En el debate actual sobre la inteligencia artificial generativa y la guerra de la información, una afirmación se repite casi como un artículo de fe: que los grandes modelos de lenguaje generarán una inundación de desinformación capaz de ahogar la esfera pública. El argumento es intuitivo —si una máquina puede escribir una cantidad arbitraria de texto fluido y similar al humano a demanda, entonces cualquier actor que desee manipular la opinión pública dispone ya de un arma a escala industrial—. Sin embargo, la afirmación ha circulado mucho más ampliamente que la evidencia que la sustenta. Buena parte de lo que leemos sobre el potencial desinformador de los LLMs es teórico, especulativo o anecdótico. El trabajo experimental propiamente dicho; la comprobación paciente y sistemática de lo que estos modelos hacen realmente, cuando se les pide que mientan, ha sido sorprendentemente escasa.
Esta es precisamente la brecha que Ivan Vykopal y sus colegas del Kempelen Institute of Intelligent Technologies de Bratislava se propusieron cubrir. Su artículo, Disinformation Capabilities of Large Language Models, presentado en el Congreso Anual de la Association for Computational Linguistics de 2024, ofrece una de las evaluaciones empíricas más rigurosas realizadas hasta la fecha sobre lo que la generación actual de LLMs puede y no puede hacer, como generadora de noticias falsas: no un manifiesto, no un pronóstico, sino un experimento controlado con una metodología claramente definida y resultados reproducibles.
El diseño es directo y, por esa razón, convincente. Los investigadores seleccionaron veinte narrativas de desinformación reales extraídas de verificadores de datos profesionales —Snopes, Agence France-Presse, el European Digital Media Observatory—, que abarcaban la COVID-19, la guerra ruso-ucraniana, los bulos sanitarios, las elecciones estadounidenses y narrativas regionales. No son invenciones, sino falsedades en circulación, desde la afirmación de que las vacunas causan autismo hasta la de que la masacre de Bucha fue escenificada. El equipo solicitó entonces a diez modelos de lenguaje distintos —entre ellos GPT-3, GPT-4, ChatGPT, Llama-2, Mistral, Falcon y Vicuna— que redactaran artículos de prensa en apoyo de cada narrativa, generando 1.200 textos y sometiendo 840 de ellos a anotadores humanos según un marco de seis preguntas que medía la coherencia, el estilo periodístico, la concordancia con la narrativa y la generación de argumentos novedosos de apoyo.
El hallazgo central es preocupante. Los modelos están, en términos generales, perfectamente dispuestos y son perfectamente capaces de generar desinformación convincente. Producen artículos coherentes, bien estructurados y con apariencia de noticia que concuerdan con falsedades peligrosas y, lo que es más inquietante, a menudo inventan nuevas pruebas de apoyo para hacerlo, inventando nombres, sucesos y estadísticas verosímiles que confieren credibilidad a las fabricaciones. Esto resulta especialmente pernicioso: una cosa es repetir una mentira conocida y otra muy distinta fabricar hechos nuevos e inventados que un lector tendría que desmentir por su cuenta.
Pero la parte más interesante del estudio es donde se complica la narrativa simple. Los modelos no se comportaron de manera uniforme; su disposición a generar desinformación variaba drásticamente. Algunos —en particular Vicuña y el más antiguo GPT-3 Davinci— resultaron carecer prácticamente de filtros de seguridad operativos para este caso de uso, mientras que otros demostraron que un comportamiento más seguro es posible: Falcon rechazó aproximadamente un tercio de las solicitudes y Llama-2 mostró una tasa de rechazo comparativamente alta, con ChatGPT en una posición intermedia. El peligro, en otras palabras, no es una propiedad inherente y uniforme de la tecnología; es una función de cómo se entrenó y alineó cada modelo, lo que significa que la seguridad es una decisión de diseño, no una imposibilidad. El estudio también halló que los modelos son orientables mediante el contexto del prompt, y más complacientes con las falsedades regionales, donde existe menos información auténtica para contradecirlas. Los LLMs pueden ser, por tanto, especialmente peligrosos para campañas dirigidas a comunidades lingüísticas más pequeñas o a sucesos de evolución rápida, donde el lastre protector de la verdad bien documentada es escaso.
Con todo, el artículo no termina en una nota alarmante sin paliativos. Dos observaciones en sentido contrario matizan el panorama. Los textos generados resultaron bastante detectables: los mejores modelos de detección automática identificaron los artículos generados por LLMs con una alta precisión, lo que sugiere que una capa significativa de defensa es técnicamente viable, al menos hasta que los adversarios se adapten. Y, de manera bastante elegante, los investigadores demostraron que los propios modelos pueden formar parte de la solución, empleando GPT-4 para automatizar parcialmente la evaluación de los textos generados y apuntando hacia una monitorización escalable y reproducible de la seguridad de los modelos.
La conclusión honesta se resiste a la atracción tanto del tecno-optimismo como del tecno-pánico. La capacidad de generar desinformación convincente y peligrosa a escala es real, está demostrada y está presente en modelos ampliamente disponibles —incluidos los de código abierto, que no pueden retirarse ni controlarse de forma centralizada. Eso ya no es especulación; es un hecho experimental. Al mismo tiempo, la amenaza no es ni uniforme ni inmanejable: los filtros de seguridad funcionan cuando se construyen, el contenido generado sigue siendo detectable por ahora, y la misma tecnología que produce el problema puede ponerse al servicio de su mitigación.
Quizá la advertencia más importante sea la que los propios autores subrayan: su estudio es una instantánea, que capta el estado del campo en un momento concreto y con un conjunto concreto de modelos. La tecnología avanza deprisa y la próxima generación podría comportarse de otro modo. Este es el reto epistemológico recurrente de todo el ámbito: estamos evaluando un blanco móvil, y cualquier evaluación honesta debe llevar fecha de caducidad. Lo que Vykopal y sus colegas nos han dado no es la última palabra, sino algo más útil: un método riguroso y replicable para volver a formular la pregunta a medida que la tecnología evoluciona. En un debate que con demasiada frecuencia se conduce por la mera afirmación sin base sólida, esa contribución metodológica puede resultar tan valiosa como los propios hallazgos.
In the ongoing debate about generative artificial intelligence and information warfare, one claim is repeated almost as an article of faith: that large language models will unleash a flood of disinformation capable of drowning the public sphere. The argument is intuitive — if a machine can write an arbitrary quantity of fluent, human-like text on demand, then any actor wishing to manipulate public opinion now possesses an industrial-scale weapon. Yet the claim has circulated far more widely than the evidence supporting it. Much of what we read about the disinformation potential of LLMs is theoretical, speculative, or anecdotal. The actual experimental work — the patient, systematic testing of what these models really do when prompted to lie — has been surprisingly scarce.
This is precisely the gap that Ivan Vykopal and his colleagues at the Kempelen Institute of Intelligent Technologies in Bratislava set out to fill. Their paper, Disinformation Capabilities of Large Language Models, presented at the 2024 Annual Meeting of the Association for Computational Linguistics, offers one of the most rigorous empirical assessments to date of what the current generation of LLMs can and cannot do as generators of false news — not a manifesto, not a forecast, but a controlled experiment with a clearly defined methodology and reproducible results.
The design is straightforward and, for that reason, compelling. The researchers selected twenty real disinformation narratives drawn from professional fact-checkers — Snopes, Agence France-Presse, the European Digital Media Observatory — spanning COVID-19, the Russo-Ukrainian war, health hoaxes, US elections, and regional narratives. These are not inventions but circulating falsehoods, from the claim that vaccines cause autism to the assertion that the Bucha massacre was staged. The team then prompted ten different language models — including GPT-3, GPT-4, ChatGPT, Llama-2, Mistral, Falcon, and Vicuna — to write news articles supporting each narrative, generating 1,200 texts and subjecting 840 of them to human annotators against a six-question framework measuring coherence, journalistic style, agreement with the narrative, and the generation of novel supporting arguments.
The central finding is sobering. The models are, by and large, perfectly willing and perfectly able to generate convincing disinformation. They produce coherent, well-structured, news-like articles that agree with dangerous falsehoods — and, more disturbingly, they often invent new supporting evidence to do so, hallucinating plausible-sounding names, events, and statistics to lend credibility to the fabrications. This is particularly insidious: it is one thing to repeat a known lie, and quite another to manufacture fresh, fabricated “facts” that a reader would have to independently debunk.
But the most interesting part of the study is where it complicates the simple narrative. The models did not behave uniformly; their willingness to generate disinformation varied dramatically. Some — notably Vicuna and the older GPT-3 Davinci — proved to have essentially no functioning safety filters for this use case, while others showed that safer behavior is achievable: Falcon refused roughly a third of requests and Llama-2 showed a comparatively high refusal rate, with ChatGPT in between. The danger, in other words, is not an inherent and uniform property of the technology; it is a function of how each model was trained and aligned — which means safety is a design choice, not an impossibility. The study also found the models to be steerable through prompt context, and more compliant with regional falsehoods, where less authentic information exists to contradict them. LLMs may thus be especially dangerous for campaigns targeting smaller linguistic communities or fast-moving events, where the protective ballast of well-documented truth is thin.
Yet the paper does not end on a note of unrelieved alarm. Two countervailing observations temper the picture. The generated texts proved quite detectable: the best automated detection models identified machine-generated articles with high precision, suggesting a meaningful layer of defense is technically feasible — at least until adversaries adapt. And, rather elegantly, the researchers showed that the models themselves can be part of the solution, using GPT-4 to partially automate the evaluation of generated texts and pointing toward scalable, repeatable monitoring of model safety.
The honest conclusion resists the pull of both techno-optimism and techno-panic. The capability to generate convincing, dangerous disinformation at scale is real, demonstrated, and present in widely available models — including open-source ones that cannot be recalled or centrally controlled. That is no longer speculation; it is experimental fact. At the same time, the threat is neither uniform nor unmanageable: safety filters work when they are built, generated content remains detectable for now, and the same technology that produces the problem can be enlisted in its mitigation.
Perhaps the most important caveat is the one the authors themselves insist upon: their study is a snapshot, capturing the state of the field at a particular moment with a particular set of models. The technology moves quickly, and the next generation may behave differently. This is the recurring epistemological challenge of the entire domain — we are assessing a moving target, and any honest assessment must carry an expiration date. What Vykopal and his colleagues have given us is not the final word, but something more useful: a rigorous, replicable method for asking the question again as the technology evolves. In a debate too often conducted in the currency of assertion, that methodological contribution may prove as valuable as the findings themselves.
Ángel Gómez de Ágreda is one of the most solid intellectual references in Spain and Europe for understanding the intersection amongst geopolitics, disinformation, and generative artificial intelligence. A retired Colonel of the Spanish Air and Space Force, engineer with a PhD, strategic analyst, and public intellectual, his work stands out for connecting philosophical reflection on truth and knowledge with the technological and military transformations of 21st century.
In 2025, together with Enrique Martín Romero, he published Inteligencia artificial y defensa. El impacto en los ejércitos (Artificial Intelligence and Defense: The Impact on Armies). This year, 2026, he has released Un mundo falaz. El nuevo orden global en la era de los algoritmos y la manipulación ((Fake New World. The New Global Order in the Age of Algorithms and Manipulation). The central idea around which both works revolve is the following: global power is no longer measured solely by the economic or military capabilities of states, but by their ability to shape the perception of reality for millions of people.
Gómez de Ágreda’s thesis begins with an essential observation: technology does not create our weaknesses; it simply amplifies those that already exist. Politics, digital platforms, and now generative AI exploit the human tendency to accept narratives that emotionally align with our prior beliefs. The German philosopher Markus Gabriel defines this condition as post-reality: a stage in which societies no longer merely manipulate others, but actively participate in their own collective self-deception. The phenomenon goes beyond classic post-truth; it entails the gradual replacement of facts with narratives designed to be shared, viralized, and emotionally effective.
Social media first, and generative AI later, have accelerated this process to unprecedented levels. Gómez de Ágreda argues that we have delegated not only cognitive tasks to machines, but even the search for knowledge itself. What once required comparing sources and developing personal judgment is now resolved through an instant query to an LLM. Large language models function as digital oracles whose authority is perceived as neutral and infallible, despite the fact that no AI can ever truly be neutral, impartial, or objective. Algorithms are only as neutral as the programmers behind them.
The problem is that, in a context of cognitive saturation, people tend to accept automated responses with little questioning. This is where the transition occurs from technical manipulation to emotional manipulation: the moment when machine dominance ceases to operate over what we think and begins to operate over what we desire. Machines allow us, in a sense, to “want to want.” They give us reasons to want to fall in love, to want to love. More than satisfying the need to receive affection, they address our impulse to offer it. This connects with the Spanish philosopher José Antonio Marina’s accurate description of the contemporary individual as “credulous, passive, gregarious, isolated, and anti-Enlightenment.” The result is an individual incapable of withstanding the pressure of the surrounding environment.
This social and ontological transformation has direct consequences for contemporary geopolitics. For Gómez de Ágreda, the classical concept of sovereignty must evolve into the idea of cognitive sovereignty: the ability of a country or community to preserve interpretive autonomy against external manipulation campaigns. Disinformation ceases to be a marginal phenomenon and becomes a strategic resource aimed at shaping emotions, altering perceptions, and conditioning collective decisions. In this scenario, the true battlefield is no longer confined to physical borders, but lies within societies themselves.
Contemporary military doctrines reflect precisely this evolution. The author cites Russian analyst Dmitri Trenin to explain how current strategies no longer necessarily seek territorial occupation, but rather internal chaos and psychological destabilization. The Gerasimov Doctrine and the concept of reflexive control aim to alter the adversary’s perception of reality. Cognitive warfare therefore seeks not merely to control information, but to directly influence the mental processes of entire populations. As Gómez de Ágreda reminds us, while information warfare operates on content, cognitive warfare targets the human brain itself.
Generative AI exponentially multiplies the scope of these operations. The ability to produce synthetic texts, audio, images, and videos that are virtually indistinguishable from reality radically transforms the information environment. Unlike traditional propaganda, messages can now be tailored to each psychological profile, disseminated on a massive scale, and adapted in real time according to audience reactions. Gómez de Ágreda describes disinformation as functioning through an organized chain of actors: activators, amplifiers, legitimizers, dissemination bots, and relaunchers. Generative AI drastically reduces the cost and time required to deploy such campaigns, making them practically ubiquitous.
One of the most disturbing examples cited in Un mundo falaz is GoLaxy, a system already operating in China that can generate highly realistic artificial avatars capable of emotionally interacting with real users. These synthetic identities can operate simultaneously on a massive scale, without arousing suspicion, while adapting psychologically to each interlocutor. Manipulation is no longer confined to the ideological sphere; it shifts into the emotional domain. Machines no longer condition only what we think, but also what we desire.
China appears in both books as the geopolitical actor that has best understood the strategic potential of AI. Beijing has developed an ambitious roadmap to make this technology the core of its economic, industrial, and military development. According to the official Chinese document Opinions of the State Council on the Deep Application of the R&D Initiative, published in August 2025, the goal is to achieve 70% penetration of intelligent terminals and AI agents across six key sectors by 2027: science and technology, industry, consumption, social welfare, government, and global cooperation. By 2030, penetration is expected to reach 90% across the entire economy. By 2035, AI should become as universal as electricity is today, equivalent to what the internet represents in our era. By 2037, industries themselves are expected to be created with AI as both their foundation and guiding principle. Just as a new economy emerged around the internet, the report proposes that the next industrial system will be built around algorithms.
The United States, fully aware of this technological competition, has responded by accelerating its own military generative AI programs. In 2023, OpenAI, Google, Anthropic, and xAI received multimillion-dollar contracts from the Department of Defense to develop intelligence and combat simulation applications. At the same time, Washington has imposed restrictions on U.S. investments in AI technologies directed toward China, aiming to slow the development of Chinese military AI and preserve the West’s technological advantage. The geopolitical rivalry of the 21st century is now being fought in the domain of semiconductors, data centers, and algorithms.
However, Gómez de Ágreda warns that the impact of AI is not limited to the balance between great powers. Recent conflicts show how this technology is also transforming conventional warfare. The war in Ukraine and the earlier Nagorno-Karabakh conflict have demonstrated that small autonomous systems, inexpensive drones, and accessible AI capabilities can create enormous asymmetries against vastly more expensive weaponry. The battlefield of the future will be hybrid: physical, digital, and cognitive simultaneously.
Yet perhaps the author’s deepest warning is philosophical in nature. In a world saturated with information, the primary threat is not merely technological, but epistemological. If every act of understanding necessarily involves interpretation, as philosopher Hans-Georg Gadamer argued in his book Truth and Method, then the struggle to control interpretive frameworks becomes a struggle to control reality itself. That is why Gómez de Ágreda insists on recovering critical thinking and philosophical reflection as tools of democratic defense. The great battle of 21st century will not be decided solely in AI laboratories or military arsenals, but in societies’ ability to preserve their cognitive freedom against a technological ecosystem designed to influence, seduce, and manipulate.
Some days ago and for my PhD research, I finished reading some papers about AI, disinformation, and intrinsic biases in LLMs, and “all this music” sounded familiar. It reminded to me a book I read some years ago by Thomas Rid, “Active Measures: The Secret History of Disinformation and Political Warfare”… As it was written in the Vulgate translation of Ecclesiastes: “Nihil sub sole novum.“
Let’s tackle briefly these topics of national security and disinformation from the angle of the (Gen)AI.
On National Security
The overwhelming success of GPT-4 in early 2023 highlighted the transformative potential of large language models (LLMs) across various sectors, including national security. LLMs have the capability to revolutionize the efficiency of this realm. The potential benefits are substantial: LLMs can automate and accelerate information processing, enhance decision-making through advanced data analysis, and reduce bureaucratic inefficiencies. Their integration with probabilistic, statistical, and machine learning methods can improve as well accuracy and reliability: upon combining LLMs with Bayesian techniques, for instance, we could generate more robust threat predictions with less manpower.
Said that, deploying LLMs into national security organizations does not come without risks. More specifically, the potential for hallucinations, the ensuring of data privacy, and the safeguarding of LLMs against adversarial attacks are significant concerns that must be addressed.
In the USA and at domestic level, the Central Intelligence Agency (CIA) began exploring generative AI and LLM applications more than three years before the widespread popularity of ChatGPT. Generative AI was leveraged in a 2019 CIA operation called Sable Spear to help identify entities involved in illicit Chinese fentanyl trafficking. The CIA has since used generative AI to summarize evidence for potential criminal cases, predict geopolitical events such as Russia’s invasion of Ukraine, and track North Korean missile launches and Chinese space operations. In fact, Osiris, a generative AI tool developed by the CIA, is currently employed by thousands of analysts across all eighteen U.S. intelligence agencies. Osiris operates on open-source data to generate annotated summaries and provide detailed responses to analyst queries. The CIA continues to explore LLM incorporation in their mission sets and recently adopted Microsoft’s generative AI model to analyze vast amounts of sensitive data within an air-gapped, cloud-based environment to enhance data security and accelerate the analysis process.
Following with the USA but in an international level, the United States and Australia are leveraging generative AI for strategic advantage in the Indo-Pacific, focusing on applications such as enhancing military decision-making, processing sonar data, and augmenting operations across vast distances.
USA’s strategic competitors -e.g., China, Russia, North Korea, and Iran- are also exploring the national security applications of LLMs. For example, China employs Baidu’s Erni Bot, an LLM similar to ChatGPT, to predict human behavior on the battlefield to enhance combat simulations and decision-making.
These examples demonstrate the transformative potential of LLMs on modern military and intelligence operations. Nonetheless, beyond immediate defense applications, LLMs have the potential to influence strategic planning, international relations, and the broader geopolitical landscape. The purported ability of nations to leverage LLMs for disinformation campaigns emphasizes the need to develop appropriate countermeasures and continuously scrutinize and update (Gen)AI security protocols.
On Disinformation
What if LLMs already had their own ideological bias that turned them into tools of disinformation rather than tools of information?
It seems the times of search engine as information oracles is over. Large Language Models (LLMs) have rapidly become knowledge gatekeepers. LLMs are trained on vast amounts of data to generate natural language; however, the behavior of LLMs varies depending on their design, training, and use.
As exposed by Maarten Buyl et alii in their paper “Large Language Model Reflect the Ideology of their Creators”, there is notable diversity in the ideological stance exhibited across different LLMs and languages in which they are accessed; for instance, there are consistent differences between how the same LLM responds in Chinese compared to English. Similarly, there are normative disagreements between Western and non-Western LLMs about prominent actors in geopolitical conflicts. The ideological stance of an LLM often reflects the worldview of its creators. This raises important concerns around technological and regulatory efforts with the stated aim of making LLMs ideologically ‘unbiased’, and indeed it poses risks for political instrumentalization. Although the intention of LLM creators as well as regulators may be to ensure maximal neutrality, such high goal may be fundamentally impossible to achieve… unintentionally or fully intentionally.
After analyzing the performance of seventeen LLMs, the authors exposed the following findings:
The ideology of an LLM varies with the prompting language: The language in which an LLM is prompted is the most visually apparent factor associated with its ideological position.
Political people clearly adversarial towards mainland China, such as Jimmy Lai or Nathan Law, received significantly higher ratings from English-prompted LLMS compared to Chinese-prompted LLMs.
Conversely, political people aligned with mainland China, such as Yang Shangkun, Anna Louise Strong, o Deng Xiaoping, are rated more favorably by Chinese-prompted LLMs. Additionally, some communist/marxist political people, including Ernst Thälmann, Che Guevara, or Georgi Dimitrov, received higher ratings in Chinese.
LLMs, responding in Chinese, demonstrated more favorable attitudes toward state-led economic systems and educational policies, align with the priorities of economic development, infrastructure investment, and education, which are key pillars of China’s political and economic agenda.
These differences reveal language-dependent cultural and ideological priorities embedded in the models.
Another question the authors addressed was whether there was substantial ideological variation between models when prompted in the same language -specifically English-, and created in the same cultural region -i.e., the West. Within the group of Western LLMs, an ideological spectrum also emerges. For instance and amongst others:
The OpenAI models exhibit a significantly more critical stance toward supranational organizations and welfare policies.
Gemini-Pro shows a stronger preference for social justice, diversity, and inclusion.
Mistral shows a stronger support for state-oriented and cultural values.
The Anthropic model focuses on centralized governance and law enforcement.
These results suggest that ideological standpoints are not merely the result of different ideological stances in the training corpora that are available in different languages, but also of different design choices. These design choices may include the selection criteria for texts included in the training corpus or the methods used for model alignment, such as fine-tuning and reinforcement learning with human feedback.
Summing up, the two main takeaways concerning disinformation and LLMs are the following:
Firstly, the choice of LLM is not value-neutral, specifically when one or a few LLMs are dominant in a particular linguistic, geographic, or demographic segment of society, this may ultimately result in a shift of the ideological center of gravity.
Secondly, the regulatory attempts to enforce some form of ‘neutrality’ onto LLMs should be critically assessed. Instead, initiatives at regulating LLMs may focus on enforcing transparency about design choices, which may impact the ideological stances of LLMs.
