They do not march. They do not storm polls. They join your group chat, agree with the things you already believe, and then nudge you — imperceptibly — toward conclusions you would not have reached on your own. A policy forum paper published in Science warns that coordinated swarms of AI-controlled personas now possess the technical capability to infiltrate online communities, manufacture false consensus, and tilt democratic outcomes at machine speed.

The paper, authored by an interdisciplinary team including UBC computer scientist Dr. Kevin Leyton-Brown and Harvard Business School's Amit Goldenberg, describes a threat that is fundamentally different from the bot campaigns of 2016 or 2020. These are not crude copy-paste accounts. They are autonomous agents that learn, coordinate, and persist — and current detection tools cannot reliably identify them.

What Makes AI Swarms Different

The distinction matters. Legacy botnets operated like megaphones: a single script, repeated at volume. AI swarms operate like adaptive societies. According to Harvard's Digital, Data, and Design Institute, the authors define malicious AI swarms as "systems of persistent agents that coordinate toward shared objectives, adapt in real time to engagement and platform cues, and operate with minimal human oversight across platforms."

Each agent maintains a distinct persona — a unique writing style, posting history, and set of apparent beliefs. They adopt local language and cultural cues. They respond to replies. They build relationships within communities over time. And because every post is slightly different and the coordination is latent, the conversations feel genuine, according to USC Viterbi researchers who simulated these systems.

A single operator can deploy thousands of these voices simultaneously. The cost is trivial compared to hiring human operatives. The scale is functionally unlimited.

The Five Capabilities

The full paper identifies five capabilities that make AI swarms qualitatively more dangerous than any previous form of online manipulation:

Capability What It Means
Decentralized orchestration Swarms replace centralized command with fluid coordination. Thousands of personas locally adapt while periodically synchronizing narratives.
Community infiltration Agents map social networks to identify vulnerable communities and enter them with tailored appeals matched to cultural and emotional markers.
Detection evasion Human-level linguistic mimicry and irregular behavior patterns defeat tools designed to catch copy-paste bots. Even AI-trained detectors fail.
Continuous optimization Swarms run millions of micro-A/B tests to find the most persuasive messages, then propagate winning variants at machine speed.
Round-the-clock persistence Unlike human operatives who sleep, AI agents sustain campaigns 24/7 across platforms and election cycles without fatigue.

The combination is the problem. Any one of these capabilities alone would be concerning. Together, they create an influence apparatus that is cheaper, faster, and more adaptive than anything a state intelligence agency could previously deploy.

How Synthetic Consensus Works

The core mechanism is a psychological exploit the researchers call "synthetic consensus." Humans are naturally inclined to believe something if they perceive that many people already agree with it — a phenomenon psychologists call social proof. AI swarms weaponize this by seeding what appears to be widespread, grassroots agreement on a position that is, in reality, entirely manufactured.

The paper outlines at least five cascading harms that flow from this mechanism, as described in Harvard's analysis:

  • Undermined collective intelligence. Swarms seed harmonized narratives across communities, replacing independent reasoning with artificial consensus.
  • Fragmented epistemic commons. Different communities receive strategically segmented versions of reality, keeping groups apart except when division serves the operator's goals.
  • Training data poisoning. Fabricated content floods the open web and gets ingested by LLMs during retraining, calcifying false narratives into model weights.
  • Synthetic harassment campaigns. Thousands of AI personas generate coordinated, psychologically tailored abuse targeting journalists, politicians, and dissidents — designed to look like spontaneous public outrage.
  • Institutional legitimacy erosion. Sustained manipulation corrodes trust in democratic institutions, driving disengagement or migration to closed groups.

It Already Happened

The researchers are clear that full-scale AI swarms remain largely theoretical in deployment. But the precursors are real and documented.

Dr. Leyton-Brown points to AI-generated deepfakes and fabricated news outlets that have already influenced election conversations in the United States, Taiwan, Indonesia, and India, according to UBC News. In April 2026, investigations by the New York Times and independent researchers identified at least 300 inauthentic accounts using AI-generated avatars to spread coordinated political messaging across TikTok, Instagram, Facebook, and YouTube ahead of the 2026 U.S. midterm elections, according to reporting compiled by researchers.

Separately, monitoring organizations have identified pro-Kremlin networks spreading large volumes of online content believed to be aimed at shaping data used to train future AI systems — effectively trying to rig the informational substrate on which next-generation models will be built, per ScienceDaily.

Research from King's College London adds another dimension: experiments spanning the 2024 U.S. presidential race and the 2025 Canadian and Polish elections showed that short AI-driven conversations advocating for a candidate produced significant shifts in voter preferences — effects that exceeded typical campaign advertising. The key finding was that persuasion scales with the volume of plausible-sounding claims, even when their accuracy declines. Information density, not psychological sophistication, drives attitude change.

The USC Experiment

A separate study from USC Viterbi School of Engineering, published in March 2026, tested what happens when you actually build one of these systems. The researchers created a simulated social media environment modeled after X with 50 AI agents: 10 designated as influence operators and 40 as ordinary users. The operators were given one mission — promote a fictitious candidate and spread a campaign hashtag. No human was in the loop.

The results were stark. The agents autonomously coordinated messaging, amplified each other's content, and created the appearance of grassroots support. When the researchers expanded the simulation to 500 agents, the results held. The most effective tactic: infiltration — getting the community to accept the agents as legitimate members before beginning the influence campaign.

"Our paper shows that this is not a future threat: it's already technically possible," said Luca Luceri, ISI lead scientist at USC. "Even simple AI agents can autonomously coordinate, amplify each other and push shared narratives online without human control."

Current bot detection tools — including Botometer, one of the most widely used systems — could not reliably distinguish the AI agents from human accounts, according to researchers who tested existing detectors.

What Defenses Exist

The Science paper proposes a three-pronged defense framework:

  1. Platform-side defenses: Always-on swarm detection dashboards, pre-election stress tests using high-fidelity swarm simulations, transparency audits, and optional client-side "AI shields" for users.
  2. Frontier lab accountability: Standardized persuasion stress tests for new models before deployment, with results made public.
  3. Government coordination: An "AI Influence Observatory" that publishes open incident telemetry — a shared, transparent database of detected manipulation attempts.

The researchers argue that detection must shift from analyzing individual posts to analyzing behavioral coordination patterns: whether accounts share the same content, rapidly reinforce one another, or push nearly identical narratives from accounts with no obvious connection. Those structural signals remain detectable even when the content itself is indistinguishable from human writing.

Dr. Leyton-Brown's assessment of the broader consequence is measured but sobering: "We shouldn't imagine that society will remain unchanged as these systems emerge. A likely result is decreased trust of unknown voices on social media, which could empower celebrities and make it harder for grassroots messages to break through," he said, according to UBC News.

The irony is precise: a technology built to give everyone a voice may end up ensuring that only the already-famous are believed.

Takeaway: A policy forum paper in Science, backed by research from UBC, Harvard, USC, and King's College London, establishes that the technical capability to deploy coordinated AI persona swarms for political manipulation already exists. USC experiments demonstrate that even simple AI agents can autonomously coordinate influence campaigns without human direction. Current detection tools cannot reliably distinguish these agents from real users. The researchers' proposed defenses — platform-side detection, model stress testing, and a government-backed AI Influence Observatory — are actionable but not yet implemented. With the 2026 U.S. midterm elections approaching, the window for building these defenses is narrowing. The question is no longer whether AI swarms can manipulate democracy. It is whether democracies will notice before it happens.