AI incident ·
Iranian Hacker Group Cotton Sandstorm Reportedly Integrating AI into Cyber Influence Operations
In brief
An AI system built by Islamic Revolutionary Guard Corps (Irgc), Government Of Iran and 2 others and deployed by Islamic Revolutionary Guard Corps (Irgc), Government Of Iran and 1 other allegedly harmed Political Candidates, Media Organizations and 3 others.
- Risk domain
- Malicious Actors & Misuse
- Occurred
- Coverage
- 13 reports
What happened
The Iranian state-sponsored group Cotton Sandstorm, linked to the IRGC, has integrated generative AI into cyber influence operations. In December 2023, it launched Operation “For Humanity," using AI-crafted messaging to hijack a U.S.-based IPTV streaming service with propaganda about the Israel-Hamas conflict. The group also engages in election-related reconnaissance, which suggests they used AI-enhanced influence efforts ahead of the 2024 U.S. election.
Laws that address this harm
Policy angle: Classified under Malicious Actors & Misuse (Disinformation, surveillance, and influence at scale) in the MIT AI Risk Repository taxonomy; 5 recorded instruments address this use case.
- India DPDP Act
- Law on Artificial Intelligence (2025)
- Law No. 132/2025 on artificial intelligence
- EU AI Act
- Texas Responsible AI Governance Act (TRAIGA)
Matched from the record's risk domain and country to the instruments recorded here. A reviewer can correct the match in the repository (data/external/incident_overrides.yaml).
News reports (13)
Titles link to the original publisher; report text is not reproduced here.
Who was involved
- Alleged developer
- Islamic Revolutionary Guard Corps (Irgc), Government Of Iran, Cotton Sandstorm, Generative Ai Developers
- Alleged harmed party
- Political Candidates, Media Organizations, General Public Of The United States, American Voters, Democratic Integrity
Classification (MIT AI Risk Repository taxonomy)
- Risk domain
- Malicious Actors & Misuse
- Risk subdomain
- 4.1 Disinformation, surveillance, and influence at scale
- Causal entity
- Human
- Intent
- Intentional
- Timing
- Pre-deployment
- Harm level
- —
- Sectors
- —
- Countries
- —
Risk entries describing this failure mode
Entries from the MIT AI Risk Repository coded to subdomain 4.1.
- Political manipulation
"Political manipulation - Use or misuse of personal data to target individuals’ interests, personalities and vulnerabilities with tailored political messages via micro-advertising or deepfakes/synthetic media."
- Coercion/manipulation
"Coercion/manipulation - Use of a technology system to covertly alter user beliefs and behaviour using nudging, dark patterns and/or other opaque techniques, resulting in potential erosion of privacy, addiction, anxiety/...
- Political and Economic
"Political and Economic - Manipulation of political beliefs, damage to political institutions and the effective delivery of government services."
- Electoral interference
"Electoral interference - Generation of false or misleading information that can interrupt or mislead voters and/or undermine trust in electoral processes."
- Political
"In the UK, a form of initial computational propaganda has already happened during the Brexit referendum1 . In future, there are concerns that oppressive governments could use AI to shape citizens’ opinions"
- Biased influence through citizen screening and tailored propaganda
"AI-powered chatbots tailor their communication approach to influence individual users' decisions. In the UK, a form of initial computational propaganda has already happened during the Brexit referendum. In future, there...
- Surveillance and Censorship
"Content moderation has emerged as one of the key use-cases of LLMs (Weng et al., 2023), indicating the potential of LLMs for surveillance and censorship as well (Edwards, 2023). Surveillance and censorship are one of th...
- Disinformation and manipulation of public opinion
"AI, particularly general- purpose AI, can be maliciously used for disinformation (351), which for the purpose of this report refers to false information that was generated or spread with the deliberate intent to mislead...
Incidents in the same risk subdomain
- Suspected AI-Generated Deepfake Video Reportedly Targeted Former Chhattisgarh Chief Minister Bhupesh Baghel on Instagram
- Purported AI-Generated War Footage Reportedly Circulated Widely Online During the Opening Phase of the War in Iran
- Purportedly AI-Manipulated Satellite Image Reportedly Claimed Iranian Strike Destroyed U.S. Radar in Qatar
- Network of Allegedly Fake Facebook Profiles with Purportedly AI-Generated Images Amplified Posts by Bulgaria's 'There Is Such a People' (ITN) Party
- Purportedly AI-Generated Image Reportedly Circulated Ahead of Thai Election Depicting PM Anutin Charnvirakul Dining with Benjamin Mauerberger
- Purportedly AI-Altered Images Reportedly Distort Evidence After Minneapolis Shooting of ICU Nurse Alex Pretti
Source record: incident #971 on the AI Incident Database · all 13 reports