OpenAI has released an updated report, “Disrupting malicious uses of our models” (February 2026), detailing new cases of malicious attempts to abuse its artificial intelligence systems. Among the exposed operations was activity linked to the Russian media network “Rybar,” identified as part of an operation dubbed “Fish Food.”
According to the report, OpenAI banned a set of ChatGPT accounts connected to the Rybar network on Telegram and X. At least some of the accounts likely originated in Russia. The network generated content that was posted both by Rybar-branded accounts and by other social media profiles that did not publicly disclose any affiliation with the group.
OpenAI states that the primary activity within Operation “Fish Food” involved generating social media content in multiple languages, including Russian, English, and Spanish. Some of this content was published by official Rybar accounts, while other posts were distributed through a broader network of profiles. In one instance, a single prompt generated seven tweets, six of which were later posted on X by different accounts.
The report also notes that one user asked ChatGPT to help draft commercial proposals on behalf of Rybar for covert influence campaigns in Africa. These proposals included running X and Telegram accounts, launching a bilingual “investigative journalism” website focused on Africa, placing paid publications in French-language media, and building a network of amplifiers. One of the outlined projects mentioned an estimated annual budget of up to $600,000.
OpenAI emphasizes that the content generated in this operation reflected typical narratives associated with covert Russian influence campaigns, including praise for Russia and its allies, criticism of Ukraine, and accusations of Western interference.
According to the report, the Rybar network has a substantial online presence, with its main Russian-language Telegram channel alone counting approximately 1.4 million subscribers. However, OpenAI said it did not observe the operation’s content being amplified by major mainstream media outlets.
The company stressed that it continues to detect and disrupt malicious uses of its tools and is working with industry partners to counter influence and fraud-related operations.