# Bad Grammar (Influence Operation) Bad Grammar is a small Russia-based influence operation, mostly on [[Telegram]], that [[OpenAI]] disclosed and disrupted in its first public threat report on covert influence operations, published May 30, 2024. Nobody had reported it before. It targeted audiences in Ukraine, Moldova, the Baltic states and the United States. ## How it used AI OpenAI found the operators using its models for two things: debugging the code for a Telegram bot that posted automatically, and writing short political comments in Russian and English. The resulting posts went out through Telegram channels and accounts. ## The May 2024 report Bad Grammar was one of five operations OpenAI disrupted over the preceding three months: | Operation | Origin | Use of OpenAI tools | |---|---|---| | Bad Grammar | Russia | Telegram bot code; short comments | | [[Doppelganger]] | Russia | Comments in five languages on X and 9GAG; translated articles | | Spamouflage | China | Multilingual posts; code debugging | | IUVM | Iran | Long-form articles and headlines | | Zero Zeno | Israel (commercial firm STOIC) | Posts for Instagram, Facebook and X | OpenAI rated all five on the Brookings Breakout Scale, which runs from 1 to 6. None scored higher than Category 2: present on several platforms, but not breaking out into authentic communities. Axios reported the same low-severity assessment. ## Later Russian operations in OpenAI reports OpenAI's later reports have flagged further Russia-origin operations: - **"Helgoland Bite" (June 2025):** German-language, pro-[[AfD]] content around Germany's 2025 election. Its output was reposted on a domain tied to the [[Pravda Network]]. - **August 25, 2026:** a fake think tank, the "International Burke Institute," with a "Burke Sovereignty Index." OpenAI said the accounts "very likely originated in Russia" and rated it at the low end of Category 3. ## Why it matters for the KB Bad Grammar matters less for its effect than for what it shows. AI companies are now among the main sources of public attribution of influence operations, through their own threat reports. Their visibility depends on the operations using their products, which pushes operators toward self-hosted models — exactly the move [[Recorded Future]] documented in [[Storm-1516]]. ## See Also - [[OpenAI]] - [[Doppelganger]] - [[Pravda Network]] - [[Storm-1516]] - [[Large Language Model]] - [[Kremlin Disinformation]]