Foreign-agent filings with the US Department of Justice document paid campaigns that build research-styled websites designed to be quoted by AI chatbots. One work order registered under FARA number 7732 on June 2, 2026 covers a 900,000 dollar Digital Storytelling Pilot; an earlier and much larger registration, number 7649, includes contract language calling for the "deployment of websites and content to deliver GPT framing results on GPT conversations." Both name Havas Media Germany as the intermediary acting for an Israeli government principal.
Key facts
- FARA registration 7732, filed June 2, 2026, names Piro, Inc. with Havas Media Germany acting for the Israel Government Advertising Agency. The attached work order totals 900,000 dollars.
- FARA registration 7649, signed September 18, 2025 by Bradley Parscale for Clock Tower X LLC, covers a reported 46.5 million dollar contract and contains the explicit GPT-framing language.
- The published surface for the newer campaign is the Hanover Institute for Public Policy, which discloses the arrangement on its own funding page.
- Drop Site News reported on July 28, 2026 that the older network was archived by Common Crawl 912 times in the first half of 2026.
The mechanics are worth understanding because they do not match the usual mental model of disinformation. Nobody here is running bot armies or fabricating viral posts. The campaigns build sites that look like small policy institutes and publish material formatted the way answer engines prefer: a question as the headline, a confident declarative answer in the first paragraph, citations, bullet points, and a neutral institutional voice.
Piro's own AI Story Optimization page is unusually candid about the goal. The company says it maps "every surface the models read," authors content "engineered for how LLMs evaluate credibility," and deploys it on "trusted third-party properties" where engines are looking. That is a marketing pitch, not a confession, but it describes the technique precisely.
The Hanover Institute is the visible output. Its research index carries answer-shaped titles like "What Is Zionism? How the Research Measures It" and pieces analyzing how Gaza war headlines assign agency. Its own about and funding pages state that its materials are distributed by Piro on behalf of Havas and the Israeli advertising agency, and that the relationship is registered under FARA. The disclosure is real and easy to find. The problem is that a model summarizing an answer does not usually read the funding page.
The older network documented by Drop Site News was larger and less forthcoming. Reporter-identified properties included Paxpoint, Allyvia, FactSignal, Cognitura, Justorium, and several others, each with a different narrative lane. Cognitura describes itself as a "Research and Education Platform" studying radicalization and propaganda, with legal pages identifying Clock Tower X as operator and disclosing distribution on behalf of the State of Israel.
Two delivery paths matter here, and they have very different evidence behind them. The first is retrieval. Drop Site documented chatbots citing these pages in live outputs, with Perplexity surfacing Allyvia as a top source for a pro-Israel query. Some assistants flagged the foreign-government disclosure; others did not. That is documented answer contamination, and it is the strong claim. The second path is training data, and it is weaker. The network was repeatedly archived by Common Crawl, a major upstream corpus source, but as the DFRLab noted in its analysis of a similar Russian operation, inclusion in Common Crawl does not prove ingestion into any particular model.
The economics are what make this a durable problem. Anthropic's research on data poisoning found that as few as 250 malicious documents can implant a backdoor in models across a wide size range, because what matters is the absolute count of poisoned samples rather than their share of the corpus. A content farm producing a few hundred well-formatted pages is cheap by advertising standards and potentially significant by corpus standards. That is the asymmetry.
There is a serious counter-argument, and it came from an expert quoted in Drop Site's own reporting. Stephen Walt argued that constant spinning of this kind eventually teaches audiences to expect fabrication rather than to believe it, which would make the tactic self-defeating over time. Others in the same piece disagreed: Alice Lee said the pages have exactly the hallmarks that make chatbot pickup more likely, and Herve Letoqueux described Common Crawl as a manipulation surface useful for damage control on contested questions.
The honest limit on this story is that intent is inferred from artifacts, not confessed. What is documented is the contract language, the content strategy, the crawlability, the disclosed funding chain, and in the older case the chatbot citations. Nobody has admitted to trying to poison a model, and no one has demonstrated a controlled causal link between these pages and a specific model's weights.
The defensive lesson is narrower and more useful than the alarm: provenance has to be a first-class signal in retrieval pipelines, not a footer. A system that ranks by how citable a page looks will reliably prefer content engineered to look citable. That is not a bug in any one product. It is what happens when the ranking signal and the manipulation target are the same thing.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)