On Tuesday, OpenAI published a threat report that should alarm anyone running an advocacy organization, a policy shop, or a public-facing nonprofit.
Russian operators built a fake Israeli think tank — complete with plagiarized academic articles, invented experts, and a made-up "sovereignty index" designed to make Russia look favorable. They ran it for nearly nine months across Substack, Telegram, X, Facebook, and LinkedIn. Of 36 articles attributed to supposed experts on the site, 34 were copy-pasted from elsewhere on the internet — often with wrong attribution. The operation used ChatGPT to draft social media content and to specifically scrub any linguistic tells that might flag the text as AI-generated.
It got caught because OpenAI was actively looking for this pattern. Your organization probably isn't doing the same.
This isn't really a story about Russia. It's a story about what a scalable influence operation costs now — and who's actually in the crosshairs.
The cost of fake credibility just hit zero
Running a fake think tank used to require real resources. Writers who could sustain a consistent voice, researchers who could at least gesture at methodology, enough institutional history to survive basic scrutiny. That's why state-level actors with actual budgets were the main players.
That's over.
A ChatGPT subscription is $20 a month. A plausible institutional name and a stock photo header cost nothing. You can generate 50 passable articles over a weekend, seed them across platforms under fabricated bylines, and let algorithmic amplification do the rest. The operation CNBC covered this week ran for nine months before anyone caught it — and it was only caught by one of the largest AI labs in the world running an active investigation.
The question every NGO, policy org, and public-sector team needs to ask: who might have a reason to do this to you?
Civil society is the soft target
Most disinformation conversations focus on elections and military narratives. That framing misses most of the actual risk.
Any organization whose credibility is its primary asset is a target. That means:
Advocacy nonprofits. Your policy positions are your product. A flood of AI-generated "expert analysis" contradicting your research can muddy the water with funders, lawmakers, and journalists — all of whom are being pulled in a hundred directions and can't verify every citation.
International development orgs. You operate in regions where local trust is everything and rumors spread fast. Synthetic narratives about your organization's behavior, funding sources, or motives can collapse that trust before you even know the content exists.
Public sector teams. If you're building AI policy, procurement processes, or regulatory guidance, someone with an interest in that outcome might flood the information space with counter-"research" timed to your consultation windows.
Grant-funded orgs. Disinformation doesn't have to be sophisticated to work. It just has to make a funder hesitate, or give a board member something to ask about at the wrong moment.
The fake think tank targeted geopolitical narratives. But the same playbook runs just as well for targeted reputation attacks. You don't need a nation-state budget. You need a grievance and a $20 subscription.
What this operation actually looked like
The Russians built a fictional Israeli research institute, gave it a professional name, created expert profiles with headshots, and produced the "sovereignty index" — a scoring system that rated countries on made-up criteria calibrated to favor Russia. They routed their ChatGPT access through VPNs to bypass OpenAI's Russia access restrictions.
The operation ran from September 2025 through May 2026. Nine months. Five platforms. And in a detail worth sitting with: they used AI to remove any features of the text that might "betray its origins." The content wasn't AI-looking because they specifically cleaned it up.
This matters because it means your existing content moderation filters — "does this sound AI-generated?" — already don't work as a detection mechanism.
What to do right now
This isn't about building a counter-disinformation capability from scratch. It's about not getting caught flat-footed.
Set up monitoring for your name and your work. Google Alerts for your organization's name, your key reports, and your senior staff takes ten minutes to configure. Add variations — common misspellings, your acronym, your main program names. You want to see unfamiliar citations of your work as early as possible.
Date-stamp and sign everything you publish publicly. The fake think tank's articles had no consistent author history, no institutional voice that built over time. Your archive of clearly attributed, consistently styled content is your authenticity signal. It's also what lets you say definitively "we did not write that" when something appears under your name.
Verify think tanks before you cite them. New "research institutes" appear weekly right now. Before you quote a report or reference an expert in your own work, spend two minutes checking whether the organization has a traceable history — a real domain registration date, past coverage in legitimate outlets, staff who show up elsewhere. A professional website proves nothing.
Train your team to notice suspicious citations in your sector. This isn't a security awareness course. It's one conversation: what does a synthetic research outlet look like? Vague author credentials. Articles with incorrect attribution. Institutional claims that don't hold up to five minutes of searching. A "sovereignty index" that happens to rate countries in a very convenient order.
If you find synthetic content about your org, document and report it. Screenshot everything. Report to the platform. If you do international work, flag it to your networks — your peers in the sector may be seeing the same campaign from a different angle.
The signal underneath this story
What the OpenAI report actually reveals isn't that Russia is creative. It's that the cost of a sophisticated-looking influence operation just collapsed. The same tools helping your team draft reports and summarize documents can generate nine months of fake research about your issue area, your organization, or your leadership.
The organizations most at risk aren't the highest-profile ones. They're the ones who haven't thought about this yet — because they assumed they weren't interesting enough to target.
Most orgs we work with have never sat down and asked: "Who might want to undermine us, and how cheap would it be to try now?" That conversation is worth having before someone else starts it for you.