Christo Grozev was sitting in a New York cafe in February 2023, expecting to fly back to his home in Vienna that evening, when US law enforcement officials delivered some news that changed his life. “I was told that it’s not a good idea for me to leave back to Austria, because there’s been some intelligence suggesting there’s a red team waiting for you,” said Grozev, a Bulgarian-born investigative journalist who has infuriated the Kremlin by exposing numerous Russian intelligence operatives in recent years. “My question was: ‘Could this be just hacking and surveillance?’ And they said: ‘From what we’ve seen, it’s definitely more than that.’” That was the only information Grozev was given, but he did not board that flight. A few weeks later, news came of coordinated arrests in Britain of members of a Bulgarian spy ring believed to be working for Russian intelligence. Last week at the Old Bailey, [a jury found three of the group](https://www.theguardian.com/world/2025/mar/07/three-bulgarian-nationals-found-guilty-spying-russia-uk) – Katrin Ivanova, Vanya Gaberova and Tihomir Ivanov Ivanchev – guilty on espionage-related charges. Over [many weeks of court hearings](https://www.theguardian.com/world/2025/mar/07/spy-trial-scheming-bluster-tangled-relationships), the jury heard how the trio were part of a group that travelled to Vienna and other European locations to surveil Grozev. Plans were developed to kidnap and deliver him to Russian operatives, which ultimately were never implemented. The plotters’ ideas were sometimes more bluster than substance, and occasionally prompted laughter from the jury, but Grozev said he was relieved at the guilty verdict nonetheless. “They may have come across as muppets, but it’s clear that their plans could have been incredibly dangerous,” he said. Grozev first came to prominence with his work for Bellingcat, a group of online sleuths who used traditional journalistic tools combined with combing leaked Russian databases to identify Russian operatives – first [uncovering the suspects in the 2018 Salisbury novichok poisoning](https://www.theguardian.com/uk-news/2018/sep/27/we-got-really-lucky-novichok-suspects-identities-revealed-bellingcat) of Sergei Skripal and his daughter, who were from Russia’s GRU military intelligence agency. Two years later, he [identified the FSB poisoning squad](https://www.theguardian.com/world/2021/jan/17/poison-squad-stalked-alexei-navalny-on-40-flights-says-bellingcat-investigator) behind the attempt to kill the opposition leader Alexei Navalny, also with novichok nerve agent. At the time, Navalny called him “a modern-day Sherlock Holmes”. These investigations apparently put Grozev firmly in the sights of Russia’s vengeful intelligence apparatus, along with his collaborator, [the Russian journalist Roman Dobrokhotov](https://www.theguardian.com/world/2025/mar/08/burn-him-alive-on-the-street-the-russian-journalist-targeted-in-uk-by-spy-ring-tasked-with-his), with whom he now works for the online outlet the Insider, and who was also surveilled by the Bulgarian ring. While he knew there was a danger of reprisals for his work, the appearance of a concrete threat forced him to introduce new security measures into his life. But just as he was adapting to them, in the weeks after the initial warning in New York, he received more unwelcome news – his father had died unexpectedly in Austria. “I had to breach all of these instructions and fly there to attend to the funeral,” he said. On that visit, he spent three days living in a safe house, but there was no burial because Austrian police impounded his father’s body for tests to see if there was anything suspicious. Grozev said he never received a conclusive answer as to whether there was any foul play, but seeing evidence presented in the London trial of how the Bulgarian ring had located his father’s apartment led to increased suspicion. _“_I had written it off as a coincidence, but something that brought that story back is the photo of Ivanova in front of my dad’s apartment with an arrow on how to get into it. I guess we’ll never know,” he said. During the trip back for his father’s funeral, the Austrians told Grozev the group tracking him apparently had links to Jan Marsalek, the Austrian-born fugitive executive of Wirecard, who is accused of coordinating his actions with handlers in the Russian intelligence structures. Marsalek contracted a Bulgarian living in Britain, Orlin Roussev, to run the spy ring. Roussev pled guilty and did not stand trial, but the evidence included thousands of messages exchanged between him and Marsalek, who is believed to be in Moscow. Grozev had published numerous investigations into Marsalek, an unusual player in the global espionage game. He is wanted in Europe over a €1.9bn (£1.6bn) bank fraud, and disappeared soon after news of the scandal broke in 2020. Reporting by Der Spiegel suggests he may have been recruited by Russia as early as 2014. In the messages presented to the Old Bailey, Marsalek repeatedly refers to discussions with “our friends” over mission planning, suggesting that he became a trusted freelancer for the Russian intelligence services. [skip past newsletter promotion](https://www.theguardian.com/world/2025/mar/10/they-came-across-as-muppets-christo-grozev-on-being-target-of-bulgarian-spy-ring#EmailSignup-skip-link-15) Sign up to First Edition Our morning email breaks down the key stories of the day, telling you what’s happening and why it matters **Privacy Notice:** Newsletters may contain info about charities, online ads, and content funded by outside parties. For more information see our [Privacy Policy](https://www.theguardian.com/help/privacy-policy). We use Google reCaptcha to protect our website and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. after newsletter promotion Grozev sees in Marsalek a successful businessman who developed supervillain ambitions: “He got so much money so early on, he scammed so many people early on, and he just wanted to be bigger than just a super-rich guy, he wanted to be an international player,” he said. Numerous intelligence agencies would have tried to recruit Marsalek, Grozev believes, as his Wirecard company offered “cash conversion capabilities” that every intelligence agency needs. “But not everyone offered that he could become one of them, and the Russians did,” he said. Engaged by Marsalek, Roussev ordered his Bulgarian ring to track Grozev and Dobrokhotov. Over a period of many months, the team followed Grozev, covertly recorded him, had Gaberova friend him on Facebook with the goal of setting up a honey-trap sting, and even claimed to have broken into his Vienna apartment. A plan was discussed to launch a kidnap mission during a visit to Kyiv, but this was called off by Marsalek at the last minute. Grozev does not recall ever spotting his unwanted followers, but his teenage daughter may have done so. On one occasion, when he took her to an outdoor restaurant in Vienna for lunch, she told him she thought there was a Russian spy surveilling them. “She told me: ‘He’s been walking back and forth like four times, and every time I look at him, he raises his camera and he pretends to be filming or take photographs of the building above us. And this building is very ugly, so there’s nothing to photograph!’” At the time, Grozev told his daughter to leave the spy tracking to him, but much later, it transpired that this was the day on which Ivanchev had been tracking Grozev in Vienna. These days, he prefers not to disclose too much about his current living arrangements, but he has been forced to stay away from Vienna. “I have no idea where my home is. Apparently it cannot be Bulgaria, it cannot be Austria or any Schengen country. There is a feeling of unrootedness that has plagued me for two years now.” _Antidote, a documentary film featuring Christo Grozev and his investigations, is in select cinemas from 14 March, and will be shown as Kill List: Hunted by Putin’s Spies on Channel 4 on 25 March._

Apr 16, 2025 6:17 PM With the Global Engagement Center shut down, the State Department is now set to investigate whether past US efforts against foreign propaganda amounted to censorship of Americans.  Photograph: Win McNamee/Getty Images The Global Engagement Center, a State Department unit that called out Russian and Chinese propaganda campaigns and became a MAGA boogeyman, has been shut down. Team Trump is promising that it’s just the start of an examination of alleged censorship during the Biden administration—and the first Trump administration too. Secretary of State Marco Rubio called the move “[a crucial step toward keeping the president’s promise to liberate American speech](https://thefederalist.com/2025/04/16/rubio-to-protect-free-speech-the-censorship-industrial-complex-must-be-dismantled/)” in an op-ed for the right-wing site The Federalist. Critics say it’s part of a larger effort by the Trump administration to withdraw from a decades-long contest of ideas and information with America’s adversaries. In early February, Attorney General Pam Bondi disbanded the Justice Department task force on [covert foreign influence](https://www.rollingstone.com/politics/political-commentary/trump-eric-adams-make-america-corrupt-again-1235263142/) and radically narrowed enforcement of the law that [outlawed secretive propaganda for overseas regimes](https://www.cnn.com/2025/02/06/politics/bondi-trump-election-fara-justice/index.html). The Trump administration gutted the parent organization of the Voice of America, Radio Free Europe, and Radio Free Asia, which aimed to provide news and demonstrate the value of a free press in regions of the world where both were often in short supply. Together, according to The Washington Post, they reached a [weekly audience of 420 million people in 63 languages](https://www.washingtonpost.com/politics/2025/03/16/trump-voa-voice-of-america/). “Most shameful moment at the department since the purges of the 1950s,” one State Department official, who was granted anonymity because they are not authorized to talk to the press, tells WIRED. To Trumpists, the push to publish American-style news around the world was an outdated waste of taxpayer money, and attempts to combat disinformation abroad, even if their origins were benign, were really attempts to silence right-wing Americans. The Global Engagement Center, or GEC, became a particular fixation. “The worst offender in US government censorship & media manipulation is an obscure agency called GEC,” Elon Musk [posted](https://x.com/elonmusk/status/1622739987031552002) in 2023. (MIT Technology Review [first reported the news of its closure](https://www.technologyreview.com/2025/04/16/1115256/us-office-that-counters-foreign-disinformation-is-being-eliminated-say-officials/).) (“The allegations of ‘censorship’ against the GEC are as fictitious as the conspiracy theories spun by various bad-faith actors around international broadcasting and other long-standing institutions of American soft power now under attack,” said the State Department official.) First established during the war on terror to counter and keep tabs on militant messaging overseas, the GEC expanded over the Obama, Trump, and Biden administrations into a $60-million, 120-person shop which also tracked and exposed rival nation-state campaigns to spread propaganda and pollute the information environment. It mapped a multibillion-dollar [Chinese influence program](https://www.state.gov/wp-content/uploads/2023/09/HOW-THE-PEOPLES-REPUBLIC-OF-CHINA-SEEKS-TO-RESHAPE-THE-GLOBAL-INFORMATION-ENVIRONMENT_Final.pdf) that stretched from Pakistan to Latin America. It looked into the social media accounts [boosting Germany’s far-right AfD party](https://fedscoop.com/wp-content/uploads/sites/5/2024/11/GEC2021-EUR-99221AUG.pdf) and [spreading neo-Nazi propaganda](https://fedscoop.com/wp-content/uploads/sites/5/2024/11/Technical-Report_Option.pdf). It revealed a covert Russian effort to [undermine public health in Africa](https://web.archive.org/web/20240416201414/https://www.state.gov/the-kremlins-efforts-to-spread-deadly-disinformation-in-africa/). And the GEC called out the Kremlin’s claims that the “United States worked with Ukraine to [train an army of migratory birds](https://web.archive.org/web/20230314191503/https://www.state.gov/the-kremlins-never-ending-attempt-to-spread-disinformation-about-biological-weapons/), mosquitos, and even bats to carry biological weapons into Russia.” Sometimes, with grants of just a few thousand dollars, it funded the work of journalists in countries targeted by the Putin regime. “We were really focused on building the capacity of folks that were already doing that good work and making sure that they had the platform to continue to tell their stories—to tell the truth in an environment that was trying to take that from them,” a second State Department source tells WIRED. Over the years, the GEC’s [effectiveness](https://www.stateoig.gov/uploads/report/report_pdf_file/isp-i-22-15.pdf) and [execution](https://www.oversight.gov/sites/default/files/documents/reports/2023-07/Final-Report-Audit-GEC-20-April-2020-51523Redacted.pdf) were questioned by the State Department’s Inspector General, [among others](https://www.vanityfair.com/news/2018/04/russia-propaganda-america-information-war?srsltid=AfmBOorqnUu-Y_bIy8MT1LjbZTHntb6rvSG2fcAU9h1uql7B6VpiOUfd). But the GEC and efforts like it generally received bipartisan support. That started to change after the pandemic—and Musk’s purchase of Twitter. The so-called “[Twitter Files](https://x.com/mtaibbi/status/1610394203422433280)”—reports based on Musk’s release of internal company emails—seemed to show the GEC being far too aggressive in its attempts to tamp down on alleged Covid disinformation during Trump’s first term. Republican critics like US Representative Brian Mast of Florida complained that the GEC wasn’t being aggressive enough in [support of Israel](https://www.youtube.com/watch?v=xPCD0VGmmok&t=2s&ab_channel=HouseForeignAffairsCommitteeRepublicans) after October 7. Other GOP congresspersons [zeroed in](https://www.breitbart.com/politics/2023/02/15/report-marco-rubio-ron-johnson-demand-investigation-into-government-backing-group-leading-conservative-media-blacklist/) on its [$100,000 grant](https://www.washingtonpost.com/opinions/2024/03/19/house-republicans-disinformation-global-engagement-center/) to the UK-based Global Disinformation Index to monitor media in Asia. The Index later compiled a list of the 10 American news outlets at highest risk of publishing false claims; nearly all of them [were MAGA-friendly](https://web.archive.org/web/20230301230830/https://www.disinformationindex.org/research/2022-10-21-brief-disinformation-risk-in-the-united-states-online-media-market-october-2022/). This was an entirely separate project from the one the GEC funded, but Trumpists saw the existence of the list as evidence that it was suppressing speech at home when it was supposed to be looking abroad. “GEC’s history shows the pernicious way Washington turns laudable public goals into a means of entrenching its own power and rolling back the freedom of regular Americans,” Rubio wrote in his op-ed. “Over the past half-decade, bodies like GEC, crafted by our own governing ruling class, nearly destroyed America’s long free speech history. The enemies of speech had new lingo to justify their authoritarian impulse. It was ‘disinformation,’ allegedly pushed by nefarious foreign governments, that was the No. 1 threat to ‘our democracy.’ To protect ‘our democracy,’ this ‘disinformation’ had to be identified and stamped out.” A famously conservative US court of appeals [rejected this idea](https://www.nytimes.com/2023/12/14/technology/state-department-disinformation-criticism.html), writing that “there is no indication that State Department officials flagged specific content for censorship.” But by then, the GEC was poison in MAGA minds. Its participation in a State Department campaign accusing Kremlin-funded media outlet RT of being [an intelligence operation](https://www.washingtonpost.com/world/2024/09/13/rt-propaganda-intelligence-weapons-ukraine/) did not change their opinions. The GEC was cleared of “having anything to do with domestic suppression of points of view. But what was going on was that they decided that this was a winnable, small victory they could have over this ‘liberal institution,’” according to a diplomatic source with direct knowledge of the matter. A December deal to reauthorize funding for the GEC, due to run out in 2024, [fell apart](https://apnews.com/article/congress-budget-trump-musk-johnson-5dc9fd8672f9807189032811d4ab0528) after “Elon Musk got involved,” that source said; the center was officially disbanded, but about 50 staffers and $30 million in funding were moved to a “[Counter Foreign Information Manipulation and Interference Hub](https://nypost.com/2025/01/02/us-news/biden-admin-rebranding-state-depts-shuttered-gec-under-new-name-with-same-staff-report/)” in the hopes of proving the value of such an operation to their new MAGA superiors. They were also given a new boss, Undersecretary of State for Public Diplomacy [Darren Beattie](https://www.state.gov/biographies/darren-beattie/). The name may sound familiar. Beattie had left a trail of trolly posts on Musk’s social media platform—[promoting the Holocaust denier Nick Fuentes](https://jewishinsider.com/2025/02/darren-beattie-marco-rubio-undersecretary-of-state-trump/), for instance, and musing that “[competent white men must be in charge if you want things to work](https://x.com/dthekingpin/status/1886473544458023386?s=46&t=lO03GaaQiKwBXh8cK5OsOQ).” He also called his future boss Marco Rubio “[low IQ](https://www.cnn.com/2025/03/10/politics/darren-beattie-marco-rubio-deleted-tweets-kfile/index.html).” Rubio, until recently, was hawkish about fighting foreign influence campaigns. In 2023, a second diplomatic source with direct knowledge said, he supported reauthorizing funding the GEC into the 2030s. “It’s not just Russia—Iran, China, North Korea, and even Cuba are [pushing disinformation into America](https://x.com/SenMarcoRubio/status/1836518059067982276),” he posted last September. But after being confirmed as secretary of state, Rubio appeared to do something of a 180. While the department would continue to counter “enemy propaganda,” he wrote in a cable, any State Department programs that “lead or in any way [open the door to censorship of the American people](https://www.realclearpolitics.com/articles/2025/01/21/rubio_outlines_sweeping_change_cable_us_diplomats_worldwide_152229.html) will be terminated.” “The secretary believes shutting down GEC was long overdue,” a State spokesperson tells WIRED. “It cost taxpayers $50 million a year, and the Biden administration used that money to silence and censor Americans. What started out years ago as an effort to counter terrorist organizations was exploited by partisan bureaucrats who used the office to go after Americans’ free speech. Even career employees acknowledged GEC’s ambiguous mission was always problematic. Thanks to Secretary Rubio, the American people won’t have to worry about it anymore, as it has been permanently disbanded.” For the first 60 days, the renamed, pared-down Global Engagement Center escaped the clear-cutting that took down the [US Agency for International Development](https://www.wired.com/story/doge-guts-usaid-workforce/) and other programs boosting America’s standing abroad. But employees there knew that this was, at best, a temporary stay of execution. In his Federalist op-ed, Rubio wrote, “Today, we are putting that to an end. Whatever name it goes by, GEC is dead. It will not return.” Stories about GEC will continue, Rubio promised in a [livestreamed conversation](https://www.youtube.com/watch?v=JpFW4C-p5yU&ab_channel=U.S.DepartmentofState) with [Mike Benz](https://www.nbcnews.com/tech/internet/michael-benz-rising-voice-conservative-criticism-online-censorship-rcna119213), a former State Department official who has both a well-documented animus toward foreign-assistance and counter-disinformation programs—as well as a [long](https://factcheck.afp.com/doc.afp.com.363W3FW) [history](https://www.wired.com/story/taylor-swift-psyop-conspiracy/) of promoting outlandish conspiracy theories. Benz asked Rubio if there would be a kind of Twitter Files sequel, this time for GEC. “Yeah. So I think what we have to do now, and Darren \[Beattie\] will be involved in that as well, is sort of document what happened,” Rubio answered. The secretary of state promised an even further-reaching, “cross-jurisdictional” effort to look at who got “deplatformed” for peddling disinformation or foreign propaganda and whether the US government could be blamed for it. “If we could somehow, with an internal review, create a linkage between some information that came from something the State Department paid for and an actual aggrieved party, that's what's important,” Rubio said.

Brandon Drenon and Tom Bateman BBC News, Washington DC US President Donald Trump has appeared to set a two-week deadline for Vladimir Putin, threatening a different response if the Russian counterpart was still stringing him along. As the Kremlin escalated its attacks on Ukraine, Trump was asked in the Oval Office on Wednesday if he thought Putin wanted to end the war. "I can't tell you that, but I'll let you know in about two weeks," Trump told reporters, the latest amid a string of critical public remarks made by Trump about Putin. Since Sunday, Trump has written multiple posts on social media saying that Putin has gone "absolutely crazy" and is "playing with fire" after Russia intensified its attacks on Ukraine. The bombardments by Russia are said to have been some of the largest and deadliest attacks since the start of the war, now in its fourth year. Russian strikes in Kyiv, Ukraine's capital, killed at least 13 people and injured dozens more, including children, over the weekend. And by Wednesday, the attacks had shown no signs of slowing down. In Trump's remarks about the escalation of violence and whether he thinks Putin is serious about ending the war, Trump said: "I'll let you know in about two weeks. "Within two weeks. We're gonna find out whether or not (Putin is) tapping us along or not. "And if he is, we'll respond a little bit differently." The comments are a sign of Trump's growing frustration, as the White House's repeated efforts to negotiate a deal between Russia and Ukraine appear ever more futile. This includes a recent [two-hour phone call](https://www.bbc.com/news/articles/ce824m5849po) between Trump and Putin, after which the US president said the discussions went "very well". Putin walked away from the call saying he was ready to work with Ukraine on a "memorandum on a possible future peace agreement". That call was one week before Russia launched hundreds of drones and dozens of missiles towards Ukraine's capital, according to Ukraine's air force. And a memorandum has yet to be produced by Russia. So far, Trump's threats have not appeared to concern Moscow sufficiently for it to accede to his demands. Trump has not delivered on previous such threats. Since taking office, Trump has only taken action against Ukraine, as Washington sought to steer the countries to Trump's demand for a truce. This included an eight-day suspension of US military assistance and intelligence sharing with Kyiv in March. Meanwhile the US administration has not publicly demanded any significant concessions from Russia. The White House rejects accusations of appeasing Moscow or failing to enforce its will, pointing out that all the Biden-era sanctions remain in force against Russia. But so far its mediation approach appears to have made the Kremlin more, not less, empowered. After the latest attacks, Trump wrote on Truth Social that "something has happened" to Putin, which the Kremlin said were comments made ["connected to an emotional overload"](https://www.bbc.com/news/articles/c4g2wz74jdzo). Russia's attacks on Ukraine continued in the days afterwards. Trump then escalated his criticism. On Tuesday, he said Putin was "playing with fire" and that "lots of bad things" would have happened to Russia if it were not for Trump's involvement. A Kremlin aid responded to the latest Trump Truth Social post by saying: "We have come to the conclusion that Trump is not sufficiently informed about what is really happening." Putin aide Yury Ushakov told Russian state TV channel Russia-1 that Trump must be unaware of "the increasingly frequent massive terrorist attacks Ukraine is carrying out against peaceful Russian cities." On Wednesday, Germany's new chancellor, Friedrich Merz, told Ukraine's Volodymyr Zelensky that [Berlin will help Kyiv produce long-range missiles](https://www.bbc.com/news/articles/cpw7vllepx7o) to defend itself from Russian attack. The Kremlin has warned that any decision to end range restrictions on the missiles that Ukraine can use would be a dangerous change in policy that would harm efforts to reach a political deal. In the face of Russia's recalcitrance, Trump has frequently softened his demands, shifting the emphasis from his original call for an immediate 30-day ceasefire, to which only Ukraine agreed, to more recently demanding a summit with Putin to get what he says would be a breakthrough. Putin and his foreign minister Sergei Lavrov have upped their demands from earlier positions since the US restored contacts with the Russians in February. These have included a demand that Ukraine cede parts of its own country not even occupied by Russia and that the US recognises Crimea as a formal part of Russia. Michael McFaul, a former US ambassador to Moscow, calls this a "poison pill" introduced by Russia: Creating conditions Kyiv could never agree to in order to shift blame onto Ukraine in Trump's eyes. The war has claimed tens of thousands of lives and left much of Ukraine's east and south in ruins. Moscow controls roughly one-fifth of the country's territory, including Crimea, which it annexed in 2014. Zelensky has accused Moscow of delaying the peace process and said they were yet to deliver a promised memorandum of peace terms following talks in Istanbul. Peskov insisted the document was in its "final stages."

In October 1979, a top-secret CIA intelligence report featured the first inklings in the West that something unusual and disturbing had allegedly taken place in the Soviet Union several months earlier. In April of that year, patients started appearing at hospitals in the industrial city of Sverdlovsk, now known as Yekaterinburg, in the Ural region of the Soviet Union. They were showing symptoms of what doctors first thought to be an unusually virulent and deadly form of pneumonia. It wasn’t. The outbreak that ultimately killed more than 60 people was in fact caused by anthrax spores that had been accidentally released from a Soviet biological weapons facility. How exactly this happened is still unknown. Officially, neither the facility nor the Soviet bioweapons program was supposed to exist; a few years earlier, Moscow, along with Washington, had ratified a [landmark international treaty](https://disarmament.unoda.org/biological-weapons/) prohibiting biowarfare work. When US officials publicly raised questions about the incident at Sverdlovsk, the Soviet government denied any biological weapons research was taking place, blaming the outbreak on contaminated meat. It wasn’t until 1992, after the fall of the Soviet Union, that Russian President Boris Yeltsin acknowledged that the incident was the result of a covert bioweapons program. How is it possible that a bioweapons accident that killed dozens was kept secret for decades, even in the Soviet Union? As the Washington Post reporter David E. Hoffman writes in _[The Dead Hand](https://bookshop.org/p/books/the-dead-hand-the-untold-story-of-the-cold-war-arms-race-and-its-dangerous-legacy-david-hoffman/8740694?ean=9780307387844&next=t)_, his history of the Cold War arms race, the answer lay in the nature of the weapons themselves_:_ “Biological weapons were the ultimate challenge for spies, soldiers and scientists.” Unlike a missile silo, easily distinguishable from the air, a laboratory where bioweapons are being developed doesn’t look that different from a benign medical laboratory. Unlike nuclear warheads, which leave clear radiological traces in their silos and are unmistakable in their use, a weaponized pathogen and the outbreak it would cause could be difficult to discern from a naturally occurring one, giving any attacker plausible deniability. The mystery surrounding these weapons is just as much a problem today as it was during the Cold War. Putting aside the still politically fraught question of whether Covid-19 escaped from a Chinese lab or, like most outbreaks, jumped from animals to humans naturally, the bigger problem is the simple fact that we [may never know for certain](https://www.bbc.com/news/world-us-canada-66005240). “What the pandemic tells us is that nobody can do attribution,” said [Drew Endy](https://engineering.stanford.edu/people/drew-endy), professor of biological engineering at Stanford. Intelligence agencies have determined that [Covid was not a deliberately engineered bioweapon](https://www.dni.gov/files/ODNI/documents/assessments/Unclassified-Summary-of-Assessment-on-COVID-19-Origins.pdf), but the confusion about its origins does suggest that if an even more virulent, intentionally designed pathogen were to be unleashed, it might be very difficult to say for certain who was behind the attack, or even whether it was an attack at all. This kind of plausible deniability could make using such a weapon more attractive to attackers. Biowarfare is only set to become a bigger threat in the coming years if, [as many experts predict](https://www.cnas.org/publications/reports/ai-and-the-evolution-of-biological-national-security-risks), artificial intelligence makes it easier, cheaper, and faster to develop new biological compounds, including weaponized pathogens far more sophisticated and deadly than the anthrax that killed dozens in Sverdlovsk 46 years ago. That’s why Endy, a pioneer in the field of synthetic biology — the construction of new biological systems or deliberate alteration of existing ones through genetic manipulation — argues that new forms of detection are desperately needed for this new threat landscape. “When the Iron Curtain came down, we found it useful to have geospatial intelligence to see what was happening on the other side regarding nuclear weapons,” he told Vox. “Today, there’s a molecular curtain. The stuff that’s invisible, that we can’t see, is all around us and could be harmful. And we don’t really do that kind of intelligence.” The technologies that could allow adversaries to create ever more dangerous bioweapons are advancing at a much faster clip than defensive measures. But at the moment when AI might be amplifying the risks of this type of weapon, it may also be emerging as the key for detecting and stopping them. Biological warfare dates back at least as far as the 14th century BC, far before anyone knew that germs caused disease, when the Hittites [sent diseased rams](https://www.newscientist.com/article/dn12960-were-cursed-rams-the-first-biological-weapons/) to their enemies to infect them with the dangerous bacterial infection tularemia. Every major combatant in World War II had a biological weapons research program — including the US — and Japan even deliberately unleashed germs in China. Warfare and disease have always gone together; until the 20th century, illness was responsible for killing more soldiers than weapons in many conflicts. Even today, bullet and shrapnel wounds in the war in Ukraine have become breeding [grounds for drug-resistant bacteria](https://www.science.org/content/article/war-torn-ukraine-has-become-breeding-ground-lethal-drug-resistant-bacteria). The deliberate use of illness as a weapon also has a long history. In the 14th century BC, the Hittites [sent diseased rams](https://www.newscientist.com/article/dn12960-were-cursed-rams-the-first-biological-weapons/) to their enemies to infect them with tularemia, a dangerous bacterial infection still classified as a potential bioweapon by the Centers for Disease Control and Prevention today. British soldiers infamously gave blankets infected with smallpox to American Indian tribes in the 18th century. During World War II, Japan’s military tested pathogens on prisoners of war in China and dropped ceramic bombs containing plague-infested fleas and grain on Chinese cities. The United States had its own biowarfare research program starting in World War II, and testing of potential weapons, especially anthrax, expanded dramatically in the early years of the Cold War. In 1969, President Richard Nixon, facing increasing public pressure — and believing that biological agents weren’t particularly useful in a world of thermonuclear weapons — ordered the program shut down. Six years later, the Biological Weapons Convention, an international treaty banning their use, went into effect. It’s not only states that have used bioweapons. In 1984, the Rajneeshees, a religious cult in Oregon, sickened hundreds by infecting salad bars with salmonella — the first recorded bioterror attack in US history. In 2001, shortly after the 9/11 attacks, a lone wolf perpetrator mailed anthrax to media and congressional offices, killing five people and sickening more than a dozen. Terrorist organizations including ISIS and al-Qaida have also sought unsuccessfully to acquire bioweapons. Fear over the use of biological weapons eventually led to the ratification of the Biological Weapons Convention (BWC) in 1975, banning the use and development of bioweapons globally — though the Soviet program continued in secret for years later, despite Moscow having signed onto the treaty. But even more than the treaty, biowarfare has been held back by the fact that biological weapons have been difficult to develop, deploy, and — should they be used — control. But that may be changing. New gene editing tools like [CRISPR](https://www.vox.com/2018/7/23/17594864/crispr-cas9-gene-editing) have brought down the cost and difficulty of tinkering with DNA. But the same kind of tools also can make it easier for malign actors to create designer diseases for use in warfare or terrorism. AI is already revolutionizing the field of synthetic biology: The 2024 Nobel Prize in chemistry was awarded to researchers who used [AI to predict and design new proteins](https://www.nytimes.com/2024/10/09/science/nobel-prize-chemistry.html). This is likely to have positive effects, like [dramatically accelerating drug development](https://www.vox.com/future-perfect/415100/artificial-intelligence-google-deepmind-alphafold-climate-change-medicine). But, says [Matt McKnight](https://www.belfercenter.org/people/matt-mcknight), head of biosecurity at the synthetic biology company Ginkgo Bioworks, past periods of rapid scientific advancement, from chemicals in the early 1900s (poison gas), to physics in the 1930s (nuclear weapons), to computer science in the later 20th century (cyber offensives), suggest that the new confluence of AI and gene editing is almost certain to be put to violent ends. “My assumption is that bioweapons will be used by a bad actor in this century because that would be the baseline expectation given all of human actions throughout history,” McKnight said. “And I want to reduce the likelihood that that happens.” A [recent report from the Center for a New American Security](https://s3.us-east-1.amazonaws.com/files.cnas.org/documents/AIBiologicalRisk_2024_Final.pdf) (CNAS) suggested several worrying scenarios for how AI could be used to optimize pathogens for warfare. Entirely new viruses could be designed, or modifications could be made to existing viruses to make them more resistant to existing treatments. [Kevin Esvelt](https://www.media.mit.edu/people/esvelt/overview/), a synthetic biology researcher and director of the Sculpting Evolution group at MIT, said one of his greatest concerns was that large language models could facilitate “not just the replication of an existing natural pathogen, but building something entirely new that doesn’t occur in nature.” This means that both our natural immunological defenses and existing vaccines would be entirely unprepared for it. How bad could it be? Mustafa Suleyman, the CEO of Microsoft AI, [has warned](https://www.theguardian.com/books/2023/sep/08/the-coming-wave-by-mustafa-suleyman-review-a-tech-tsunami) that the combination of AI and synthetic biology could allow the creation of a pathogen with the death rate of Ebola but the transmissibility of seasonal flu, causing “more than a billion deaths in a matter of months.” This wouldn’t be a very practical weapon for anyone but a doomsday cult. But AI-enhanced engineering could also allow for viruses to be made more controllable by adapting them to only work in particular locations. More disturbingly, viruses could be tailored to attack particular populations. The CNAS report quotes Zhang Shibo, former president of China’s National Defense University and a one-time general in the Chinese military, who has speculated that new technology would allow for the development of diseases for “specific ethnic genetic attacks.” Beyond these nightmare scenarios, AI may simply make it easier to produce existing dangerous viruses. In a [2023 experiment](https://www.science.org/content/article/could-chatbots-help-devise-next-pandemic-virus), a group of students at MIT used commercially available AI chatbots to generate suggestions for assembling several deadly viruses — including smallpox, which currently exists only in ultra-secure labs in the US and Russia — from their genetic material. The chatbots also suggested the supplies needed and listed several companies and labs that might print the genetic material without screening. Concerns about scenarios like these have prompted some AI companies to [incorporate new safeguards](https://time.com/7287806/anthropic-claude-4-opus-safety-bio-risk/) into their models — though the intense commercial and geopolitical competition to reach artificial general intelligence [may erode those safeguards over time](https://www.lesswrong.com/posts/MXaLqi4dN7gpsfeux/how-to-solve-the-misuse-problem-assuming-that-in-10-years). These advances don’t mean just anyone can grow their own smallpox today. The technical obstacles to actually constructing a disease are still formidable, even if you have the instruction manual and a very patient AI to walk you through it. But it suggests the barriers to entry are coming down. In the past, nonstate actors like ISIS or the Japanese cult Aum Shinrikyo, responsible for the 1995 sarin gas attack on the Tokyo subway, have tried to acquire biological weapons, but inevitably hit up against talent and supply limits. But advances in both AI and synthetic biology means actors with limited means will now have more tools at their disposal. As a method of warfare, synthetic biology “just seems to favor offense,” said Esvelt, who led the MIT experiment on the use of chatbots in virus design. “There’s just a lot of ways you can attack, and it’s much cheaper to build a virus than it is to develop and distribute a vaccine.” That’s why defense needs to start catching up to offense. When it comes to the risk of this technology being misused, Ginkgo’s McKnight argues, “You can’t regulate your way out of it. You have to be better at it. You have to be as good as the adversaries at making countermeasures.” His company is working to build one. One vision of what the future of biowarfare defense might look like can be found in a tucked-away corner of a busy, sprawling lab overlooking Boston Harbor. That’s where Ginkgo Bioworks is based, and where the company, founded by former MIT scientists in 2008, designs custom microorganisms for industrial use. Through that work, Ginkgo has developed advanced testing capability to determine whether the microscopic organisms they built work as intended. During Covid, Ginkgo’s “foundry,” as it refers to its main lab, was pressed into service processing nasal swabs and surveilling wastewater to help governments monitor community-level spread of the coronavirus and the emergence of new variants. That work has evolved into an ongoing monitoring operation at eight international airports in the US, as well as airports in the Middle East and Africa, for evidence of potentially dangerous pathogens crossing international borders. Nasal swabs from arriving passenger volunteers as well as wastewater samples are collected from planes and sent to Ginkgo for analysis. That means the next time you use the airplane lavatory, you may be contributing to a vast database of the genetic material moving around the world During a recent visit to Ginkgo’s foundry, I was shown a rack of thermocyclers — each resembling oversized George Foreman grills — where these wastewater samples were being subjected to a process known as polymerase chain reaction. (That’s the “PCR” that was in PCR tests during the pandemic.) The process involves heating and cooling DNA samples in order to replicate them for analysis, allowing scientists to identify genetic abnormalities that would otherwise be difficult to detect. This process can track how certain pathogens — Covid or the flu, for instance — are migrating around the world, and how they are evolving, which can help guide any public health response. Such work would be important enough given the [documented rise](https://journalistsresource.org/economics/global-rise-human-infectious-disease-outbreaks/) in naturally emerging new pathogens. But Ginkgo is no longer only looking at biological threats that emerge from nature. With the support of the Intelligence Advanced Research Projects Activity (IARPA), the US intelligence community’s research arm, Ginkgo has developed a tool known as ENDAR, or engineered nucleotide detection and ranking, which is specifically designed to detect artificially engineered genetic material. This is where AI comes in. Through its cell engineering business, Ginkgo has accumulated a vast library of engineered genomes. “We engineer microbes all day, every day. And we actually use \[tools\] to validate that our engineering worked,” said Casandra Philipson, director of bioinformatics at Ginkgo. Just as AI tools like ChatGPT train on vast amounts of written material or images to be able to answer user prompts with uncanny accuracy, ENDAR was trained on a vast library of engineered genomes. This enables ENDAR to detect when something doesn’t look quite right. “You can get really specific and start looking at what’s called the base pair, like very specifically every ATCG,” said Philipson, referring to the basic nucleotides that bond together to form DNA. These structures tend to evolve in predictable patterns, and the system can detect anomalies. “You can actually calculate a molecular clock and say, ‘Does its ancestry match what we would expect, given the evolutionary history?’” If it doesn’t, this could be a sign that genetic engineering has taken place. If so, this could go a long way toward addressing the attribution problem Endy referred to. If a new virus as bad or even worse than Covid emerges, we should have a pretty good idea if it was designed that way. That can help policymakers plan a public health response, and if necessary, a political or military one. Given that its purpose is making synthetic biology easier and cheaper at scale, one could argue that Ginkgo is itself part of the problem, simply by producing the kind of tools that could, say, make designer smallpox more feasible. Still, that dichotomy is one Ginkgo appears to embrace — the foundry is decorated with _Jurassic Park_ memorabilia, a reminder of the potential, and perhaps also the risks, of the kind of DNA tinkering the company is engaged in. (One wonders what Professor Ian Malcolm [would make](https://www.youtube.com/watch?v=F_7RvW-avZ8&pp=0gcJCdgAo7VqN5tD) of the company’s confidence.) The government has tried to reduce those risks — former President Joe Biden’s executive order on artificial intelligence in 2023 included restrictions on the [purchases of synthetic DNA](https://www.statnews.com/2024/05/08/shouldnt-be-easy-buy-synthetic-dna-fragments-recreate-deadly-1918-flu-virus/). But Ginkgo’s McKnight argues that given the speed of biotech innovation in multiple countries, and the benefits it can bring, “there’s no choice you can make to clamp down on all the technology.” When it comes to the risk of this technology being misused, he says, “You can’t regulate your way out of it. You have to be better at it. You have to be as good as the adversaries at making countermeasures.” The [State Department has assessed](https://www.state.gov/wp-content/uploads/2023/04/13APR23-FINAL-2023-Treaty-Compliance-Report-UNCLASSIFIED-UNSOURCED.pdf) that Russia and North Korea both maintain active offensive biological weapons programs, even though both countries have signed on to the Biological Weapons Convention. But the bigger concern, given its [increasingly dominant position in global biotech innovation](https://www.axios.com/2025/05/29/china-biotech-boom-us-drug-trials), heavy investments in frontier AI, and its scientists’ often controversial approach to [genetic research](https://www.npr.org/2023/06/08/1178695152/china-scientist-he-jiankui-crispr-baby-gene-editing), is China. When it comes to China, the State Department assesses more vaguely that the country has “continued to engage in biological activities with potential \[bioweapon\] applications” and has failed to supply sufficient information on a “diverse families of potent toxins with dual-use applications.” The writings of a number of prominent defense scholars in China, including a textbook published by the People’s Liberation Army, have identified biotechnology as a “[new domain of warfare](https://www.defenseone.com/ideas/2019/08/chinas-military-pursuing-biotech/159167/).” McKnight believes the main takeaway from the experience of the Covid pandemic was that “America is not a biosecure nation today.” And as bad as Covid was, what’s coming could be far worse. Covid, he said, cost the US economy [trillions of dollars](https://fortune.com/well/us/2023/05/16/how-much-did-covid-19-pandemic-coronavirus-cost-economy-14-trillion/) and “was probably the biggest factor in creating the chaos we’re seeing in our political system. \[But\] it wasn’t really even that bad compared to some of the potential things that are out there.” Esvelt believes that the pandemic showed the importance of stockpiling preventive equipment like respirators, likely to be a far more effective first line of defense than vaccines — and that it should be viewed as a military priority as well as a public health one. “We’re going to lose a hot war in which our civilian support personnel are taken out by a pandemic and the adversaries are not,” he said. AI could come into play here in a different way. We’re already seeing generative AI’s potential as a tool for creating and spreading misinformation as effectively as a virus. Epidemiologist Jay Varma [recently warned](https://www.statnews.com/2025/05/27/artificial-intelligence-bioterrorism-deepfake-public-health-threat/) of the risk of “a rogue actor using existing AI tools to _simulate_ a bioterrorism attack that would destabilize a region or the world.” For example, Varma imagines a scenario in which an extremist group uses faked evidence of a biological attack, spread on social media, to foment a security crisis between nuclear rivals China and India. Even without AI, rumors and misinformation ran rampant in the pandemic, eroding public trust in vaccines. And despite the intelligence community’s assessment that Covid was _not_ a deliberate bioweapon, some [politicians have continued to insinuate](https://thebulletin.org/2020/03/why-do-politicians-keep-breathing-life-into-the-false-conspiracy-theory-that-the-coronavirus-is-a-bioweapon/) that it was. (The uncertainty around this is probably not helped by the ongoing confusion over whether Covid was inadvertently released from a lab doing benign research, which several intelligence agencies consider a real possibility.) Likewise, the Russian government has spread unsubstantiated rumors that Ukraine is running labs where bioweapons are being developed with the support of the US government, a campaign that was [picked up and spread by prominent US media figures](https://www.npr.org/2022/03/25/1087910880/biological-weapons-far-right-russia-ukraine), including Tucker Carlson. All this suggests that determining a bioweapons attack is _not_ taking place during an outbreak may be just as important an application for Gingko’s ENDAR technology as determining one is. Despite the increasing attention being devoted to biosecurity at the government level, there’s also reason to be concerned about whether the US is moving toward becoming a more biosecure nation. The Trump administration recently [canceled a $12 million grant](https://edition.cnn.com/2025/06/02/politics/harvard-says-trump-white-house-directed-agencies-to-freeze-grant-money) to Harvard University for biosecurity research, despite the warnings of Pentagon officials that this would pose national security risks. As Hoffman writes in _The Dead Hand,_ many of the leading Soviet biologists who worked on the country’s bioweapons program did so under the sincere impression that their counterparts in the US were doing exactly the same thing. Once the Cold War ended, they were stunned to learn that the Americans had halted their offensive program decades before. But that only shows how the distrust and competition of an arms race can obscure reality. With the rapid pace of advances of both synthetic biology and AI today, Endy worries about a new arms race mentality taking hold. Whereas nuclear competition has, since the dawn of the Cold War, been governed by the logic of mutually assured destruction (MAD), he worries that the dynamic of biosecurity will be governed by what he calls SAD — stupidly assured destruction. “It’s really important to be thoughtful and cautious about accusations,” he says. “If we’re not careful about how we are framing and talking about weapons programs, we get this type of geopolitical autoimmune response that leads to some really bad policy outcomes. We don’t want to go down the deterrence path” — in other words, deterring an enemy from unleashing bioweapons by having more powerful ones of our own. Instead, Endy said, “we want to go down the resilience path” — building societal defenses from biological threats, natural or artificial. The first step of building those defenses is knowing exactly what threats are out there. You’ve read 1 article in the last month Here at Vox, we're unwavering in our commitment to covering the issues that matter most to you — threats to democracy, immigration, reproductive rights, the environment, and the rising polarization across this country. Our mission is to provide clear, accessible journalism that empowers you to stay informed and engaged in shaping our world. By becoming a Vox Member, you directly strengthen our ability to deliver in-depth, independent reporting that drives meaningful change. We rely on readers like you — join us.  Swati Sharma Vox Editor-in-Chief

The UK has exposed 18 Russian spies and their units responsible for cyber-attacks in Britain and hacking one of the victims of [the Salisbury poisonings](https://www.theguardian.com/uk-news/novichok-poisonings), David Lammy, the foreign secretary, has said. Announcing individual sanctions, Lammy said [Russia](https://www.theguardian.com/world/russia) had targeted media, telecoms providers, political and democratic institutions and energy infrastructure in the UK in recent years. He also said two of the spies had been involved in planting X-Agent spyware on a device used by Yulia Skripal, the daughter of the former spy Sergei Skripal, five years before they were poisoned with novichok in Salisbury in 2018. The Skripals survived the attack on British soil but a woman, Dawn Sturgess, was killed after her boyfriend stumbled across the poison in a perfume bottle. X-Agent is believed to be linked to the hacking group Fancy Bear, which has ties to Russia’s GRU military intelligence unit 26165, which is being hit with sanctions. The government said some of the agents from the unit were also involved in targeting [the bombing of the Mariupol theatre in Ukraine](https://www.theguardian.com/world/2022/mar/25/mariupol-theatre-bombing-killed-300-ukrainian-officials-say), where hundreds of civilians, including children, were killed, and carrying out wider cyber-operations in support of Russia’s president, Vladimir Putin. Lammy said the UK was exposing Russian spies and hackers to increase security. “GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty and threaten the safety of British citizens,” he said. “The Kremlin should be in no doubt. We see what they are trying to do in the shadows and we won’t tolerate it. That’s why we’re taking decisive action with sanctions against Russian spies. “Putin’s hybrid threats and aggression will never break our resolve. The UK and our allies’ support for Ukraine and Europe’s security is ironclad.” The names of the alleged spies were [published](https://www.gov.uk/government/news/uk-sanctions-russian-spies-at-the-heart-of-putins-malicious-regime) online. Sanctions typically involve asset freezes and travel bans. The government said it was also imposing sanctions on an entity called African Initiative that it said was responsible for printing disinformation about health in west Africa. [skip past newsletter promotion](https://www.theguardian.com/politics/2025/jul/18/lammy-announces-exposure-of-18-russian-spies-after-uk-cyber-attacks#EmailSignup-skip-link-13) Sign up to Headlines UK Get the day’s headlines and highlights emailed direct to you every morning **Privacy Notice:** Newsletters may contain info about charities, online ads, and content funded by outside parties. For more information see our [Privacy Policy](https://www.theguardian.com/help/privacy-policy). We use Google reCaptcha to protect our website and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. after newsletter promotion The decision to target spies with sanctions is an escalation of the UK’s strategy, which has previously focused more on politicians, financial institutions and military leaders. [The UK announced in May](https://www.theguardian.com/world/2025/may/20/sanctions-russia-uk-europe-putin-trump-call) that further sanctions would target dozens of entities “supporting Russia’s military machine, energy exports and information war, as well as financial institutions helping to fund Putin’s invasion of Ukraine”. The Foreign Office said at the time: “Putin has so far not put in place the full, unconditional ceasefire that President Trump has called for, and which President Zelenskyy endorsed over two months ago.” The Foreign Office estimated in June that sanctions against Russia had deprived the Russian state of at least $450bn (£340bn) in war funds between February 2022 and June 2025. Since taking office last year, Lammy has deployed a tough stance against Russia, saying the post-cold war era is “well and truly over” and arguing that keeping the British people safe means standing up against “Putin’s mafia state”.

By [Matt Burgess](https://www.wired.com/author/matt-burgess/) and [Natasha Bernal](https://www.wired.com/author/natasha-bernal/) Oct 27, 2025 5:00 AM ChatGPT, Gemini, DeepSeek, and Grok are serving users propaganda from Russian-backed media when asked about the invasion of Ukraine, new research finds.  Photo-Illustration: WIRED Staff; Getty Images OpenAI’s ChatGPT, Google’s Gemini, DeepSeek, and xAI’s Grok are pushing [Russian state propaganda](https://www.wired.com/story/pro-russia-disinformation-campaign-free-ai-tools/) from sanctioned entities—including citations from Russian state media, sites tied to Russian intelligence or pro-Kremlin narratives—when asked about the war against Ukraine, according to a new report. Researchers from the Institute of Strategic Dialogue (ISD) claim that Russian propaganda has targeted and exploited [data voids](https://datasociety.net/wp-content/uploads/2019/11/Data-Voids-2.0-Final.pdf)—where searches for real-time data provide few results from legitimate sources—to promote false and misleading information. Almost one-fifth of responses to questions about Russia’s war in Ukraine, across the four chatbots they tested, cited Russian state-attributed sources, the ISD research claims. “It raises questions regarding how chatbots should deal when referencing these sources, considering many of them are sanctioned in the EU,” says Pablo Maristany de las Casas, an analyst at the ISD who led the research. The findings raise serious questions about the ability of large language models (LLMs) to restrict sanctioned media in the EU, which is a growing concern as more people use AI chatbots as an alternative to search engines to find information in real time, the ISD claims. For the six-month period ending September 30, 2025, ChatGPT search had approximately 120.4 million average monthly active recipients in the European Union according [to OpenAI data](https://help.openai.com/en/articles/8959649-eu-digital-services-act-dsa). The researchers asked the chatbots 300 neutral, biased, and “malicious” questions relating to the perception of NATO, peace talks, Ukraine’s military recruitment’ Ukrainian refugees, and war crimes committed during the Russian invasion of Ukraine. The researchers used separate accounts for each query in English, Spanish, French, German, and Italian in an experiment in July. The same propaganda issues are still present in October, Maristany de las Casas says. Amid widespread sanctions imposed on Russia since its full-scale invasion of Ukraine in February 2022, European officials have sanctioned at [least 27 Russian media sources](https://www.consilium.europa.eu/en/policies/sanctions-against-russia-explained/) [for](https://finance.ec.europa.eu/document/download/99b8682b-4f41-4d78-9756-7087d0a93965_en?filename=faqs-sanctions-russia-media_en_1.pdf) spreading disinformation and distorting facts as part of its “strategy of destabilizing” Europe and other nations. The ISD research says chatbots cited [Sputnik Globe,](https://2021-2025.state.gov/report-rt-and-sputniks-role-in-russias-disinformation-and-propaganda-ecosystem/) [Sputnik China](https://www.consilium.europa.eu/en/policies/sanctions-against-russia-explained/), RT (formerly [Russia Today](https://www.rferl.org/a/russia-rt-sputnik-eu-access-bans-propaganda-ukraine-war/32803929.html)), [EADaily](https://www.consilium.europa.eu/en/press/press-releases/2025/02/24/three-years-of-russia-s-full-scale-invasion-and-war-of-aggression-against-ukraine-eu-adopts-its-16th-package-of-economic-and-individual-measures/), the [Strategic Culture Foundation](https://data.europa.eu/apps/eusanctionstracker/subjects/147241), and the [R-FBI](https://www.consilium.europa.eu/en/press/press-releases/2025/07/15/russian-hybrid-threats-eu-lists-nine-individuals-and-six-entities-responsible-for-destabilising-actions-in-the-eu-and-ukraine/). Some of the chatbots also cited Russian disinformation networks and Russian journalists or influencers that amplified Kremlin narratives, the research says. Similar previous research has also found 10 of the most popular chatbots [mimicking Russian narratives](https://www.newsguardtech.com/special-reports/generative-ai-models-mimic-russian-disinformation-cite-fake-news/). OpenAI spokesperson Kate Waters tells WIRED in a statement that the company takes steps “to prevent people from using ChatGPT to spread false or misleading information, including such content linked to state-backed actors,” adding that these are long-standing issues that the company is attempting to address by improving its model and platforms. “The research in this report appears to reference search results drawn from the internet as a result of specific queries, which are clearly identified. It should not be confused with, or represented as referencing responses purely generated by OpenAI's models, outside of our search functionality,” Waters says. “We think this clarification is important as this is not an issue of model manipulation.” Neither Google nor DeepSeek responded to WIRED’s request for comment. An email from Elon Musk’s xAI said: “Legacy Media Lies.” In a written statement, a spokesperson for the Russian Embassy in London said that it was “not aware” of the specific cases that this report details but that it opposes any attempts to censor or restrict content on political grounds. “Repression against Russian media outlets and alternative points of view deprives those who seek to form their own independent opinions of this opportunity and undermines the very principles of free expression and pluralism that Western governments claim to uphold,” the spokesperson wrote. “It is up to the relevant providers to block access to websites of outlets covered by the sanctions, including subdomains or newly created domains and up to the relevant national authorities to take any required accompanying regulatory measures,” says a European Commission spokesperson. “We are in contact with the national authorities on this matter.” Lukasz Olejnik, an independent consultant and visiting senior research fellow at King’s College London’s Department of War Studies, says the findings “validate” and help contextualize how Russia is targeting the West’s information ecosystem. “As LLMs become the go-to reference tool, from finding information to validating concepts, targeting and attacking this element of information infrastructure is a smart move,” Olejnik says. “From the EU and US point of view, this clearly highlights the danger.” Since Russia invaded Ukraine, the Kremlin has moved to control and restrict the free flow of information inside Russia: banning [independent media](https://rsf.org/en/country/russia), increasing censorship, curtailing civil society groups, and building more [state-controlled tech](https://www.nytimes.com/2025/10/21/world/europe/russia-max-app.html). At the same time, some of the country’s [disinformation networks have ramped up](https://www.wired.com/story/russia-election-disinformation-2024-election-day/) activity and [adopted AI tools to supercharge](https://www.wired.com/story/pro-russia-disinformation-campaign-free-ai-tools/) production of fake images, videos, and websites. Across the ISD’s findings, around 18 percent of all prompts, languages, and LLMs returned results linked to state-funded Russian media, sites “linked to” Russia’s intelligence agencies, or disinformation networks, the research says. Questions about peace talks between Russia and Ukraine led to more citations of “state-attributed sources” than questions about Ukrainian refugees, for instance. The ISD’s research claims that the chatbots displayed confirmation bias: The more biased or malicious the query, the more frequently the chatbots would deliver Russian state-attributed information. The malicious queries delivered Russian state-attributed content a quarter of the time, biased queries provided pro-Russian content 18 percent of the time, while neutral queries were just over 10 percent. (In the research, malicious questions to chatbots “demanded” answers to back up an existing opinion, whereas “biased” questions were leading but more open ended). Of the four chatbots, which are all popular in Europe and collect data in real time, ChatGPT cited the most Russian sources and was most influenced by biased queries, the research claims. Grok often linked to social media accounts that promoted and amplified Kremlin narratives, whereas DeepSeek sometimes produced large volumes of Russian state-attributed content. The researchers say Google’s Gemini “​​frequently” displayed safety warnings next to the findings and had the overall best results out of the chatbots they tested. [Multiple](https://www.americansunlight.org/updates/new-report-russian-propaganda-may-be-flooding-ai-models) [reports](https://www.newsguardrealitycheck.com/p/a-well-funded-moscow-based-global) this year have claimed a Russian disinformation network dubbed “Pravda” has flooded the web and social media with millions of articles as part of an effort to “poison” LLMs and influence their outputs. “Having Russian disinformation be parroted by a Western AI model gives that false narrative a lot more visibility and authority, which further allows these bad actors to achieve their goals,” says McKenzie Sadeghi, a researcher and editor at media watchdog company NewsGuard, who has studied the [Pravda](https://www.newsguardrealitycheck.com/p/a-well-funded-moscow-based-global) network and Russian propaganda’s influence on chatbots. (Only two links in the ISD research could be connected back to the Pravda network, the findings say). Sadeghi claims the Pravda network in particular is quick to launch new domains where propaganda is published and says it can be particularly successful when there is little reliable information on a subject—the so-called [data voids](https://www.lawfaremedia.org/article/ai-and-data-voids--how-propaganda-exploits-gaps-in-online-information). “Especially related to the conflict \[in Ukraine\], they’ll take a term where there’s no existing reliable information about that particular topic or individual on the web and flood it with false information,” Sadeghi says. “It would require implementing continuous guardrails in order to really stay on top of that network.” Chatbots may come under more pressure from EU regulators as their user base grows. In fact, ChatGPT [may have already hit the threshold](https://www.euractiv.com/news/commission-checking-if-chatgpt-falls-under-eu-online-governance-rules/) to be [designated a Very Large Online Platform (VLOP)](https://digital-strategy.ec.europa.eu/en/policies/dsa-vlops) by the EU once it hits 45 million average monthly users. This status triggers specific rules that tackle the risk of illegal content and their impact on fundamental rights, public security, and well-being on those sites. Even without qualifying for specific regulation, the ISD’s Maristany de las Casas argues that there should be a consensus across companies of what sources should not be referenced or should not appear on these platforms when they are linked to foreign states known for disinformation. “It could be providing users with further context, making sure that users understand the times that these domains have a conflict and even understanding why they’re sanctioned in the EU,” he says. “It’s not only an issue of removal, it’s an issue of contextualizing further to help the user understand the sources they’re consuming, especially if these sources are appearing amongst trusted, verified sources.”

The family of a British woman killed in the [Wiltshire](https://www.theguardian.com/uk-news/wiltshire) nerve agent poisonings have strongly criticised the UK state for not doing more to keep the public safe, and believe lessons have not been learned from her death. Relatives of Dawn Sturgess, who was [killed after she sprayed herself with a nerve agent](https://www.theguardian.com/uk-news/2020/may/31/she-never-had-a-voice-dawn-sturgess-parents-hope-tv-drama-bbc-salisbury-poisonings-novichok) smuggled into the UK by Russian agents to kill a former spy, expressed concern that an inquiry into her death had not set out how such a tragedy could be prevented in the future. The inquiry made limited criticism of the way the security services protected the former Russian spy Sergei Skripal, who was living openly under his own name in Salisbury when he was targeted. The family said: “Today’s report has left us with some answers, but also a number of unanswered questions. We have always wanted to ensure that what happened to Dawn will not happen to others; that lessons should be learned; and that meaningful changes should made. The report today contains no recommendations. That is a matter of real concern. There should, there must, be reflection and real change.” They added: “Skripal was described by [Vladimir Putin](https://www.theguardian.com/world/vladimir-putin) as a traitor and convicted of treason. Yet there were no sufficient and regular assessments of the risk he faced from Russian retaliation. That put the British public at risk, and led to Dawn’s death. “The chair considered secret evidence from the government and the UK intelligence services. Today’s report does not set out, publicly, how the risks that led to Dawn’s death will be prevented in the future. Adequate risk assessment of Skripal was not done; no protective steps were put in place. That is a serious concern, for us now, and for the future.” The family criticised Wiltshire police for wrongly initially characterising Sturgess as a drug user. “That was a grave mistake by Wiltshire police that should never have happened,” they said. They also said that after the attack on Skripal, training to emergency responders about nerve agent symptoms should have been more widely circulated and more public health advice ought to have been given warning people not to pick up unknown items. On 4 March 2018, Skripal and his daughter, Yulia Skripal, were poisoned by novichok at his home in a suburban cul-de-sac after a spy exchange. The Skripals fell seriously ill but survived. Sturgess, 44, died after spraying novichok, stored in a fake perfume bottle, on herself at the home of her boyfriend, Charlie Rowley, in Amesbury, Wiltshire, 8 miles north of Salisbury, on 30 June 2018. The chair of [the inquiry](https://www.dawnsturgess.independent-inquiry.uk/), Lord Hughes, concluded that Putin must have authorised the attack on Skripal and that he was “morally responsible” for Sturgess’s death. He called it a “public demonstration of Russian state power for both international and domestic impact”. The chair said [Alexander Petrov, Ruslan Boshirov and Sergey Fedotov](https://www.counterterrorism.police.uk/charges-authorised-against-third-suspect-in-salisbury-investigation/) (all aliases) were members of an operational team within the GRU – the Russian military intelligence agency responsible for foreign intelligence gathering. He said: “Deploying a highly toxic nerve agent in a busy city was an astonishingly reckless act. The risk that others beyond the intended target might be killed or injured was entirely foreseeable. The risk was dramatically magnified by leaving in the city a bottle of novichok disguised as perfume.” Hughes said the bottle containing the novichok that Sturgess had sprayed on herself was “probably” the same one the Russian agents had used to apply poison to the door handle of Sergei Skripal’s house. He said: “They recklessly discarded this bottle somewhere public or semi-public before leaving Salisbury. They can have had no regard for the hazard thus created, of the death of, or serious injury to, an unaccountable number of innocent people.” Rowley has said he found the bottle in a bin shortly before he gave it to Sturgess, but Hughes said it was “likely” he had come upon the bottle “within a few days” of it being abandoned on 4 March. The chair said: “There is a clear causative link between the use and discarding of the novichok by Petrov and Boshirov and the death of Dawn Sturgess.” Hughes concluded there had been failings in Skripal’s management as an exchanged prisoner. “In particular, sufficient, regular written assessments were not conducted,” he said. But he said the assessment by the state that Skripal was not at significant risk of assassination could not be judged to have been unreasonable. He said he did not consider that the attack on Skripal could have been avoided by additional security measures being put in place: “The only such measures which could have avoided the attack would have been such as to hide him completely with a new identity.” Hughes said that, after the Salisbury attack, extra training for emergency services on recognising symptoms nerve agent exposure should have been more widely circulated. He also criticised Wiltshire police for wrongly characterising Sturgess as a drug user after she was poisoned. The chair concluded it was reasonable that public health officials had not given the public advice not to pick anything up, because at that stage it was not known where the Russian agents had been. Hughes said he was satisfied that Sturgess had received “entirely appropriate medical care” from the ambulance staff who attended to her and from hospital doctors. He said: “It is absolutely clear that her condition was in fact unsurvivable from a very early stage – before the time the ambulance crew arrived to treat her. This was a result of the very serious brain injury that was itself the consequence of her heart stopping for an extended period of 30 minutes or so immediately after she was poisoned.”