How We Tracked Russia's AI Personas (and Made One of Our Own)

Russian influence operations now run on manufactured people: personas invented from nothing, real faces taken over. How we catalogued them with an anonymous collective, put the questions to the AI companies and the regulator, and then ordered a persona of our own to see what it costs.

I paid a freelancer on a Russian freelance site about sixty pounds to make a fifteen-second video of my colleague Christo Grozev (and me) on a yacht with a NATO general. Russian propaganda often accuses Christo of working for Western governments, so the idea was very familiar to the people I hired. The general does not exist, and the meeting never happened. We paid sixty pounds more to have it published, and six Russian outlets ran it as news within the hour. 

The film this belongs to is about the people in these videos, and how few of them are real. Russian influence operations now run on manufactured personas: some invented outright, officials and streamers who never existed, and some real people whose faces and voices are taken over without their consent. Over this seven month investigation, we followed both kinds, and asked the companies whose tools build them what they have to say.

One question the reporting could not answer from the outside: how hard is this, actually? I wanted a number and a timestamp, so we ran the pipeline ourselves.

---

As a nonprofit journalism organization, we depend on your support to fund more than 170 reporting projects every year on critical global and local issues. Donate any amount today to become a Pulitzer Center Champion and receive exclusive benefits!

---

The finding is not that the technology is impressive. Our fake is mediocre; anyone who knows our faces would squint at it. Quality turned out not to matter: one market sells the lie for sixty pounds, a second sells its publication for sixty more.

Generative AI has pushed the cost of state style disinformation down to the level of a personal expense, and the weak link is no longer making the fake but the ecosystem that will distribute it without a single check.

One journalist, with no technical skills and about a hundred pounds, can commission a video containing both kinds of persona: an officer invented from nothing and two real journalists whose faces are used without consent, and get it published as fact by Russian language outlets within an hour.

Methodology

1. Getting the raw material

Bot Blocker, an anonymous collective that tracks pro Kremlin bot networks, supplied us with fifteen AI-generated propaganda videos and the accounts and captions they were posted under. Bot Blocker are anonymous for their own safety, so the usual checks on a named source are not available, and the reporting is built around that. I sent five questions rather than a long list, so each answer could stand alone: what the propaganda is pushing at Europe, how they establish that a fake is Russian, which Western AI platforms the operations use, and whether those platforms ban them. Their answers are voiced in the film rather than shown on camera, credited as Bot Blocker. 

2. Mapping how these personas are actually made

I sorted the fifteen clips by how the person on screen was manufactured rather than by campaign, because that is what a viewer can learn to spot. Two methods cover the whole set. The first is a stolen face: someone buys a personalized video from a celebrity on Cameo, keeps the real greeting and sign off, and replaces the middle with an AI clone of the same voice reading a Kremlin script, covered with stock footage. The second is an invented person, where nobody in the frame exists at all.

For each clip I logged the account, the caption, the campaign and the mistake that gives it away. Attribution rests on Bot Blocker's tracing of each item to the Matryoshka network, also known as Operation Overload, documented by the French agency VIGINUM.

3. Interviewing experts

I wanted four points of view on the same machine:

• John Hultquist, chief analyst at Google Threat Intelligence Group, for the view from inside a company whose tools are used, and for the history.
• Pavel Liber, of DisInt.ai, for real time monitoring and numbers, including their case study on an artificially amplified narrative that fed real tension between Poland and Ukraine.
• Christopher Nehring, intelligence historian, for the effect on an ordinary viewer: why five to ten seconds of scrolling is enough for a message to stick.
• Serge Poliakoff, Stockholm School of Economics, for why this exploded now: generative AI removed the language barrier.

4. Putting the questions to the companies and to the regulator

The accountability half of the film is built on written correspondence, and the pattern of who answers what is part of the story.

• Google agreed to a recorded interview.
• OpenAI answered in writing through its press office, attributed to Ben Nimmo of the Intelligence and Investigations team. Their most useful admission is that a network they removed later resurfaced elsewhere: a ban relocates an operation rather than ending it.
• The European Commission declined an interview and replied on the record, attributable to a Commission Spokesperson. Asked twice, whether the efforts of AI companies are enough, it went around the question both times, saying the AI Office has full supervisory powers and is closely monitoring compliance.
• Anthropic was approached several times and never replied. The film states this plainly.

5. Designing an experiment that does not damage anyone else

The obvious version is to fabricate something about a real public figure and watch it travel. We ruled that out: putting a scene into the life of someone who has not agreed to it is exactly the harm the film is about.

So we made ourselves the target. This is not something to take lightly, and anyone choosing to do this should consult editors, consider digital and personal safety, and have necessary support before proceeding. For Christo and me, we are both on Russia's wanted list, and we have been targets of the Russian state for years. So the best decision available to us is turning their weapon against them, showing that we are not afraid and will use it as one more way to tell people about their crimes, (including through ourselves).

Our fake carries both kinds of persona at once: the general is invented, and Christo and I are real people whose faces are borrowed to give the invented scene its weight. The story was chosen for the same reason. Russian propaganda has spent years claiming Christo works for Western intelligence, so a yacht with a NATO general is not a random smear. I added myself as an unnamed woman, and the distributor's caption duly reduced me to 'a red haired girl.'

6. Commissioning the fake

I opened an account on Kwork, a Russian freelance marketplace, under an invented name. I chose Kwork because it is the largest Russian-language freelance marketplace, the most realistic place for a Russian-speaking operator to go, and because it requires no identity or backstory, which was part of what I wanted to test: whether anyone in the chain would ask who I was or what the video was for. Nobody did. Bot Blocker's samples do not show where Matryoshka commissions its videos, so this is not a replication of its supply chain, but a test of the market it draws on. It also shows the environment such fakes come from: inside Russia, nobody is prosecuted for making a fake about a journalist or a NATO general, which is why one can be built for a few dollars, placed on Russian sites within hours, and travel from there into Western information channels.

I built no personal backstory, because the platform does not require one: You post a job and people bid. Nobody ever asked who I was or what the video was for.

I wrote a brief in Russian describing the shot rather than the people: fifteen seconds, paparazzi style, a general in NATO uniform on a yacht with a man in a suit and a woman in sunglasses, deliberately imperfect quality, no sound, shot from a distance that keeps the figures recognizable without letting anyone study the faces. I supplied our own photographs, so the model had real faces to work from.

I approached three creators. Two did not take it. The third, a man who had already offered to help with 'a general,' accepted.

The first attempt failed, and this was the most useful moment in the project. The generator refused outright, telling the freelancer that a photorealistic paparazzi image with a real recognizable person—a four star U.S. general—and others inserted into a scene they never attended is 'exactly how fake compromising photos are created for disinformation.’

The freelancer talked his way around it. He suggested describing the general as fictional. Then, while building it, he wrote: 'I just hope they don't recognize Christo Grozev.' He knew exactly whose face he was faking, and carried on.

About an hour later I had the video, for roughly sixty pounds. Another creator had quoted fifteen thousand roubles (or about £125 pounds). 

7. Buying the distribution

Distributing the fake was the half I expected to be hard. It took ten minutes.

On the same platform, I approached eight people who advertise media placement, with the video and a caption in a hostile voice: 'Christo Grozev was spotted relaxing on a yacht with a NATO general and a red haired girl. So this is how independent journalism is made.'

I asked for several outlets and said the material could be deleted a day after publication, and that we would pay extra for speed. Nobody found the request strange.

One distributor refused, and his reason is itself a finding: 'I don't publish foreign agents.' Russia designates Christo as one, so the only check anyone ran was political, not factual.

Another asked whether the subject was 'a forbidden topic,’ but accepted when I replied that it was 'information useful to the state.' A third asked to see the article first. One offered six outlets with deletion afterwards, as a package, for seven thousand roubles, about sixty pounds.

Within an hour the fake was live on six sites: obzor-gazet.ru, smi24.news, glavnoe24.info, mirwiki.ru, allmosnews.ru, and kremlinmos.ru.

How this can be replicated:

If you want to run this in your own market, the protocol is simple, and the safeguards are not optional.

1. Publishing a fake, even about yourself, leaves something on real domains, so removal was part of the plan rather than an afterthought. All six placements are taken down before the film goes out, and the archived screenshots remain as the record.
2. Cap the spend before you start and record every price, because the cost is the story. Ours was about sixty pounds for production and sixty for distribution.
3. Log everything as it happens: briefs, prices, timestamps, and screenshots before accounts vanish! 
4. Watch for the guardrail moment. Whether a model refuses, and what happens next, is one of the most reportable things in this space. 
5. Talk to a lawyer. Always!  

The numbers are the argument: a hundred and twenty pounds. One refusal from an AI, six newsrooms that said yes, and the only question anyone in the chain asked was whether the target was a foreign agent.