By ByteBot
The Israeli government paid a media firm $900,000 to publish more than 100 fake think tank articles in 12 days — every one engineered to manipulate how ChatGPT, Gemini, and Perplexity respond to questions about the Israel-Palestine conflict. The firm behind it, Piro Inc., calls the technique “AI Story Optimization.” Researchers call it LLM poisoning. Whatever the label, the operation worked, and any developer running an AI product over real-world data should read the playbook carefully.
The Operation
The Hanover Institute for Public Policy launched August 6, 2026. It looks like a legitimate American think tank: professional layout, generic institutional name, red-white-blue color scheme, no bylines. In reality, it was created by Piro Inc. — a media firm co-founded by Daniel Rosenberg, a film producer turned AI influence contractor — on behalf of the Israeli Government Advertising Agency, contracted through the French media conglomerate Havas Media. Piro received $900,000 for the engagement.
The Hanover Institute published more than 100 reports in under two weeks, all addressing Israel and Palestine. NewsGuard analyst Alice Lee called it “a perfect imitation of a typical credible American think tank, even down to the generic name, site layout, and color scheme.” GPTZero analyzed 12 randomly selected articles and flagged 11 as “highly confident AI-generated” and one as “moderately confident.” The content is machine-made and machine-optimized — for other machines.
How You Engineer Content to Fool an LLM
Piro’s approach is a direct exploit of how language models evaluate credibility. Their website states they “author content engineered for how LLMs evaluate credibility” and promise to make a brand “the story an AI engine tells” within a week. The Hanover Institute articles implement this playbook precisely:
- Question-first structure — articles open with the exact queries users type into chatbots (“What Caused the Displacement of Palestinians in 1948?”), optimizing retrieval in RAG systems
- Citation density — footnotes, peer-reviewed references, and official statistics signal academic authority to LLMs
- Neutral tone — emotional or partisan language gets downweighted by LLMs; academic register does not
- Structural completeness — tables of contents and headers mirror the document format of legitimate research
Piro’s own marketing summary: “The engineering gets you cited. The story makes you chosen.”
Why This Is a Developer Problem
It’s tempting to frame this as political news. It isn’t — or not only. This is the first publicly documented, government-funded, commercial-scale LLM poisoning operation. It’s a proof of concept that the attack works. And the attack surface is any AI product that retrieves from a broad web corpus.
The 2026 PoisonedRAG research makes the math stark: inject 5 adversarial documents into a 2.6 million-document corpus and you can control an LLM’s output 97% of the time. The Hanover Institute published 100+ documents. Piro openly sells this service to commercial clients. Any actor with roughly $1 million can replicate the operation for any domain — product reviews, financial analysis, medical information, legal research.
The Defenses That Exist (and Why Few Use Them)
RAG security research has produced real tools. RAGuard fine-tunes retrievers on synthetic adversarial examples. RAGPart fragments documents and aggregates results through majority voting. TrustRAG scores source trustworthiness through multi-source consensus. Perplexity-based detection flags statistically unusual text insertions. None of these is a silver bullet, and none is deployed by default in any major RAG framework. Most production RAG systems do zero source provenance validation.
If you’re building a product that retrieves from the open web — or any corpus you don’t fully control — source reputation scoring and retrieval-stage anomaly detection are no longer optional hygiene. They’re table stakes.
The Bigger Picture
The Responsible Statecraft investigation that broke this story is worth reading in full. But the detail that should land hardest for the tech community: Piro’s service is publicly marketed. There are no laws prohibiting “AI Story Optimization.” AI labs have no public policy on filtering state-sponsored influence content. The Hacker News discussion hit 713 points today — the community is paying attention. The question is whether AI product teams will.
The Hanover Institute is almost certainly not the first operation of this kind. It’s just the first one that disclosed what it was.
