OpenAI Disrupts Operation Helgoland Bite Russian Influence Campaign

OpenAI has banned ChatGPT accounts used by a Russia-linked actor to conduct a German-language influence operation dubbed "Operation Helgoland Bite." The actor used OpenAI models to generate critical commentary on the US and NATO and to produce content supporting the Alternative für Deutschland (AfD) party ahead of the 2025 German election.

Network Infrastructure and Distribution Channels

Operation Helgoland Bite utilized a multi-platform distribution strategy to spread AI-generated content. The operation was centered around a Telegram channel named "Nachhall von Helgoland" (Echo of Helgoland), which had 1,755 subscribers at the time of investigation. Content from this channel was reposted verbatim on a domain affiliated with the Pravda network, a known node in the Moscow-linked "Portal Kombat" covert influence network previously identified by the French government's VIGINUM service.

Additionally, the actor operated an X account with over 27,000 followers. This account used an AI-generated profile image and frequently posted AI-generated content supporting the AfD party.

Model Usage and Threat Actor Behavior

The threat actor used OpenAI models for several specific tasks beyond content generation:

  • Content Production: Generating short articles and social media comments in German.
  • Information Gathering: Requesting publicly available information and contact details for German opposition activists and bloggers.
  • Translation: Translating short texts from Russian into German, with language usage consistent with conversational traffic and messaging.
  • Coordination: Some translated messages discussed the coordination of posting times for social media content and referenced payments.

Impact Assessment

OpenAI assesses the impact of Operation Helgoland Bite using the Brookings Institution's Breakout Scale for influence operations (IO). The activity is categorized as being toward the upper end of Category 2.

This classification indicates that while the activity occurred across multiple platforms (Telegram, X, and the Pravda network), there was little authentic engagement or evidence that the content was widely shared among the rest of the population.

Sources