AI Could Disrupt Democracy —the Evidence Is Now Here

Now the controlled experiment numbers. Because they’re bad. And complicated.

In December 2025, researchers published simultaneous papers in Nature and Science documenting something political scientists had feared but never measured at scale: a single AI chatbot conversation moved opposition voters’ candidate preferences by up to ten percentage points in real electoral periods, across the U.S., Canada, Poland, and the UK. Nearly 80,000 participants. Pre-registered. Peer-reviewed.

The “nearly four times more effective than political advertising” framing is technically accurate — but it requires a caveat that belongs right here, not buried three paragraphs later. The 2020 Facebook/Instagram ad removal experiment (Allcott et al.) ran for six weeks before the U.S. presidential election and found near-zero effects on political knowledge, polarisation, perceived legitimacy, and turnout. Lab persuasion and field outcomes are not the same thing. The Cornell researchers are explicit: chatbot engagement requires users to initiate conversations. That engagement barrier is real. The threat is not that chatbots spontaneously infiltrate every voter’s information diet. It’s that actors who overcome that barrier — through companion apps, social platforms, voice assistants — now wield a persuasion instrument with no historical precedent in cost-to-effect ratio.

Both things are simultaneously true. That’s the frame this piece applies throughout.

Why This Technology Is Structurally Different

Every major communications technology disrupted the political information environment of its era. The printing press. Radio. Television. Social media. What separates AI is not speed or reach alone — it’s the elimination of the human labour bottleneck.

Mounting an effective influence campaign a decade ago required armies of people: writers, account managers, cultural adapters. That labour cost was a structural constraint on abuse. MIT Technology Review estimated that a politically personalised AI conversation could now be delivered to every registered U.S. voter for under a million dollars. The 80,000 swing voters who effectively decided the 2016 election: under three thousand dollars to reach, individually, conversationally.

The Journal of Democracy‘s analysis identifies the secondary mechanism: AI floods the media landscape at a volume no human institution can fact-check in real time. The rational citizen response — believe nothing — is itself corrosive. Epistemic nihilism is the condition partisan actors fill with curated certainties. And the Knight First Amendment Institute’s 2025 review is honest that the 2024 “misinformation apocalypse” largely didn’t materialise — voter skepticism, platform guardrails, and civil society adaptation all worked as buffers. The question is how durable those buffers are.

The Persuasion Machine: What the Science Actually Shows

The Cornell-led research answers whether AI chatbots can change votes in real elections. The answer is yes — and the mechanism is counterintuitive.

AI chatbots persuade not through emotional manipulation or psychological targeting. The research explicitly tested for these and found them ineffective. They persuade by generating large volumes of evidence-backed factual claims. As Scientific American reported, Ethan Porter at George Washington University’s Institute for Data, Democracy and Politics frames this as somewhat reassuring: facts and evidence still move voters. Democracy’s epistemic precondition isn’t dead.

The problem is the optimisation curve. And it’s dark.

Malicious AI Swarms: Real Capability, Unconfirmed at Electoral Scale

Individual persuasion bots are known and increasingly studied. The genuinely novel development — described in a January 2026 paper in Science by Schroeder, Goldenberg, Christakis, and colleagues from Harvard, Yale, and Cambridge — is coordinated multi-agent AI systems designed to infiltrate democratic communities.

A necessary calibration upfront: this paper is a governance analysis of emerging capability, not a report of documented large-scale electoral deployment. The authors are describing what these systems can do and calling for governance action before they’re widely deployed. That’s a different evidential register than the Nature/Science persuasion papers, which tested actual effects on actual voters.

With that clearly stated: the capability distinction from earlier bot networks matters. Twitter trolls circa 2016 were large in number but static — detectable by behavioural signature, requiring ongoing human coordination, incapable of adapting when exposed. Malicious AI swarms inherit LLM reasoning. Extended coherent conversations. Plausible responses to challenges. Real-time tactical updates. The Harvard analysis of the paper frames the shift as moving from episodic disinformation to persistent community manipulation — from flooding the information environment to systematically shaping social dynamics over time.

Detection methods are improving alongside capabilities. The race is between offense and a moving target, not offense and a static one. The forward-projecting nature of this threat is actually where the governance window argument gets its urgency.

Surveillance, Repression, and the Coercive Threat

The information threat and the coercive threat share a structural root. The same capabilities enabling personalised persuasion at scale also enable surveillance at a granularity previously available only to the most heavily resourced state security services.

Legal scholar Matthew Tokson’s 2025 analysis in the University of Pennsylvania Journal of Constitutional Law identifies the specific mechanism: AI law enforcement concentrates coercive capacity. Traditional authoritarian control requires large human coalitions — each member of which can defect, leak, or refuse orders. An AI-enabled enforcement system can theoretically be controlled by a very small number of people, eliminating the friction that has historically constrained authoritarian excess. This is a structural argument, not a documented outcome. The capability is built before the abuse occurs. That’s precisely what makes it difficult to legislate against proactively.

More concretely: the Journal of Democracy documents China’s AI surveillance infrastructure being exported via its Digital Silk Road, with confirmed deployments in Bangladesh, Colombia, Ethiopia, Guatemala, the Philippines, and Thailand. The Carnegie Endowment’s January 2026 mapping identifies Iran, Russia, and Venezuela as actively weaponising generative AI to suppress opposition. Freedom House’s 2025 Freedom on the Net report: 15th consecutive year of global internet freedom decline, the most consistent mechanism being manipulation of online political information.

The “What the evidence can’t establish” column is adversarial by design — each row names a specific limit of the cited evidence, not a dismissal of the threat. Evidence levels: Confirmed = consistent findings across multiple independent sources; Capability confirmed = demonstrated technically, not yet at documented electoral scale; Mechanism-specific = structural argument with named causal chain, not yet empirically demonstrated at stated scope.

The Other Side: AI as a Democratic Tool

A serious analysis can’t treat the technology as unambiguously corrosive. The same open-source ecosystem that puts persuasion tools in bad actors’ hands puts detection tools, civic engagement platforms, and accessibility infrastructure in civil society’s hands. The technology is genuinely two-sided.

What’s actually working. Carnegie’s July 2025 analysis documents AI tools processing over 1,000 detailed resident responses after Los Angeles’s 2025 wildfires — preserving people’s language, elevating shared concerns, giving policymakers a more representative picture than conventional comment processes produce. Fort Collins, Colorado: 4,000 long-form responses on contested land use, synthesised for council use. These address democracy’s structural weakness — the gap between governance complexity and participation capacity.

The Centre for Democracy and Technology’s 2024 case studies identified three working models: fact-checking collectives in Mexico using AI to match disinformation volume at lower cost; decentralised civil society coordination in Taiwan — the model that proved most resilient to coordinated AI influence operations in 2024; and academic AI incident tracking creating accountability. The OECD’s 2025 governing-with-AI report documented 200 real-world government applications including civic participation tools.

The technology is being deployed on both sides. The question is which side is winning — and where — and whether the institutional investment in democratic AI is scaling at comparable pace to the offensive deployment. Right now, it isn’t. That’s the actual problem.

More on how civil society is fighting back: ForbiddenAI — AI governance & democratic rights

What Three Datasets Imply for 2027 — A Cross-Source Synthesis

What’s Actually Being Done — and What Isn’t

The response landscape is neither absent nor adequate to the pace of capability development. The EU AI Act is scheduled for full application from August 2026, with the Commission’s November 2025 digital omnibus proposing a delay of high-risk AI rules to 2027 or 2028. The U.S. America’s AI Action Plan, July 2025, prioritises innovation and national security while leaving gaps in fairness requirements and human rights accountability. Japan’s AI Promotion Act, passed May 2025, takes an industry-led approach. None of these frameworks specifically addresses the persuasion-optimised open-source deployment scenario Cornell and the UK AI Security Institute identified as the most immediately actionable threat vector.

The Schroeder et al. paper identifies three concrete leverage points for swarm defense: technical detection standards at infrastructure level, economic disincentives on model developers and platform operators who fail to implement detection, and governance mechanisms beyond voluntary compliance. The CDT case studies point toward a fourth the academic literature underweights: the Taiwan model of decentralised civil society coordination — overlapping resilience rather than centralised fact-checking that can be overwhelmed or discredited. That model requires investment long before a crisis, not as a response to one.

The capacity to demand provenance and disclosure for AI-generated political content is now a democratic competency. The Harvard Kennedy School’s AI Ethics Initiative, February 2026, is explicit that individual actors have meaningful agency — but that capacity is distributed extremely unevenly. The communities most targeted by AI persuasion tools are typically those with least access to counter-capacity. That asymmetry is where the democratic case for AI governance is strongest: not because AI is irredeemably corrosive, but because the market for AI-enabled democratic offense is far more developed than the market for AI-enabled democratic defense, and market forces alone won’t close that gap.

For Policymakers and Citizens

Five Questions, Answered Honestly