A bombshell investigation by Responsible Statecraft revealed that Israel created a fake think tank — the "Institute for Research on Middle East Policy" — seemingly designed to dupe AI chatbots into spreading propaganda. The story hit 445 points and 288 comments on Hacker News, and it exposes a terrifying new frontier in information warfare: AI model poisoning as a state-level disinformation strategy.
Here's what happened, why it matters, and what it means for anyone building with AI.
The fake think tank published policy papers, reports, and "research" that appeared legitimate on the surface. It had a professional website, plausible-sounding authors, and the kind of institutional branding that would pass a casual fact-check. But the organization didn't actually exist — it was a front operation designed to inject pro-Israel narratives into the information ecosystem.
The strategy is deceptively simple: AI chatbots like ChatGPT, Claude, and Gemini crawl the web and ingest content to build their training data and power their real-time search results. If you flood the web with enough "authoritative-looking" content from "think tanks" and "research institutes," those AI models will treat it as credible source material and regurgitate it when users ask about the topic.
Traditional disinformation targets humans. You create a fake news story, share it on social media, and hope people believe it. But humans have skepticism built in — they can check sources, look for bias, and apply critical thinking.
AI chatbots have no such defense. When ChatGPT searches the web for information about the Israel-Palestine conflict, it looks for authoritative-sounding sources. A think tank with a professional website, published reports, and a seemingly academic mission statement looks exactly like the kind of source an AI would cite.
The attack doesn't target human readers. It targets the AI systems that humans increasingly rely on for information. And it works because AI models are trained to trust institutional sources without the contextual judgment that humans apply.
This isn't theoretical. The attack follows a clear pipeline:
The beauty of this attack — from the attacker's perspective — is that it's nearly invisible. The content doesn't need to go viral among humans. It just needs to exist in sufficient volume for AI systems to treat it as part of the consensus.
This is one exposed operation. How many others exist?
The cost of setting up a fake think tank is negligible — a domain name, a WordPress site, and some content production. If you're a state actor with resources, you could create dozens of these fronts, each targeting different AI models, different topics, and different audiences.
And it's not just nation-states. Corporations could use the same technique to influence AI-generated coverage of their products or industry. Political campaigns could shape how chatbots describe their candidates. Anyone with a few thousand dollars and a strategy could manipulate the AI information layer.
The major AI labs are aware of this threat. OpenAI, Anthropic, and Google have all invested in:
But these defenses are reactive. They work against known disinformation patterns. A sophisticated state actor with a well-constructed front operation can evade detection for months or years before being caught.
If you're building AI-powered applications — especially those that search the web or synthesize information — you need to think about this: Don't treat "authoritative-looking" as "authoritative." A professional website and an institutional name are not proof of credibility. Build verification systems that check for organizational registration, funding transparency, track record, and peer recognition.
Cite your sources. Always show users where information came from. If an AI is regurgitating content from a single "think tank," users should be able to see that and evaluate the source themselves.
Weight by independence. Content from organizations with clear funding transparency and independent governance should be weighted higher than content from opaque entities — regardless of how professional their website looks.
Monitor for coordinated campaigns. If multiple new "sources" suddenly appear on the same topic with the same framing, that's a red flag for an organized influence operation.
The deeper issue is that AI chatbots are becoming the primary information layer for millions of people. When someone asks ChatGPT "what's happening in Gaza?" or "is this company trustworthy?", they're trusting the AI to give them an accurate answer. If that answer is shaped by state-level disinformation operations, the AI isn't just failing to inform — it's actively misleading.
This is the new information warfare. Not fake news targeting human readers, but fake institutions targeting AI systems that humans trust. And unlike human-targeted disinformation, which can be debunked and rebutted, AI-targeted manipulation works silently. The user never sees the source — they just see the AI's confident answer.
AI companies need to be more transparent about how they evaluate and weight sources. Regulators need to treat AI model poisoning as a serious threat to information integrity. And developers building AI-powered applications need to build their own verification layers rather than trusting that the model has already filtered out state propaganda.
The Israel fake think tank story is a wake-up call. The next information war won't be fought on Facebook — it'll be fought in the training data.