Incident Overview
On February 22, 2026, Bulgarian investigative journalists uncovered a coordinated network of fake Facebook profiles using AI-generated profile images. These profiles were actively amplifying content from Bulgaria’s political party, There Is Such a People (ITN), in the lead-up to national elections. The network primarily shared posts by ITN politician Pavela Mitova and party leader Slavi Trifonov, artificially inflating engagement metrics and visibility for their messages. This activity was not isolated; it formed part of a broader pattern of inauthentic behavior designed to manipulate public perception and influence electoral outcomes.
The profiles were traced back to individuals including Shte Ima Takuv Narod (Aneliya Yordanova), Nikola Savov, and Magdalena Kostova, who were allegedly involved in deploying synthetic image generation technology. The AI-generated faces were used to create the illusion of authentic user activity, making it difficult for casual observers to distinguish between genuine and fabricated accounts. This incident highlights the growing intersection of generative AI and political influence operations, where synthetic media is weaponized to distort information ecosystems.
The coordinated effort began no later than February 22, 2026, with one profile sharing Pavela Mitova’s post from February 20, 2026, twice as part of the amplification strategy. The incident was formally recorded in the OECD AI Incidents and Hazards Monitor (AIM) on April 24, 2026, classifying it under misinformation and malicious actor misuse categories.
The harm extended beyond ITN supporters to Bulgarian voters, Facebook users, and the broader democratic integrity of the country. The incident also impacted epistemic integrity—the reliability of information available to the public—by introducing synthetic content into the digital conversation.
Possible Root Cause
The primary root cause of this incident lies in the deployment of synthetic image generation technology to create fake Facebook profiles. These profiles were designed to mimic real users, complete with AI-generated faces that appeared indistinguishable from authentic photographs. The technology allowed operatives to bypass traditional verification methods, enabling the creation of a large-scale network of accounts that could amplify specific political narratives without detection.
The development and use of this AI system can be traced to generative AI developers and deepfake technology creators, who provided the tools necessary for the operation. The profiles were managed by individuals associated with ITN, including Aneliya Yordanova, Nikola Savov, and Magdalena Kostova, who coordinated the amplification of party-related content. Their actions exploited Facebook’s content-ranking system, which prioritizes posts based on engagement metrics such as likes, shares, and comments.
The incident also reflects broader trends in the misuse of AI for influence operations. The OECD AI Incidents and Hazards Monitor categorizes this as an example of malicious actor misuse, where AI systems are intentionally deployed to deceive and manipulate public opinion. The use of synthetic media in this context demonstrates how generative AI can be repurposed from creative or benign applications to serve malicious ends, particularly in politically sensitive environments like election periods.
Additionally, the incident underscores the role of social media platforms in enabling such operations. Facebook’s content-ranking algorithm, which relies on user engagement, inadvertently facilitated the spread of ITN’s content by prioritizing posts from the fake profiles. This highlights a systemic vulnerability: platforms that reward engagement without robust verification mechanisms can become unwitting participants in disinformation campaigns.
Takeaways
This incident reveals the escalating threat posed by AI-generated synthetic media in political campaigns. The use of AI-generated faces to create fake profiles demonstrates how easily digital deception can be scaled, making it increasingly difficult for platforms and users to distinguish between authentic and fabricated content. For policymakers and platform operators, the case serves as a warning about the need for proactive measures to detect and mitigate AI-driven influence operations.
Current methods for detecting fake profiles, such as behavioral analysis or manual reviews, may not be sufficient when faced with AI-generated visuals that closely resemble real individuals.
Developers and researchers must consider the potential for misuse when designing tools capable of creating synthetic media.
Finally, the incident serves as a reminder of the broader societal impact of AI-driven disinformation.
The Bulgarian case also fits within a broader pattern of AI incident variants, where similar tactics—such as YouTube’s recommendation algorithm promoting misinformation or student-developed facial recognition apps raising ethical concerns—demonstrate recurring risks across different platforms and applications.
Sources
Incident summary from the AI Incident Database, used under CC BY-SA 4.0.