Analysis of pro-Russia and pro-China inauthentic accounts on X from 2024 to 2026 finds actors are using AI to improve content quality, multilingual reach, and visuals rather than simply increasing volume. According to the GBHackers analysis, a machine-learning pipeline achieved average precision 86% and recall 83%, identifying likely inauthentic accounts; the study reports median post volumes fell roughly 50% between 2024 and 2026 and active account populations remained about 5,000-11,000 per actor group. The GBHackers piece says image usage rose sharply, more than quadrupling for pro-Russia accounts and doubling for pro-China accounts, with a subset of images identifiable as AI-generated. Separately, OpenAI reported, as covered by TIME and NPR/KQED, that it identified and removed five covert influence operations tied to Russia, China, Iran, and Israel that used its tools to generate multilingual text, images, fake bios, and translations. Editorial analysis: For practitioners, detection work must prioritize content provenance, cross-lingual signals, and image forensics rather than relying on volume-based heuristics.
What happened
GBHackers published an analysis of pro-Russia and pro-China inauthentic accounts on X covering 2024 through 2026 that used a machine-learning pipeline combining unsupervised clustering and supervised classifiers trained on human-labeled signals, reporting average precision 86% and recall 83% for likely inauthentic account identification (GBHackers). The GBHackers analysis finds that median posting frequency for these networks fell by roughly 50% between 2024 and 2026 and that the active population of inauthentic accounts remained on the order of 5,000-11,000 per actor group (GBHackers). GBHackers also reports a marked rise in original posts containing images, more than quadrupling for pro-Russia accounts and doubling for pro-China accounts, with a subset of visuals identifiable as AI-generated (GBHackers).
OpenAI, in a public report summarized by TIME and NPR/KQED, reported that it identified and removed five covert influence operations tied to Russia, China, Iran, and Israel that used OpenAI tools to produce social media comments, articles, images, fake account bios, code debugging, and translations; OpenAI analysts concluded these operations did not engage a substantial audience, per TIME and KQED. Ben Nimmo, principal investigator on OpenAI's Intelligence and Investigations team, is quoted in OpenAI's report saying, "Threat actors are using our platform to improve their content and work more efficiently," per TIME.
Editorial analysis - technical context
Industry-pattern observations: The reported shift away from high-volume posting toward higher-quality, multimodal content mirrors a broader trend where adversaries use generative models to maximize persuasive impact while reducing noisy signals that trigger automated moderation. This pattern places more weight on cross-modal and cross-lingual signals (text-image alignment, provenance metadata, translation artifacts) for reliable detection. Practitioners working on platform integrity typically find that classifiers trained only on posting frequency or single-modality features degrade when actors adopt synthetic images and automated translation.
Editorial analysis - methods and limitations
Industry-pattern observations: The GBHackers pipeline combines unsupervised clustering with supervised models and human labeling, a common approach in threat detection. Reported 86% precision and 83% recall indicate good discrimination on labeled test sets, but these metrics depend on label quality and temporal drift; similar systems often require continuous relabeling as adversaries change tactics. The GBHackers findings that accounts were repurposed rather than mass-created suggest entity-resolution and historical account behavior features are valuable signals.
Context and significance
Multiple platform and vendor reports, OpenAI's takedown report and Meta research noted by KQED, converge on a consistent conclusion: generative AI tools are lowering the cost of producing plausible multilingual text and visuals, but so far these specific influence operations struggled to gain authentic engagement. For practitioners, that means the immediate technical challenge is not mitigating volume spikes but improving provenance verification, image forensics, and cross-account attribution at scale.
What to watch
Observers should track three signals:
- •changes in the ratio of synthetic-to-authentic images and the adoption of more photo-realistic fabrication
- •linguistic footprint expansion, including sudden multilingual posting patterns
- •account-reuse behavior where long-lived accounts publish higher-quality synthetic content instead of new-account creation. Also watch for platform disclosures and vendor reports that publish ground-truth datasets or indicators useful for benchmarking detection systems
For practitioners
For practitioners: Investing effort in multimodal provenance pipelines, enhanced image provenance and metadata analysis, and active labeling workflows will likely yield higher detection returns than models focused on posting volume alone. Cross-platform coordination and shared indicators remain important because the same content and personas often appear across X, Telegram, Facebook, and blogs, as noted in OpenAI and reporting (TIME, KQED).
Scoring Rationale #
The story documents measurable changes in adversary tactics that affect detection and moderation pipelines, backed by platform disclosures and an independent analysis. It is notable for practitioners monitoring threat evolution but not a paradigm-shifting development.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.