OpenAI has reported banning accounts associated with the likely Iran-linked STORM-2035 operation, which utilized AI to create influence content. This activity, detailed in OpenAI's June 2025 report, represents a recidivist effort by the group, following an initial disruption in August of the previous year.
The operation involved prompting ChatGPT in Persian to generate short comments in English and Spanish. These comments were subsequently posted on X by accounts posing as residents of target countries.
Key Points
- OpenAI banned accounts linked to the likely Iran-linked STORM-2035 operation in June 2025.
- The operation used ChatGPT to generate short comments, typically a dozen at a time, in English and Spanish.
- Prompts for content generation were provided in Persian.
- The generated content was posted on X by accounts posing as residents of the US, UK, Ireland, and Venezuela.
- Content themes included Latino rights in the US, Scottish independence, Irish reunification, Venezuela and Cuba, Palestinian rights, and Iran's military and diplomatic prowess.
- Typical posts recorded 150–350 views and zero likes, shares, or comments.
- OpenAI assessed this activity as Category 1 on the IO impact Breakout Scale, indicating activity on one platform with little evidence of real user amplification.
Context
According to OpenAI, the STORM-2035 operation engaged in recidivist activity, having been previously disrupted in August of the prior year. The initial STORM-2035 activity, reported by OpenAI in October 2024, involved generating both long-form web articles (700 to 900 words) and short comments. The earlier operation published content across X, Instagram, and five websites, with some websites posing as progressive and others as conservative. In contrast, the recidivist activity focused solely on posting comments on X, indicating an effort to keep different workstreams separate, according to OpenAI's June 2025 report. Both iterations of the operation generated content concerning US, UK, Irish, and Venezuelan politics, as well as Latino rights.
Why It Matters
This case illustrates how malicious actors adapt their methods following platform disruptions, shifting tactics to continue influence operations. Builders and researchers should note the persistent nature of such activities and the specific platforms and content types favored by these groups, even when engagement metrics are low.
What To Do
- Note the specific content themes and target regions identified in both the October 2024 and June 2025 reports.
- Compare the operational differences between the initial and recidivist STORM-2035 activities, particularly the shift in platform usage.
- Observe the low engagement metrics (150–350 views, zero likes/shares/comments) for the recidivist activity, which still prompted platform intervention.
- Watch for future reports from OpenAI regarding threat actor adaptation and disruption efforts.
Keep Exploring
/atlas/claude-family /atlas/gpt-family /techniques/system-user-separation /techniques/ptcf