The Campaign Had No Instructions

The Assumption

Detection of coordinated influence operations rests on an assumption so foundational it rarely gets stated: coordination requires communication. Accounts posting the same hashtag at the same time, using the same phrases, referencing the same fabricated event — these are signals that someone, somewhere, issued instructions. Find the instruction pathway, find the operation.

In March 2026, a peer-reviewed study published at the ACM Web Conference 2026 broke that assumption experimentally.

Researchers at USC’s Information Sciences Institute, with colleagues from the University of Naples Federico II and Northwestern University, built a simulated social media environment modeled on X. They placed 50 AI agents inside it: 10 designated as influence operators, 40 as ordinary users. The operators were given an objective — promote a political candidate — and no further instructions. No scripts. No playbooks. No coordination protocols. No messaging templates. No synchronized posting schedules.

What emerged was a coordinated influence operation.

The agents developed synchronized posting, hashtag flooding, unified messaging, and strategic audience targeting — the standard toolkit of a real influence campaign — without a single line of instruction telling them to do any of it. Every tactic appeared on its own. The researchers later ran the simulation at 500 agents and found the results consistent.

What “Emergent” Means

The word emergent in the study’s title matters. Emergent behavior is behavior that arises from the interaction of simple rules without being encoded in any single rule. It is the property of the system, not the property of any component.

In the study’s setup, each agent could observe the social environment: what others were posting, what was being amplified, what was gaining traction. Each agent had an objective. No agent needed to communicate with its teammates to know what a useful post looked like — it could observe what teammates were posting and producing that was working, and generate its own contextually appropriate version.

The result is coordination without a coordination channel. No messaging thread. No shared document. No command sent from operator to bot. The network’s topology — knowing who else was an operator — was the only infrastructure required.

The study’s most striking specific finding: simply telling the bots who their teammates were produced coordination nearly as strong as when bots actively strategized together. Not slightly weaker. Nearly equivalent.

The implication is that the minimum viable apparatus for a coordinated influence operation is: an objective, a network, and knowledge of who else shares the objective. That is all.

What Detection Is Looking For

Current platform detection for coordinated inauthentic behavior looks for signals that require coordination to produce:

Temporal clustering — multiple accounts posting on the same topic within narrow time windows
Linguistic fingerprints — shared phrases, repeated sentence structures, shared typos that indicate common source material
Hashtag synchronization — coordinated adoption of specific tags at launch
Behavioral matching — accounts that follow the same amplification patterns, like the same posts, reply to the same threads
Communication channels — evidence that accounts are linked through shared creation infrastructure, shared IP addresses, or shared posting tools

These methods are effective against operations that are coordinated by instruction — operations that require someone to draft a message and send it to fifty accounts, or to run a spreadsheet scheduling posts, or to use a shared content library. The coordination is the artifact, and the artifact leaves traces.

Emergent coordination does not produce these artifacts in the same form. The agents are not posting the same phrases because someone told them to; they are posting similar content because they share an objective and can observe what effective content looks like in their environment. The posts are generated fresh by the agent, contextually responsive, linguistically varied. No templates. No shared timing protocol. No communication channel linking operator to operator.

The detection tools are not miscalibrated — they are calibrated to detect something that no longer needs to exist.

The Organic Aesthetic Is Not Performed

There is a version of this problem that sounds manageable: AI bots mimicking organic behavior well enough to fool detection. That would be a performance challenge — sufficiently sophisticated mimicry eventually gets detected because the mimicry must be sustained and the edge cases accumulate.

The USC finding describes something structurally different.

The agents in the study are not performing independence. Within the frame of their operation, they are genuinely independent. Each one is observing the same social environment, responding to that environment with its own generated content, and arriving at behavioral alignment through the shared logic of having the same objective in the same information space.

This is not imitation grassroots. It is a mechanism that produces what grassroots actually looks like — distributed, contextually varied, temporally uncoordinated — because the agents are operating the same way grassroots opinion formation operates: lots of independent actors responding to a shared information environment with independently formed but structurally similar views.

The difference is the objective. In genuine grassroots, the alignment emerges from people sharing a real belief. In an emergent AI influence operation, the alignment emerges from agents sharing an assigned goal. The behavioral signature is indistinguishable.

Scale and the Deployment Gap

The study ran at 50 agents and at 500 agents. Results were consistent. This confirms the mechanism scales — not a fragile simulation artifact but a robust property of the architecture.

The component technologies are not experimental. Large language model agents capable of independent text generation are commercially deployed. Social media APIs exist. Basic network setup is infrastructure-level work. The study is a controlled academic demonstration, but the gap between “demonstrated in controlled simulation” and “deployed in real operations” in influence operations work has historically closed within one to two years of the research becoming public.

The IRA was running coordinated inauthentic operations on Facebook in 2016. The academic literature on computational propaganda that described such operations in precise technical terms was published in 2017 and 2018. By 2020, researchers were documenting new operations that had directly operationalized the techniques those papers described. The publication of a technique is not a warning of a future threat — it is documentation of a capability the relevant actors are already developing or deploying.

The USC study describes a capability that requires no novel technology, no specialized infrastructure, and no explicit coordination protocol. The barrier to deployment is low.

What You Would Need to Find Instead

The detection problem is not insoluble. But it requires a different observation target.

Instead of asking “are these accounts coordinating?” — a question about process — detection needs to ask: “are these accounts organized toward a shared objective in a way that produces behavioral alignment without explicit communication?” That is a question about structure.

Structural detection looks for:

Objective coherence under semantic variation — accounts posting thematically aligned content whose alignment cannot be explained by topic similarity alone, where the alignment pattern follows the contours of a specific narrative goal rather than an organic information event
Amplification topology — accounts that consistently amplify each other’s content without explicit connection, where the amplification graph matches what you would expect if agents had teammate awareness
Response-to-environment patterns — accounts that respond to the same environmental signals (a debunking article, a counter-narrative post, a fact-check) in the same direction without coordination, suggesting shared objective rather than shared instruction
Behavioral consistency at scale — the same qualitative behavior at 50 accounts and at 500, which suggests a structural property rather than individually managed performance

None of these are simple to operationalize. They require modeling what organic behavior looks like under the same conditions — which requires the kind of large-scale behavioral baseline data that platforms have and researchers generally do not.

Influence Tactics Breakdown

Emergent Consensus Manufacturing. Using structural coordination — shared objective plus social observability — to produce the behavioral appearance of independent organic consensus. The mechanism requires no communication and leaves no communication artifacts. The consensus looks real because the process that produces it resembles the process that produces real consensus; only the source of the shared objective differs.

Template Elimination. LLM-generated fresh content for each post defeats the most widely deployed detection mechanism: linguistic fingerprinting of shared or templated source material. Each post is contextually appropriate, semantically varied, and generated in response to the specific moment of posting. The repetition is conceptual, not textual.

Minimum Signal Coordination. Requiring only teammate identity as the coordination input means there is no coordination channel to find. There is no instruction to intercept, no shared document to discover, no messaging thread to subpoena. The operation is coordination-channel-free by architecture.

Scale Invariance. Demonstrated consistent behavior at 50 and 500 agents. The mechanism does not degrade at scale; if anything, larger networks produce stronger emergent alignment because more agents observing more successful content creates a stronger signal about what the environment rewards. The economics of scale work in favor of the operation.

Objective-Encoded Architecture. The operation’s intent is expressed in the agents’ objectives, not in any post or instruction. Attribution becomes harder: there is no artifact that contains the operation’s goals in a recoverable form, only behavior consistent with those goals.

What the Study Actually Proved

The study’s authors are careful in how they scope the finding. This is a simulation. The agents operated in a controlled environment. Real-world platforms have active moderation, existing account histories, adversarial researchers, and users who are not neutral observers.

What the study proved is that emergent coordination is a real property of this architecture, not a theoretical possibility. The mechanism works. It scales. It produces behavior that matches the outputs of explicitly instructed influence operations without requiring any of the infrastructure that makes explicit operations detectable.

This shifts the problem. The question is no longer whether influence operations can be run without explicit coordination. They can. The question is what you can actually detect about an operation that was designed, from the start, to have no detectable coordination.

Current detection assumes there is a communication channel to find. The USC study demonstrates a class of operation for which there is not.

Detection built on that assumption will not catch it.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: