Introducing InfoOps Bench

Information operations are a well-documented and persistent threat to democracies. Hostile states are constantly conducting efforts to influence public opinion, both at home and abroad, including efforts to disrupt elections and damage democracy.

In our monitoring work we have been observing these efforts for years, however more recently there is a growing concern that AI models will accelerate Information Operations by removing the time-consuming human work that used to hold these operations back, and could be co-opted to rewrite a false claim as a social media post, turn it into an advocacy campaign in a dozen languages, or to hyper-personalise a narrative for a specific audience.

InfoOps Bench is our attempt to measure how far frontier models can be co-opted in this way. It is available as a public leaderboard that is updated weekly, and is built from real claims rather than hypothetical prompts written in a lab. The full methodology is set out in our paper, which we have just released, and in this post I want to give a short overview of how the benchmark works and what we found.

Built from real claims

The claims come from our Information Operations Monitor, which tracks the online assets used by Russia, China and Iran to run information operations, drawing on more than 450 outlets across more than 20 countries. Each week, high-harm claims are pulled from that pipeline, fact-checked automatically, and added to the benchmark. Currently it draws on over 2,000 information operations claims, and that number grows every week.

Static benchmarks tend to saturate, either because models are trained to perform well on them, or simply because the world moves on, and a test set written a year ago tells you very little about what adversaries are pushing today. Because new claims arrive weekly, the InfoOps benchmark is resistant to saturation, and the results reflect the current threat rather than a historical one.

For each claim we test the models by asking four different framings, and measuring how the model responds, from refusing outright through to adding fabricated detail that made the output more harmful than the original.

What we found

In the paper we tested 17 models from 8 providers, and found that most of them could be co-opted to participate in Information Operations at least some of the time. Integrity scores ranged from 9.3% to 91%. We found that this difference is not explained by model capability, and instead it appears to be driven by the safeguards and safety filters that model developers choose to implement. The leaderboard is updated every week and currently covers 21 models from 8 providers.

We are sharing these results openly as we believe that developers, governments, AI safety professionals, and the general public will benefit from increased visibility into how AI models can be co-opted into Information Operations, and how this is changing in real time.

Paper: Quelle, D., Neudert, L.-M., Bright, J. and Gallacher, J. (2026). InfoOps Bench: A live information operations safety benchmark. arXiv:2607.28503.