LLM Poisoning: Russia's New Playbook and the Risk to Your Reputation 

By Katy Ling, Digital Risk & Intelligence Client Partner

LLMs are changing how people find information. For a growing number of users, asking an AI chatbot has replaced typing into a search engine, and even Google now leads with an AI summary. This shift creates an opportunity, but is also open to manipulation, and Russia got there first. 

The Same Playbook, Updated for the AI Era

Russia has long been the world's leader of state-sponsored disinformation. In the Soviet Union, disinformation was formalised into the architecture of the KGB and deployed continuously against Western audiences throughout the Cold War. After the Soviet collapse, these tactics were continued but updated to reflect the developing communications environment: from satellite broadcasting to the early internet to social media and deepfakes.  Best known is the Internet Research Agency's interference in the 2016 US election - where industrial-scale troll farms created thousands of social media accounts to seed division and stir up conspiracies.

A decade on, Russian influence operations have adapted again - now for the AI age. 

A New Audience - LLMs 

Since 2022, a Moscow-backed operation known as the Pravda network has been running over 150 fake news websites targeting more than 80 countries. The articles push a consistent line: Russia's actions in Ukraine are justified, NATO is the aggressor, and Western democracies are failing. 

The network publishes over 10,000 articles a day, yet most sites average fewer than 1,000 monthly visitors. That’s not to say these sites are ineffective… this content was never meant to be read by humans; it was written to be crawled by AI systems. The aim is to saturate the internet with pro-Kremlin narratives at a scale that AI models will absorb and repeat. 

Kremlin propagandist John Mark Dougan has outlined this strategy openly: “By pushing these Russian narratives from the Russian perspective, we can actually change worldwide AI.” He added, “It’s not a tool to be scared of, it’s a tool to be leveraged.”

Researchers call this LLM poisoning: deliberately manipulating the information environment that AI learns from, so its output reflects a particular worldview. The research confirms it’s working. 

NewsGuard tested ten leading AI chatbots against false narratives spread by the Pravda network and found they repeated the disinformation a third of the time, including fabricated claims that Zelensky had used military aid to purchase luxury properties. Similarly, research by the Institute for Strategic Dialogue found that LLMs returned Russian state-attributed content in 20% of responses about the invasion of Ukraine. The sources drawn on by the LLMs included outlets sanctioned in the EU, including RT and Sputnik, with no distinction made between them and more legitimate journalism. 

Both studies point to a fundamental weakness of AI systems: LLMs are only as good as the data fed into them. Flood the internet with enough well-aimed false content, and you can skew what they say about any target.

Beyond Russia - This Won't Stay Political

Most documented cases of AI manipulation have concerned state-sponsored information warfare. But the mechanics are not complicated, and they are not expensive. What a GRU-backed operation can do today, a well-funded hostile actor can do tomorrow.

The same playbook - flooding AI systems to shape what they say about a target - is available to anyone with a grievance and a budget. A disgruntled business partner. A corporate competitor. A hostile activist investor. A reputation attack coordinated through channels that leave no obvious fingerprints, but that quietly reshape what AI says when someone searches your name, your company, or your fund.

The implications extend beyond reputation. As financial institutions increasingly use AI-assisted tools for AML and KYC checks, a poisoned information environment could see fabricated narratives surfacing in compliance screening meaning real consequences for banking and business relationships.

In Dablam's work auditing how AI models represent individuals and organisations, a single high-authority domain capturing a significant share of voice in AI responses can disproportionately shape the overall narrative. It doesn't take a network of 150 sites. It can take one.

For high-profile individuals and organisations, the threat is not hypothetical. It is a near-term reality that most are entirely unprepared for because they don't know what AI is saying about them, let alone whether that picture is being shaped by someone else. 

If you would like to understand what LLMs are saying about your organisation, or to start building the function to manage it, please get in touch at [email protected].