In the era of generative artificial intelligence (AI), threat intelligence is facing a profound signal-to-noise challenge. AI has introduced a massive paradigm shift to threat actor operations—making execution extremely easy while simultaneously dramatically complicating the task of verification for security teams.

In our latest on-demand webinar, Matt Edmonson, SANS Senior Instructor and founder of Argelius Labs, joined Flashpoint to discuss the intersection of Open Source Intelligence (OSINT) and AI. Drawing from his vast federal law enforcement experience, he shared actionable, human-driven techniques for detecting and vetting AI-generated online content.

Neutralizing the Automated RAG and Vector Database Trap

Before deploying any human-driven vetting techniques, an analyst must understand the specific structural trap threat actors are laying. Adversaries are no longer just using AI to spin up isolated phishing copy; they are using it to corrupt the automated defense pipelines that security teams rely on.

Modern threat intelligence workflows utilize automated ingestion to feed open-source data directly into local vector databases and Retrieval-Augmented Generation (RAG) models. Aware of this, sophisticated threat actors deploy a coordinated infrastructure strategy: they register multiple lookalike domains simultaneously to broadcast the exact same AI-generated disinformation narrative.

When automated security tools ingest this data, the system flags multiple distinct “sources” confirming the story as truth. This structural echo chamber completely bypasses automated verification safeguards, polluting corporate databases with validated lies. We have seen this play out via:

• Long-Game Credibility Building: Edmonson highlighted an active Foreign Malicious Influence (FMI) campaign utilizing a French lookalike news site called Verite Cache (“The Hidden Truth”). The threat actors scrape legitimate Western news, use AI to rewrite it to build structural domain authority over time, and then manipulate narrative outcomes the moment a critical geopolitical event or election occurs.
• Simultaneous Infrastructure Deployment: This pattern was mirrored in Southeast Asia, where Singapore recently banned six lookalike news sites targeting regional discourse. Upon technical inspection, five of those six distinct domains had been registered on the exact same day to broadcast a unified narrative.
• Organic-Looking Algorithmic Surges: The scale of these operations can shift political landscapes in a matter of days. Romania recently took the extreme step of canceling and restarting its presidential election due to a covert, highly coordinated Russian-backed social media campaign. The operation used synthetic assets to trigger algorithmic recommendation engines, driving an intense, seemingly organic surge for an underdog candidate.

Triangulating AI Flaws and Anomalies Across Modalities

Vetting AI content relies on compiling a cluster of intersecting indicators across text, images, audio, and video until a definitive analytical confidence level is reached. While generative tools have grown highly sophisticated, they are still bound by mathematical constraints and architectural limitations. Catching these errors and inconsistencies requires analysts to identify a cluster of intersecting indicators across text, images, audio, and video:

• Textual Analytics (Linguistic Quirks and Filler Text): Large Language Models (LLMs) leave distinct behavioral footprints. Analysts should look for commonly-used AI wordings and “portable sentences”, as well as automated translation leakage that reveals a threat actor’s native language mechanics.
• Visual Logic Flaws (Physics and Seams): AI models frequently fail to grasp the fundamental physics of the real world. Analysts should closely inspect image logic for anatomical blunders (such as inverted hand structures), impossible geometry, or objects with extreme structural flaws. Additionally, AI struggles with “texture seams”—the exact boundaries where distinct textures meet.
• Auditory and Video Glitches (Cadence and Duration): Human speech is inherently messy, characterized by breathing pauses, environmental background noise, and shifting cadences. Synthetic speech is often locked into a perfectly uniform, monotone rhythm. Furthermore, high-fidelity deepfakes are incredibly resource-intensive to sustain over long durations. While an actor can fake 10 to 15 seconds of synthetic video convincingly, a five-minute video will almost always display jarring cuts, visual artifacting, or avatars clipping out of frame.

Empowering the Human Layer | Watch the Full Webinar

Human analysts remain the most critical layer of defense against illicit uses of AI. Empowered by comprehensive threat intelligence, OSINT, and AI technologies, security teams can hunt for clusters of intersecting indicators across text, images, audio, and video to assess authenticity. To learn more and to gain more essential techniques, watch the full on-demand webinar. Using Flashpoint, organizations can filter through noise, execute critical data premortems, and neutralize sophisticated disinformation campaigns.