With over 20 years of experience, we transform your digital presence. We specialize in website and E-Shop development, SEO and Digital Marketing, ERP software and smart automation that take your business to the next level.
Address:
154 Egnatia Street, Thessaloniki 546 36
Phone:
+30 231 231 4095
E-mail:
hello@twodots.gr
Ready for the next step?;
Tech and Tariffs shows how AI, inauthentic accounts, and social media monitoring are changing brand safety, metrics, and crisis management.
Short answer: The «Tech and Tariffs» campaign shows that AI can accelerate the production of political commentary and images, but it does not guarantee real influence. OpenAI classified the activity as Category One on the Breakout Scale: it was limited to X, with little or no observable interaction and no documented spread to another channel.
For a brand, the key lesson is to distinguish between three different factors: how much content is produced, how well-coordinated the network distributing it is, and how many authentic users it influences. A sudden surge in mentions may require monitoring, but it does not, on its own, prove the existence of a single operator or widespread reach.
This case directly concerns brand safety, social listening, and crisis communication. It complements the usual Social media management for e-commerce with one more check: not only what is being said about the company, but which accounts are repeating it, when, using what linguistic patterns, and whether the narrative is reaching a real audience.
On June 1, 2026, OpenAI published the «Tech and Tariffs» case study. According to the company, the cluster included ChatGPT accounts that likely originated in China. Users provided prompts in Simplified Chinese and used VPNs to access the platform. They requested brief comments in English and political cartoons about U.S. technology policy, tariffs and trade restrictions, as well as help with editing job applications or support in designing social media monitoring systems.
The attribution was not presented as an absolute certainty. OpenAI used probabilistic language and stated that it was unable to precisely determine the institutional relationship between the operators. This is a crucial standard for any professional report: observable data is one thing, the assessment derived from them is another, and a definitive assertion of identity is yet another.
A crucial distinction: The presence of repetitive posts or low-quality accounts is a red flag that warrants further investigation. Attributing the activity to a specific entity requires separate and stronger evidence than that needed to establish coordinated behavior.
The prompts contained recurring terminology that, according to the report, is consistent with individuals associated with the Chinese public security system. The requests concerned public opinion risk assessments for protests, incidents of school bullying, crowd movements in Shanghai, police-related incidents, citizen reports, and traffic enforcement.
One user described the social media accounts he managed as a «water army,» a term used to describe coordinated accounts that flood platforms with criticism or trolling. He also requested content that would benefit the People’s Republic of China or promote pro-China narratives. OpenAI assessed that the totality of the evidence pointed to activity aligned with the interests of the Chinese Communist Party, without claiming to know the exact entity behind it.
The most prominent theme was the technological competition between the U.S. and China. The panelists framed the discussion around tariffs, rare earth elements, artificial intelligence, 5G, new energy, and industrial resilience. They argued that the U.S. was seeking technological dominance and the power to set the rules.
The instructions given to the model were specific and carefully crafted. The cartoons were to depict only President Trump, with no images of China or Xi Jinping. Generative AI did not determine the message on its own: operators selected the target, visual context, exclusions, and political orientation, while the model functioned as a production tool.
Their activity was not limited to English. The accounts requested content in Italian, Japanese, and Traditional Chinese, also targeting an audience in Taiwan. At the same time, they produced large batches of short Chinese-language comments and articles on various topics, with the aim of favoring China, attacking the U.S. and Israel, harassing Chinese dissidents, and, in some cases, reinforcing anti-Semitic stereotypes.
The requests often specified quantities, short character limits, and a conversational tone. Evidence of a coordinated campaign can be found not only in the content, but also in the repetitive production format, the timing, the linguistic adaptation, and the unusually uniform behavior of many accounts. The same need for rules, inventory, and monitoring exists when a company organizes its own AI Security Posture, so that productivity does not become a new risk.
The operators also requested a proposal for an AI system that would monitor online public opinion. According to their description, the system would need to automatically collect information identifying «harmful» content posted by «key figures» on social media, keep records, download videos for large-scale semantic analysis, and send risk alerts.
OpenAI reports that the model generated a general response of approximately 500 words with advice on data storage and management, but did not provide any ideas on collecting data for surveillance purposes. The source describes this specific response in this specific case; it does not constitute a general guarantee that every abusive request will always be handled in the same way.
At the same time, OpenAI identified a network on X that was spreading false claims that ChatGPT user data had been compromised. Based on behavioral indicators from open sources, it assessed that this was likely part of the same broader network linked to the «Tech and Tariffs» operation.
The correlation was based on repeated interactions and reinforcements. A post about alleged hacking of mobile networks by U.S. intelligence agencies, which had been created by an account in the cluster, was reposted by potentially inauthentic accounts in the «ChatGPT compromise» cluster. In another instance, accounts from both clusters quote-tweeted the same post from an unrelated, verified account within a few hours.
The accounts were created in late 2025, had few or no followers, and had made very few posts during the campaign period. OpenAI noted that they appear to have been suspended by X regardless of its own assessment. These observations do not, on their own, prove common control, but together they form a pattern of coordinated activity.
There was an overlap in content with previously documented influence operations of possible Chinese origin. An account that had posted a cartoon of Trump created with ChatGPT also posted images of Philippine President Ferdinand Marcos, which had appeared on inauthentic accounts linked to the «Nine-emdash Line» operation.
The source emphasizes that this overlap is not enough to prove a definitive link between the two companies. It merely reinforces the picture of a broader network of accounts on X promoted by Chinese influence operations. For brands and analysts, the similarity in content is a red flag warranting further investigation, not automatic proof of shared management.
Four levels of data that should not be confused
Recurring phrasing, identical themes, and similar images indicate what is worth investigating, but they do not prove the existence of a common operator.
Common timestamps, sequential reposts, and mutual promotion among small accounts paint a stronger picture of organized distribution.
The transition to authentic, high-reach accounts or other platforms indicates whether the narrative has gained a substantial audience.
A link to a specific organization requires additional technical, behavioral, and informational evidence and must be established with a clear degree of certainty.
Based on the Breakout Scale, OpenAI classified the activity as Category One: it was confined to a single platform, and there were no indications that it had spread beyond it. Most posts had little or no noticeable engagement. No evidence was found that the false claims of a data breach were amplified by authentic accounts with a large reach or beyond X.
This does not mean that the activity was insignificant. It means that the measured impact remained low, while the intent, infrastructure, and choice of target provide cause for vigilance. A private company in a strategically important sector may become the target of narratives that seek to undermine its credibility, even when the initial execution of the campaign fails to gain organic traction.
OpenAI compared the pattern to earlier operations of possible Chinese origin that had been described by the Australian Strategic Policy Institute and Mandiant. In 2022, the Spamouflage/DRAGONBRIDGE network used inauthentic accounts to smear Lynas Rare Earths regarding a planned processing plant in Texas. Later, Appia Rare Earths & Uranium in Canada and USA Rare Earth in the U.S. were targeted following announcements of new production capacity in North America.
According to the assessments cited by the source, that activity was intended to damage the reputation of competitors to China’s dominance in the rare earths market. OpenAI believes that in this case, similar tactics were employed against its own reputation, but without success. The comparison serves as an analytical framework and does not constitute proof that the same entities carried out all of the operations.
The campaign coincided with a sharp escalation in U.S.-China economic and technological competition, when President Trump announced an additional 100% tariff on Chinese products. It also followed the Fourth Plenary Session of the CPC, where proposals for the 15th Five-Year Plan were adopted that designated AI as a strategic technology and an industrial priority, accelerating innovation and launching the national «AI+» initiative.
OpenAI draws a parallel between this strategic focus and the 14th Five-Year Plan of 2021, which treated strategic mineral resources as a security issue and identified advanced rare-earth functional materials as a key priority. In both cases, inauthentic accounts targeted private companies in democracies that operate in sectors critical to China’s national development and security.
The first practical implication is that reputation is not protected solely by monitoring keywords. Teams need insight into behavioral patterns: accounts created during the same period, repetitive phrasing, unusually synchronized reposts, small networks that reinforce one another, and content adapted into multiple languages. These are red flags to investigate, not automatic proof of malicious activity.
The second implication concerns metrics. High output does not equal high influence. Here, the source describes massive production of comments and images, but low observable engagement and no documented reach beyond a single platform. A dashboard that measures only the volume of mentions may overestimate the actual impact, while a dashboard that looks only at engagement may overlook the organized infrastructure behind an emerging threat.
The third implication is the need for disciplined crisis communication. When a false claim of a data breach arises, the company must distinguish between what it has confirmed and what it assesses as a possible smear campaign. A swift rebuttal requires evidence, clear communication with customers, and monitoring to see if the narrative is spreading to authentic, high-reach accounts or other platforms.
This distinction must be viewed within a broader marketing strategy with measurable goals and in clear brand guidelines. The team needs a predefined approach, a decision-maker, and escalation criteria before the problem arises—not after the pressure has already been passed on to customers and partners.
The Communication Decision
Don't declare an «organized attack» based solely on a spike in reports.
First, verify the claim, preserve the original evidence, assess the level of coordination, and check whether the narrative is being shared on authentic accounts or new channels. The public response should be proportionate to the available evidence and the actual impact.
«Tech and Tariffs» is not a ready-made playbook for every crisis. However, it provides a useful framework for marketing, e-commerce, and corporate communications teams that need to manage a suspicious wave of comments without underestimating or overestimating the risk.
From the First False Claim to a Well-Documented Response
Record the original posts, URLs, timestamps, screenshots, and interactions before the accounts are deleted or modified.
Confirm what happened on your own systems and what information you can make public. Refuting the claim does not require that it has already been proven who started it.
Identify which accounts are creating content, which are reposting, and which are sharing the story with a new audience. Look for timing patterns, recurring phrases, and multilingual variations.
Track authentic, high-reach accounts, new channels, branded search, support requests, and changes in customer behavior—not just the raw number of mentions.
Choose between a limited correction, a customer notification, a public statement, or legal and platform-level escalation based on accuracy, scope, and operational risk.
Monitoring must be linked to a specific owner, time limits, and an approval channel. Without these, a dashboard generates alerts but not decisions. With these elements in place, the team can protect its reputation without inadvertently reinforcing a narrative that hasn’t actually gained traction.
The key lesson is twofold. On the one hand, artificial intelligence reduces the cost and time required to produce commentary, images, and variations on a narrative. On the other hand, it does not guarantee impact. This particular company produced content across many topics and languages, but remained in Category One of the Breakout Scale, with no documented breakout.
For a business, a mature approach is neither complacency nor panic. It involves continuous monitoring, data-driven performance, distinguishing intent from impact, and a plan to address false claims. The better a brand understands network behavior and the path of virality, the harder it becomes for an artificially inflated narrative to be presented as authentic public opinion.
Digital Marketing & SEO by TWO DOTS
Identify early on what really influences your brand.
TWO DOTS integrates social media strategy, content, analytics, and response planning so your team can distinguish between a noisy spike and a threat that reaches a real audience.
Frequently Asked Questions (FAQs)
It was a cluster of ChatGPT accounts that, according to OpenAI, most likely originated in China and used AI to generate commentary and political cartoons related to U.S. technology policy, tariffs, and trade.
No. OpenAI assessed that the activity was aligned with the interests of the CCP, but stated that it was unable to determine the exact institutional affiliation of the operators.
The observable reach was low. Most posts had little or no engagement, and there was no evidence of the content spreading beyond X or through authentic, high-reach accounts.
It was used for short comments, political cartoons, multilingual content, report processing, and a general data management concept for a public discourse monitoring system.
In this specific case, OpenAI states that the response was limited to general advice on data storage and management and did not suggest ways to collect data for surveillance purposes.
Time-synchronized reposts, repetitive phrases, accounts created on similar dates, mutual promotion among small profiles, and identical multilingual variations are red flags that warrant investigation, but not automatic proof of shared management.
It needs to distinguish between the volume of mentions, network coordination, and actual reach: authentic, high-reach accounts, new channels, branded search, support requests, and changes in customer behavior.
Retain the source data and verify the accuracy of the claim in the company’s systems. The public response must be based on verified facts, the actual scope of the issue, and a clearly identified decision-maker.
