OpenAI’s threat intelligence team tracked what it believes are two distinct clusters of activity online from groups with ties to China and posting content seemingly designed to stoke anger around divisive topics like AI and data centers.

The first, dubbed “Data Center Bandwagon,” used ChatGPT to create imagery and social media comments claiming data center buildouts were raising electricity prices for Americans.

Another used the tool to develop images and online posts characterizing tariffs as a covert means for the countries to exert control over the global technological landscape. According to OpenAI, the originating prompts directed ChatGPT to only include U.S. President Donald Trump in this content, while leaving out Chinese President Xi Jinping, who has also made use of tariffs.  

In both cases, OpenAI said the operators “likely originated” in China. The anti-data center content was traced to an unnamed Chinese technology company that holds multiple contracts with regional Chinese governments, and both clusters used VPNs to evade restrictions, prompted ChatGPT in simplified Chinese and asked for both English and Chinese-language outputs, all while posing as Americans on social media platforms like X and YouTube.

“This looks like a classic example of a foreign influence operation jumping onto the bandwagon of a genuine and pre-existing domestic debate and trying to manipulate it by using fake accounts posing as Americans,” online, said Ben Nimmo, principal investigator at OpenAI and author of the report. 

While OpenAI – which has sought to raise hundreds of millions of dollars in funding to build datacenters in the U.S. – is not a neutral party, the report does not claim that anti-data center sentiment in the country is being driven or bolstered by foreign propaganda online.

There’s little evidence that the campaigns got much attention outside their own amplification networks. Such engagement from third parties is an imperfect but important indicator of an influence operation’s impact. OpenAI rated the campaigns a 1 and 2 on the Bookings breakout scale, scores that indicate activity on one or more platforms but no evidence of meaningful engagement by targeted audiences.

Additionally, researchers who study state-sponsored influence campaigns say these groups are happy to latch onto and amplify genuine domestic movements or messaging so long as it serves their larger destabilization goals.

Others have suggested that piggybacking off established narratives with organic momentum – like public anger at AI and data centers – can make an influence operation appear more effective.

While AI tools can be leveraged to create such internet content at scale, they often fail to gain traction. Some images used by Chinese actors appear clunky or use overly direct messaging that display a lack of familiarity with both the English language and internet virality.

“I do want to be really clear here: this was not a case of an influence operation creating a debate,” said Nimmo. “The debate existed already. This was an influence operation from China trying to interfere in it. We didn’t see any signs that it succeeded.”

He added that while such views are “reasonable” and “sincerely held” by many participants on both sides, “what we don’t want to see is a covert foreign influence operation posing as Americans to try to shape it, still less a foreign influence operation using the very AI that it attacks.”

According to the OpenAI report, the actors used ChatGPT to edit work reports which contained operational security details about their social media campaigns. In them, they described their goals as “establishing persistent and credible accounts, producing visually appealing content to expand audience reach in different regions and maintaining long term account viability by anticipating platform enforcement.”

Another report fed into ChatGPT discussed how best to leverage Facebook’s content ecosystem, groups, pages, hashtags, advertising tools, recommendation systems and reporting mechanisms, as well as strategies for evading Meta’s detection of coordinated inauthentic accounts.

The campaign around tariffs also used ChatGPT to create short comments, comics in English but also Italian, Japanese and traditional Chinese accusing the US of putting profits over loyalty to its allies. OpenAI said they were targeted by the same network on X with an influence campaign alleging a widespread user data breach that Nimmo said “never happened.”

While OpenAI said the campaigns likely originated in China, they do not directly attribute the operations to the Chinese government or actors working on their behalf, but do note that many parts of the campaign and its tactics overlap with pre-established Chinese government propaganda campaigns online.

The post OpenAI: ‘Likely’ Chinese influence operation tried to use ChatGPT to stir debate on data centers  appeared first on CyberScoop.

Pashinyan's Civil Contract party won nearly 50% of Sunday's vote, defeating the pro-Russian Strong Armenia party led by Russian-Armenian billionaire Samvel Karapetyan, which received around 23% of the vote.

Cybersecurity threats to the 2026 midterm elections are targeting the accounts and platforms that campaigns, donors and voters use to communicate, according to a security report released Monday by Check Point Software Technologies.

So far in this election cycle, threats are not aimed at voting machines or ballot-counting systems. Instead, threat actors are going after the email accounts, websites and fundraising platforms that election organizations depend on.

Jeremy Fuchs, a campaign manager for Check Point, told CyberScoop that the report’s core findings reflect a broader trend in cybersecurity: Bad actors are using AI to make their attacks larger and more effective.

“The barrier to entry is lower and the quality is so much higher than it was three years ago, 10 years ago, that everything is going to look more realistic and it’s going to be more effective at accomplishing whatever goals [attackers] have,” he said.

Email remains the easiest way for hackers to perpetuate election-related schemes. Check Point found that 82% of malicious attacks arrive through email, where threat actors covertly trick users into handing over their passwords for major fundraising sites. Approximately 9,500 stolen passwords were tied to ActBlue, which collects donations for Democratic candidates. Approximately 6,500 were linked to WinRed, a Republican fundraising platform.

Fuchs noted that this information may not be directly used for election-related schemes, yet could be leveraged for opportunistic follow-on attempts at accessing other accounts.

“Whenever an exposure like this happens, whether it’s with a political site or not, oftentimes it’s saved for later,” he said. “If I have your email and password, if I have your phone number, I can just start an attack, a simple phishing attack that has nothing to do with the election right now.”

Threat actors are also registering many new websites with election-related names. In January, about 1,300 new websites included the word “election” and about 4,010 included the word “vote.” These websites can be used for phishing scams, where hackers trick people into giving up their passwords by pretending to be legitimate election organizations.

Fuchs noted that not every website may turn out to be malicious, but the speed with which these sites have been established — especially when legitimate campaign sites have been running years before an election — has led researchers to believe that the majority will be used for nefarious purposes. 

“If you’re spinning up these websites very quickly and at scale, there’s a reason for it,” he said. 

Misinformation and manipulated content present another layer of concern, especially as AI-generated political content has become increasingly visible in the 2026 cycle. Earlier this month, OpenAI rolled out a suite of tools and safeguards that’s meant to provide a layer of security for this particular election cycle.

Fuchs said this AI-powered manipulation is only going to grow as we get closer to Election Day, and as the models get better, so too will actors’ ability to deceive people with fake content. 

“It’s really hard to make sense of these things when the AI, and the attacks, have just become so good,” he said. “It was hard when they weren’t good. So now imagine how much harder it’s going to be when it is good, and it’s continuing to get better and better.” 

Fuchs warned that the speed at which AI-powered election threats are evolving presents a challenge that extends beyond technical defenses, saying that the true challenge lies in a threat landscape that’s changing faster than public understanding can keep pace.

“There’s so much more that we as a society can truly fathom,” he told CyberScoop. Generative AI “is moving so fast. It’s getting so good. And if we’re not having those conversations about, ‘hey, this is how things might change,’ all this stuff is just going to continue to get more difficult and more difficult. And it’s going to flare at these inflection points, whether an election is kind of the perfect place for it, because there’s just so much at stake for so many people.”

You read the full report on Check Point’s website. 

Update, 6/2/2026, 4:30 p.m.: This story has been amended to further clarify how threat actors are obtaining passwords for campaign donation sites.

The post Election threats are focused on campaign systems, not voting machines appeared first on CyberScoop.

Director of National Intelligence Tulsi Gabbard has tapped two individuals to coordinate work across U.S. spy agencies to monitor threats to the 2026 elections, according to multiple sources familiar with the matter.