Purported Hanover Institute for Public Policy Reportedly Targeted Chatbot Responses in Israeli Government-Backed Influence Campaign

An Israeli government-backed communications campaign reportedly operated a website presenting itself as the Hanover Institute for Public Policy, despite reporting finding no corresponding established think tank. The site published material designed for chatbot retrieval, and testing found ChatGPT and Perplexity citing Hanover content in neutral queries.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.1 Disinformation, surveillance, and influence at scale

The incident involves a coordinated, state-funded influence campaign designed to manipulate public opinion at scale by gaming AI chatbot outputs on sensitive geopolitical topics.

Additional risk subdomains

• 3.2 Pollution of information ecosystem and loss of consensus reality: The campaign aims to pollute AI training repositories like Common Crawl and manipulate chatbot outputs to distort public consensus on geopolitical events.
• 7.3 Lack of capability or robustness: Commercial LLMs lack the robustness to detect and filter out coordinated Generative Engine Optimization (GEO) and data poisoning attempts.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The risk is caused by human actors intentionally designing and executing a campaign to manipulate the outputs of deployed AI systems.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves chatbots and AI-generated content platforms (like ChatGPT, Perplexity, and Res) which are subject to transparency obligations under the EU AI Act to ensure users are aware they are interacting with AI-generated outputs.

AI system and alleged parties

• AI system: ChatGPT, Perplexity (OpenAI, Perplexity AI)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: Perplexity, OpenAI, Large language model developers, Chatbot developers
• Alleged deployer: Piro, Inc., Israel Government Advertising Agency, Information manipulation actors in Israel, Information manipulation actors, Havas Media Germany GmbH, Hanover Institute for Public Policy, Government of Israel
• Alleged harmed parties: Public discourse integrity, Perplexity users, General public of the United States, General public, Epistemic integrity, ChatGPT users, Chatbot users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Minor, indirect Minor
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report explicitly describes the creation and spread of biased political content designed to blunt criticism of war crimes and starvation.

Directly caused: The Hanover Institute website published 124 reports (over 560,000 words) presenting biased framing of the Israel-Gaza conflict as neutral research.

Indirectly caused: Chatbots like ChatGPT and Perplexity cited these reports, spreading the biased narratives to users querying the systems.

Democracy

Reported: The report explicitly describes an attempt by a foreign government to covertly influence US public opinion and political processes by manipulating AI systems.

Directly caused: Foreign government-funded entities covertly deployed websites and optimized content to manipulate LLM outputs on sensitive political topics.

Indirectly caused: This undermines democratic discourse and public understanding of foreign policy issues by covertly injecting state-sponsored propaganda into AI search engines and chatbots.

Inferred additional harm: Continued covert operations of this nature could severely degrade democratic decision-making and public trust in information systems.

Epistemic

Reported: The report explicitly describes epistemic harm through the deliberate manipulation of factual outputs of LLMs on sensitive topics.

Directly caused: The Hanover Institute published 124 reports with misleading framing, biased citations, and false pretenses of being an independent academic institute.

Indirectly caused: Chatbots (ChatGPT, Perplexity) cited these reports, presenting biased and manipulated information as neutral facts to users.

Inferred additional harm: Large-scale pollution of AI training datasets (like Common Crawl) with groomed content, leading to long-term degradation of chatbot accuracy and objectivity.

People affected

• Occurrences reported: 1
• People reportedly exposed: 28100000

Potential causes

Management

• Commercialization of GEO Platforms: Platforms like Res prioritize profit over the integrity of AI outputs.
• AI Platform Risk Blindness: AI developers failed to manage risks of coordinated optimization.

Technology

• LLM Susceptibility to GEO: Chatbots are easily manipulated by content optimized for retrieval.
• Lack of Source Verification: LLMs cite or regurgitate unverified sites like fake thinktanks.
• Generative Engine Optimization: Platforms like Res enable active manipulation of chatbot responses.

Data Inputs

• Unchecked Training Repositories: Common Crawl ingests biased web content without quality checks.
• Manipulated Q&A Formatting: Site content is structured specifically to mimic user queries.
• Use of LLM-targeted Files: Use of llms.txt files designed to guide machine readers directly.

Human Factors

• User Overreliance on Chatbots: Users trust chatbot outputs as neutral without checking sources.
• Deceptive Website Presentation: Professional site design and fake credentials deceive reviewers.

Process and Methods

• Inadequate Content Filtering: Chatbot developers lack robust methods to filter coordinated influence.
• Lack of Algorithmic Attribution: Difficulty in identifying automated or optimized state-sponsored content.

Regulatory Environment

• Weak AI Data Governance Laws: No regulations prevent the intentional poisoning of AI training data.
• Lack of LLM Grooming Regulation: No clear legal framework addresses the manipulation of chatbot outputs.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from The Guardian and Politico provide detailed, corroborating evidence of the influence campaign, including specific FARA filings, contract amounts, and technical details of the Generative Engine Optimization (GEO) techniques used. The role of the AI systems (both the Res platform and the target LLMs) is explicitly documented, and the testing of chatbots confirming the campaign's success provides direct empirical support.
• Ambiguities identified: The exact extent to which the Hanover Institute's content has successfully integrated into major training datasets like Common Crawl is not fully clear, as the reports note it was too recent for the latest crawl but aimed at future crawls.
• Alternative interpretations: The campaign could be viewed purely as a traditional public relations or 'Hasbara' effort, but the explicit technical targeting of LLM training data and search optimization (GEO) makes it a distinct AI-centric information manipulation incident.

This incident represents a notable shift in information warfare, where a state actor covertly funded a campaign to groom commercial AI chatbot outputs using Generative Engine Optimization. By seeding biased narratives into web repositories, the campaign successfully manipulated ChatGPT and Perplexity outputs on sensitive geopolitical issues, establishing a concerning precedent for AI-era disinformation.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: United States
• Other affected: Global
• Alleged perpetrator: Israel

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding the integrity of AI training data and search outputs rather than an immediate kinetic crisis.
• Autonomy: Human-controlled. The campaign was designed, funded, and executed by human actors using AI tools to generate content and target specific commercial LLMs.
• Novelty: Evolved capability. Significant advancement of traditional information operations, adapting search engine optimization techniques to target AI chatbot training pipelines.

Impact by dimension

• Physical security: Negligible. No physical systems, infrastructure, or human safety threats were involved in this digital information campaign.
• Information security: Substantial. State-funded covert operation utilizing advanced Generative Engine Optimization (GEO) to systematically manipulate commercial AI chatbot outputs, representing a substantial information warfare capability.
• Sovereignty: Minor. Involves foreign state-funded entities covertly attempting to influence public opinion and political discourse within other nations, though not directly disrupting government operations.
• Economic security: Minor. Exploitation of commercial US AI platforms to distribute state-sponsored narratives, presenting minor technological security challenges and data integrity risks.
• Societal stability: Minor. Attempts to manipulate public perception of sensitive geopolitical conflicts, potentially eroding trust in information ecosystems but with limited direct societal disruption.