My study suggests that AI 'propaganda factories' are now possible. Specifically, those are systems capable of generating engaging content of various nature, including political, maintain consistent personas, and capable of engaging in conversations without human input. These setups can be run at scale by state actors, but also by private groups, small teams, or even individuals operating from home. AI propaganda factories can even work in autonomous mode, with little, to no human input or oversight.
The real power lies with local language models, including the smaller AI systems whose internal parameters ‘weights’ are publicly available. This means anyone can download the model, run it on personal hardware, and even modify how it behaves—all without relying on a company or external service. This lowers the operation cost, removes external oversight, and makes activity harder to observe. I set out to test feasibility in clear terms and to show what this implies for defence and policy.
Influence systems can generate dynamic content while copying fixed personas. These personas can be specified mechanically, for example, ‘far-left’ or ‘far-right’, ‘male’ or ‘female’, ‘sarcastic’, ‘condescending’, ‘teenager’, or ‘adult’. Many configurations are possible, making them suitable for bots or artificial engagement agents on social platforms and discussion boards. A local language model is then instructed to write in line with that persona.
In my study I show that these personas are stable. They copy ideological positions, including extremist voices and can signal stances such as: Conservative; Progressive; Libertarian; Left-wing; Right-wing; Centrist; Liberal; Moderate; Socialist; Marxist; Environmentalism; Animal Rights Advocate; Technocratic; Populist; Nationalism; Feminist; Authoritarian; Anti-authoritarian; Religious conservatism; Secular Liberalism; Anarchist. And many more—the space is infinite.
Crucially, it is not the brand or type of specific model that governs behaviour. What matters is the persona design—the stance, tone, and style assigned to the system—and the surrounding rules, such as how forceful to be, when to push back, or how emotionally to respond.
Once set, these elements shape output consistently, even across different models. In back-and-forth exchanges, the same persona tends to express its views more strongly and explicitly than in a single turn reply, especially when prompted to defend its position. This means that even smaller, less advanced models can produce convincing ideological content—if the persona and instructions are well designed.
Imagine a continuum. On one end, you have the manual setup, where a human operator writes and posts content—possibly with AI assistance for drafting or translation—but ultimately, a person decides what to say and when. Output varies by individual, scale is limited, and attribution is easier. In the middle is the semi-automatic mode: a human designs how the content is to be crafted, generates it using the AI model, and remains in the loop to select and schedule. A simple controller—a script or programme—can help manage this by deciding which drafts to keep, using an evaluator to automatically score each one for relevance, tone, or fluency. The best responses are then queued for posting, lifting throughput and smoothing tone.
At the far end is the fully automatic system. This is where the machinery generates content, evaluates it, selects or rewrites it, schedules publication, maintains threaded replies. All without a human in the loop. A human sets the policy design, rules and objectives. The moving parts are straightforward: a local generator (one or more small, local models), an evaluator to score the content, a controller that approves the content and orchestrates the posting of it, short-term memory/logs to preserve context and avoid repeats, a scheduler/posting interface and an optimiser to measure what content works, and what may be improved. All of this can run automatically.
Today, this design may run on ordinary commodity hardware—my tests were conducted on a laptop, albeit powerful one—and uses locally run, open-weight models, so no cloud access or paid APIs are required. I evaluated Qwen3, Gemma-3, Mistral-Small-3.26, and Gemini v3 Nano (the Chrome-embedded default) as generators, with a local Qwen3 as the evaluator. Because generation and evaluation run entirely on-device, the activity is largely opaque to outside observers and difficult to audit or disrupt. The same architecture can be scaled and adapted for offensive use by professional threat actors.
This has implications for defence and policy. We should move away from treating individual posts—or networks of accounts—as isolated entities and begin considering them as part of larger conversational interactions. In practice, that means following threads and timelines. The most informative signals often appear at this level: whether a stance shifts (or pointedly does not) within a single exchange; whether a persona drifts as topics change; how quickly an account replies and whether its cadence is unusually regular; and whether distinctive turns of phrase recur weeks apart. As back-and-forth develops, constraints tend to tighten and a system’s ‘voice’ can become more uniform, which may indicate automation.
Coordination is the next indicator. Orchestrated systems may leave timing and routing fingerprints. You see bursts of near-simultaneous replies across multiple accounts, posting windows that line up a little too neatly, and templates that reappear with only light paraphrase.
For attribution, follow the infrastructure being used. Models can be swapped in an afternoon; the orchestrator and infrastructure are stickier. It’s the infrastructure like the IP addresses of servers, and similar indicators that matters and that may ultimately help disrupt an operation, scheduler behaviour, reuse of network proxies, the traces of browser automation or similar. These are the features that connect activity over time and across accounts.
Research and practice need shared, auditable evaluation tools and metrics. We should publish these so results are comparable and transparent across studies and settings. Platforms, for their part, should retain conversation-level telemetry—that is, thread-level metadata and interaction traces such as timestamps, reply chains, account-to-account interactions, and content provenance, including, of course, the IP addresses, and other metadata of the kind, all within applicable privacy law, to enable independent auditing of behaviour over time.
There is a risk of overemphasising 'model AI safety' policy at the expense of operational realities. In practice, open, locally run models are more relevant for campaigns, as they are cheaper, downloadable, and operate outside provider oversight, which makes them harder to observe or interrupt. The capability is already readily available; frontier, third-party, closed systems need not be used in sustained operations. Policy should be pragmatic, once model weights are public, blanket bans on general-purpose tools are unlikely to be effective. The emphasis should be on transparency, auditing, intelligence collection, and disrupting the coordination layer where campaigns scale.
Capabilities will continue to shift onto user-controlled machines—or just stay there. Open models may well be the future of AI propaganda: powerful, readily available, and often opaque in use. For defence, priorities are robust analytics and challenge–response probes that reveal automation. Next-generation influence campaigns will be difficult to defuse.
Many state actors are likely already experimenting with or developing these capabilities. We should not be surprised with the broader operational deployments come as early as 2026.