'Pravda' Network, Successor to 'Portal Kombat,' Allegedly Seeding AI Models with Kremlin Disinformation

A purported Moscow-based disinformation network, Pravda, allegedly infiltrated AI models by flooding the internet with pro-Kremlin falsehoods. A NewsGuard audit found that 10 major AI chatbots repeated these narratives 33% of the time, citing Pravda sources as legitimate. The tactic, called "LLM grooming," manipulates AI training data to embed Russian propaganda. Pravda is part of Portal Kombat, a larger Russian disinformation network identified by VIGINUM in February 2024, but in operation since February 2022.

Risk classification

• Primary risk domain: 3 Misinformation
• Primary risk subdomain: 3.1 False or misleading information

The incident involves major Western AI chatbots inadvertently repeating and spreading fabricated Russian propaganda narratives to users due to data poisoning.

Additional risk subdomains

• 4.1 Disinformation, surveillance, and influence at scale: The Pravda network uses automated systems to conduct a large-scale disinformation campaign aimed at manipulating public opinion and AI models.
• 7.3 Lack of capability or robustness: The chatbots fail to perform reliably under data poisoning conditions, demonstrating a lack of robustness in filtering out unreliable sources.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The risk of chatbots outputting Russian propaganda occurs post-deployment due to the AI systems unintentionally absorbing and repeating poisoned web data during retrieval or generation.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The systems involved are chatbots and generative AI tools, which fall under Risk Level 3 due to transparency obligations to ensure users are aware they are interacting with an AI and that the content is AI-generated.

AI system and alleged parties

• AI system: unspecified AI chatbots
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: You.com, xAI, Perplexity, OpenAI, Mistral, Microsoft, Meta, Inflection, Google, Anthropic
• Alleged deployer: TigerWeb, Storm-1516, Russian state media, Pravda disinformation network, Portal Kombat, John Mark Dougan, Government of Russia
• Alleged harmed parties: Truth, Policymakers, National security and intelligence stakeholders, Media integrity, Media consumers, Journalists, Journalistic integrity, Journalism, Governments, Government of Ukraine, General public of Ukraine, General public, Epistemic integrity, Democracy, Chatbot users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Severe, indirect Severe
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Minor, indirect Minor
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Substantial, indirect Severe
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the reports describe the creation and spread of malicious pro-Kremlin propaganda and disinformation.

Directly caused: The Pravda network published 3.6 million articles in 2024 containing false claims and propaganda, which were then ingested and repeated by Western AI chatbots 33% of the time.

Indirectly caused: The campaign launders Kremlin propaganda through seemingly independent websites and trusted AI chatbots, amplifying its reach.

Inferred additional harm: It is likely that millions of users interacting with these chatbots were exposed to malicious state-sponsored propaganda regarding the war in Ukraine and other geopolitical topics.

Democracy

Reported: Yes, the reports describe the campaign as a threat to democratic processes and information resilience.

Directly caused: The campaign targeted European countries ahead of the EU Parliament elections and the US presidential election to manipulate public opinion.

Indirectly caused: By laundering disinformation through trusted AI systems, the campaign undermines democratic debate, public trust in institutions, and information resilience.

Inferred additional harm: The systematic manipulation of AI models by foreign adversaries could lead to long-term erosion of democratic decision-making and public trust in shared reality.

Epistemic

Reported: Yes, the reports explicitly describe extensive epistemic harm through the systematic poisoning of the information ecosystem and chatbot training data.

Directly caused: The Pravda network spread at least 207 provably false claims (e.g., secret US bioweapons labs in Ukraine, Zelensky misusing aid), which chatbots repeated 33.5% of the time.

Indirectly caused: The 'LLM grooming' technique saturates search results and web crawlers, distorting how large language models process, summarize, and present news.

Inferred additional harm: Widespread exposure to poisoned chatbot outputs likely degrades the shared consensus reality and misleads users who overrely on AI for factual news.

People affected

• Occurrences reported: 1
• People reportedly exposed: 1000000

Potential causes

Management

• Prioritizing Speed Over Safety: AI companies deploy models rapidly without fully vetting training datasets.
• Underinvestment in Data Vetting: Companies put insufficient energy into filtering poorly vetted scraped web data.

Technology

• Vulnerability to 'LLM Grooming': Models process massive token volumes, shifting probabilities toward falsehoods.
• Inability to Verify Sources: Chatbots fail to distinguish reliable sources from laundered disinformation.
• Dependence on Search Engines: Chatbots scrape real-time web data indexed by compromised search results.

Data Inputs

• Data Poisoning via Automated Sites: Pravda network flooded web crawlers with 3.6 million articles in 2024.
• SEO Manipulation of Training Data: Disinformation actors used SEO strategies to boost visibility for web crawlers.
• Use of Unvetted Web Scraping: AI developers train models on unvetted, scraped public internet data.

Human Factors

• User Overreliance on Chatbots: Users trust persuasive chatbot outputs without cross-checking other sources.
• Deliberate Malign Prompting: Leading or malign prompts manipulate chatbots into bypassing safety guardrails.
• Malign Intent of Propagandists: Propagandist Dougan intentionally engineered narratives to manipulate AI.

Process and Methods

• Whack-a-Mole Domain Blocking: Blocking domains fails as the network continuously registers new subdomains.
• Inadequate Training Safeguards: Companies lack robust technical mechanisms to vet data before model training.
• Lack of Source Discrimination: Chatbot source citations treat reliable and unreliable sources equally.

Regulatory Environment

• Unregulated Chatbot Ecosystem: Lack of regulatory oversight allows chatbots to operate without safety rules.
• Rollback of Cyber Defenses: US paused cyber operations against Russia, weakening foreign threat mitigation.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide detailed, consistent, and well-documented findings from multiple independent organizations (NewsGuard, American Sunlight Project, Viginum, EDMO) regarding the Pravda network's operations, scale (3.6 million articles), and the specific audit results showing a 33% replication rate across 10 major chatbots.
• Ambiguities identified: The exact algorithms used by TigerWeb for automation and the specific search engine optimization (SEO) techniques are not fully detailed.
• Alternative interpretations: The incident could be viewed purely as a human-driven cyber/influence operation rather than an AI safety failure, though the deliberate targeting of LLM training data ('LLM grooming') makes it a distinct AI safety and robustness issue.

A Moscow-based disinformation network executed a massive 'LLM grooming' campaign, systematically poisoning the data environment of major Western AI chatbots. By publishing millions of automated articles, the network successfully caused leading AI models to repeat pro-Kremlin propaganda 33.5% of the time, demonstrating a significant evolution in state-sponsored information warfare.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: Western democracies
• Other affected: US and European Union countries
• Alleged perpetrator: TigerWeb

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic influence capability and systemic vulnerability rather than an active, acute 72-hour crisis.
• Autonomy: Human-supervised. AI chatbots autonomously retrieve and generate responses based on poisoned data, though they operate under user-driven queries and developer safety filters.
• Novelty: Evolved capability. Represents a significant evolution of traditional information operations, adapting automated propaganda distribution specifically to exploit LLM data ingestion.

Impact by dimension

• Physical security: Negligible. No physical infrastructure or kinetic systems were targeted or affected by this disinformation campaign.
• Information security: Substantial. Systematic 'LLM grooming' campaign successfully poisoned the data environment of major Western AI chatbots, causing them to repeat Russian state-backed propaganda 33.5% of the time.
• Sovereignty: Minor. Campaign targeted Western democratic processes and elections, but direct compromise of core government decision-making or state authority remains limited.
• Economic security: Minor. Demonstrates a significant vulnerability in Western commercial AI systems to data poisoning, though direct economic warfare or strategic technology theft was not the primary vector.
• Societal stability: Substantial. Large-scale attempt to manipulate public opinion and erode trust in shared reality by laundering state-sponsored propaganda through trusted consumer AI systems.