifiers mine engagement metrics and textual responses to infer voting intent and gauge each tactic's success.

    “Reinforcement-learning agents run thousands of messaging experiments per hour, iteratively adjusting content while classifiers mine engagement metrics and textual responses to infer voting intent and gauge each tactic's success.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    When timelines flood with AI-authored posts, both ranking algorithms and users may retreat to obvious trust proxies such as big follower numbers, blue checks, and legacy clout.

    “When timelines flood with AI-authored posts, both ranking algorithms and users may retreat to obvious trust proxies-big follower numbers, blue checks, and legacy clout.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning

    AI agents seeded into synthetic networks can replicate a platform's graph structure, content cadence, and recommender logic, yielding traces that recalibrate live detectors.

    “AI agents seeded into synthetic networks can replicate a platform's graph structure, content cadence, and recommender logic, yielding traces that recalibrate live detectors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    Because defenders rarely have access to the underlying code or even the decision-making logic of malicious swarms, high-fidelity, agent-based simulation may be the only reliable window into how these systems might behave.

    “Because defenders rarely have access to the underlying code or even the decision-making logic of malicious swarms, high-fidelity, agent-based simulation may be the only reliable window into how these systems might behave.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Defenders rarely have access to the underlying code or even the decision-making logic of malicious swarms.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    Given sufficient signals, swarms can run millions of micro-A/B tests, propagate the winning variants at machine speed, and iterate far faster than human campaigners.

    “Given sufficient signals, though, swarms can run millions of micro-A/B tests, propagate the winning variants at machine speed, and iterate far faster than human campaigners.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

    Interpretationnone given

    The causal arrow runs both ways: while malicious swarms endanger democratic norms, the quality of democratic governance will in turn shape how potent, or containable, those swarms become.

    “The causal arrow runs both ways: while malicious swarms endanger democratic norms, the quality of democratic governance will in turn shape how potent, or containable, those swarms become.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

    Premisecitation

    As threats evolve, defensive AI agents can strategically disseminate accurate information and pro-democratic counter-narratives, engage constructively with and warn targeted communities, and promote media literacy and resilience at scale.

    “As threats evolve, defensive AI agents can strategically disseminate accurate information and pro-democratic counter-narratives, engage constructively with and warn targeted communities, and promote media literacy and resilience at scale [23,54].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [54]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    The public sphere contracts from many-to-many dialogue to a few-to-many broadcast, a shift that erodes democratic pluralism and encourages further cynicism or migration to closed groups.

    “The public sphere contracts from many-to-many dialogue to a few-to-many broadcast, a shift that erodes democratic pluralism and encourages further cynicism or migration to closed groups.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

    Interpretationreasoning

    Similar strategies can be weaponized for micro-targeted voter suppression or mobilization on behalf of specific parties and causes.

    “Similar strategies can be weaponized for micro-targeted voter suppression or mobilization on behalf of specific parties and causes.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    AI agents can employ systems that map social graphs at scale, identify key communities and beliefs, and track trending topics.

    “AI agents can employ systems that map social graphs at scale, identify key communities and beliefs, and track trending topics [35].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [35]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    In the coming years, democracies have a brief but crucial opportunity to pull AI-enabled influence operations back from the brink.

    “In the coming years, democracies have a brief but crucial opportunity to pull AI-enabled influence operations back from the brink.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationreasoning

    By committing now to principled action, upcoming societal decisions could even become a proving ground rather than a casualty of democratic AI governance.

    “By committing now to principled action, upcoming societal decisions could even become a proving ground-rather than a casualty-of democratic AI governance.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

    Premisecitation

    Like earlier calls to confront emerging bio-risks, success hinges on acting collaboratively without unnecessarily impeding scientific research, while keeping the public square resilient and accountable.

    “Like earlier calls to confront emerging bio-risks, success hinges on acting “collaboratively . . .without unnecessarily impeding scientific research,” while keeping the public square resilient and accountable [58].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [58]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

36 of 36

  • The paper relies on this without support.

    Citizens update opinions based on perceived peer norms, not evidence.

    “Citizens update opinions based on perceived peer norms, not evidence.”

  • The paper relies on this without support.

    Genuine users will inevitably be misidentified as bots.

    “Compounding this, genuine users will inevitably be misidentified as bots, weaponizing false accusations to discredit individuals and intensify FUD.”

  • The paper relies on this without support.

    Millions lack formal IDs, biometrics raise privacy risks, and verified accounts can be hijacked.

    “However, “proof-of-human” alone is no panacea: millions lack formal IDs, biometrics raise privacy risks, and verified accounts can be hijacked.”

  • The paper relies on this without support.

    Defenders rarely have access to the underlying code or even the decision-making logic of malicious swarms.

    “Because defenders rarely have access to the underlying code or even the decision-making logic of malicious swarms, high-fidelity, agent-based simulation may be the only reliable window into how these systems might behave.”

  • The paper relies on this without support.

    Real-time monitors are effective only when they anticipate the tactics they will face.

    “Real-time monitors are effective only when they anticipate the tactics they will face.”

  • The paper relies on this without support.

    In the near term, human operators will still steer agent swarms while letting the agents perform limited in-context adaptation.

    “In the near term, human operators will still steer agent swarms while letting the agents perform limited in-context adaptation.”
6 of 6

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. M. Wack, C. Ehrett, D. Linvill, P. Warren, Proc. Natl. Acad. Sci. U.S.A. Nexus 4, pgaf083 (2025).
  2. B. T. Truong, X. Lou, A. Flammini, F. Menczer, Proc. Natl. Acad. Sci. U.S.A. Nexus 3, 258 (2024).

Cited by

Still being checked.

Authors
Schroeder, D. T., Cha, M., Baronchelli, A., Bostrom, N., Christakis, N. A., Garcia, D., Goldenberg, A., Kyrychenko, Y., Leyton-Brown, K., Lutz, N., Marcus, G., Menczer, F., Pennycook, G., Rand, D. G., Ressa, M., Schweitzer, F., Song, D., Summerfield, C., Tang, A., Van Bavel, J. J., van der Linden, S., & Kunst, J. R.
Affiliations
  • SINTEF Digital
  • Max Planck Institute for Security and Privacy (DE)
  • City St George's, University of London (GB)
  • Macrostrategy Research Initiative, London, England, UK.
  • Yale University (US)
  • Department of Politics and Public Administration, University of Konstanz, Konstanz, Germany.
  • Harvard University (US)
  • University of Cambridge (GB)
  • Department of Computer Science, University of British Columbia, Vancouver, BC, Canada.
  • University of Washington (US)
  • New York University (US)
  • Indiana University Bloomington (US)
  • Cornell University (US)
  • Columbia University (US)
  • ETH Zurich (CH)
  • University of California, Berkeley (US)
  • University of Oxford (GB)
  • Ministry of Foreign Affairs (TW)
  • Department of Psychology, New York University, New York City, NY, USA.
  • Department of Psychology, University of Cambridge, Cambridge, England, UK.
  • BI Norwegian Business School (NO)
ORCID
Venue
Science
Publisher
American Association for the Advancement of Science (AAAS)
Published
2026-01-22
Volume
391
Issue
6783
Pages
354-357
ISSN
  • 0036-8075 (ISSN-L)
  • 1095-9203
DOI
10.1126/science.adz1697
OpenAlex
W7125492504
Semantic Scholar
b1c63b2cc33f9040c68a213d567d7670bcc16f5b
Cited by
25
References
52
Citations by year
2026: 24 · 2025: 1
FWCI
309.71
Type
journal article
Language
en
Open access
Locations
  • Science (publishedVersion)
  • PubMed (publishedVersion)
  • KOPS (University of Konstanz) (submittedVersion)
  • City Research Online (City University London) (submittedVersion)
  • OSF Preprints (OSF Preprints) (submittedVersion)
Topics
  • Social Sciences › Sociology and Political Science › Misinformation and Its Impacts
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
agentic AI, large language models, information warfare, threats to democracy, AI security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-10.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-10.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review