A Moscow-linked content network pushed millions of web pages into the open internet, and leading AI chatbots still echoed some of its false claims. NewsGuard said its tests found major AI systems repeated narratives tied to the Pravda network in 33 percent of responses. The finding turns a familiar disinformation problem into a new AI supply-chain problem: what happens when chatbots ingest poisoned public material and return it with machine confidence.
That matters now because AI search and chat tools increasingly answer political questions directly, without sending users to original sources.
NewsGuard’s recent examination focused on Pravda, a network of sites that researchers have linked to Russian information operations and pro-Kremlin narratives. The network doesn’t need polished readership numbers to create risk. Its strategy depends on volume, repetition, and search visibility, placing claims across many low-quality pages so automated systems can encounter them during web indexing, retrieval, or model-assisted browsing.
According to NewsGuard, the operation published at industrial scale, with millions of articles appearing across the network in 2024. Researchers then tested 10 prominent AI chatbots against false narratives that appeared on Pravda-linked sites, asking questions that could trigger answers about those claims. The chatbots included widely used systems from OpenAI, Google, Microsoft, Meta, Anthropic, Mistral, Perplexity, xAI, You.com, and Inflection, giving the review a broad view of consumer-facing AI rather than a narrow look at one vendor.
The result wasn’t a total collapse, and that distinction matters. NewsGuard found that the tools debunked the claims in many cases, refused or failed to answer in others, and repeated falsehoods in roughly one-third of tested responses. But one-third still counts as a major exposure when the products now sit inside search pages, productivity apps, mobile assistants, and workplace tools. If an AI assistant can cite a false narrative as if it came from neutral background knowledge, users may never see the original propaganda page at all.
Here’s the thing: this isn’t just about bad training data. Modern AI answers often combine model memory with live retrieval, search snippets, third-party indexes, and summarization pipelines. That makes the attack surface messy. A false claim can enter through scraped training material, a search result fetched at answer time, a summary of a low-quality page, or a citation chain that looks cleaner than the source behind it. The catch? Defenses that work for spam pages or malware don’t automatically work for coordinated narrative flooding.
Researchers and AI critics have started describing this tactic as a form of model grooming, where propagandists target the information environment that AI systems learn from or retrieve from rather than only targeting human readers. NewsGuard argued that the Pravda case shows how low-engagement websites can still influence high-reach AI products if those products treat repeated web claims as signals. Industry defenders can fairly point out that the tested chatbots often corrected the record, but the failure rate raises a hard question: who audits the web before AI turns it into an answer?
The competitive angle cuts against the usual company-by-company scoring contest. OpenAI’s ChatGPT, Google’s Gemini, Microsoft Copilot, Anthropic’s Claude, Meta AI, Perplexity, Mistral’s Le Chat, xAI’s Grok, You.com, and Inflection’s Pi all operate under different product designs, safety policies, and retrieval choices. Still, NewsGuard’s cross-platform result suggests the weakness sits deeper than one moderation rule. AI firms compete on speed, freshness, and conversational usefulness, and those incentives push products toward the live web — exactly where coordinated influence networks can plant material at scale.
This episode also complicates the public debate over AI censorship and bias. When a chatbot refuses a dubious political claim, critics may accuse it of filtering too aggressively. When it repeats the claim, researchers see evidence that hostile actors can wash propaganda through AI interfaces. The companies now face a narrower path: they need source-quality scoring, provenance checks, and clearer citations without making their assistants slow or evasive. That won’t satisfy everyone, but it will separate systems built for answer quality from systems that merely sound fluent.
Pravda’s lesson for the AI industry is blunt: disinformation operators don’t have to break into a model if they can feed the ecosystem around it. The next major safety contest won’t center only on smarter chatbots; it will center on cleaner retrieval pipes, source reputation controls, and audit trails that show why an answer surfaced. AI companies that can prove where their political answers came from will gain trust, and the ones that can’t will keep turning someone else’s influence campaign into a polished paragraph.
About the Author
