Alcuin of York, the eighth-century scholar whom Charlemagne kept at his court like a particularly useful piece of furniture, is regularly credited with vox populi, vox dei, i.e., the voice of the people is the voice of God. He did not mean it as praise. Writing to Charlemagne around 798 AD, he warned against those who parrot this phrase: “the turbulence of the crowd,” he wrote, “is always close to madness.” Alcuin had spent enough time in courts to understand that what sounds like the voice of the people is often the voice of whoever last shouted loudest.
Twelve centuries on, the shouting has been automated. A paper published in Science on January 22 this year, by twenty-two researchers spanning Cambridge, Yale, ETH Zürich, Oxford, and Norway’s SINTEF Digital, does something useful, It maps what happens when large language models fuse with multi-agent architectures to produce what the authors call “malicious AI swarms.” The definition is worth dwelling on. These are AI-controlled agents that maintain persistent identities and memory. Coordinate toward shared objectives while varying tone and content. Adapt in real time to engagement and human responses. Operate with minimal human oversight and deploy across platforms simultaneously. This is not science fiction. The 2016 Russian Internet Research Agency operation on Twitter reached only one percent of users with seventy percent of its content, with no detectable effect on opinions or voter turnout (Eady et al., Nature Communications, 2023). That ceiling, the authors argue, is precisely what AI has now removed.
The history is worth tracing. The printing press created a public sphere and broke the Church’s monopoly on ideas. The broadcast era centralised influence back into a one-to-many model: radio, television, and political parties as arbiters of what a nation believed. The internet then fragmented this again, lowering barriers to speech and simultaneously lowering barriers to manipulation. Each technological transition “reshaped political power.” What AI swarms represent is not just another step in this progression. It is rather a qualitative rupture. The industrialisation of the appearance of public opinion.
Francis Galton, in 1907, asked 800 visitors at a country fair to guess the weight of a live ox. The median answer was within one percent of the correct figure. This “wisdom of crowds” (the aggregation of independent judgments outperforming any single expert) depends entirely on independence. AI swarms attack that independence directly. It can seed narratives across dispersed communities through heterogeneous personas. Adapt in real time to which messages land and which do not. Run what the paper calls “millions of micro-A/B tests” at machine speed. Through this, they manufacture the illusion of grassroots consensus. Citizens update beliefs on perceived peer norms more readily than on evidence. A chorus of seemingly independent voices creates what the authors call “synthetic consensus”. It can be best described as a mirage of bipartisan agreement that is, in fact, a product of central coordination. Whether this amounts to a Gresham’s Law of public discourse (bad speech driving out good) is one of the more interesting questions the paper prudently does not resolve.
India knows something about this terrain. The 2024 Lok Sabha elections, which the paper flags explicitly alongside Taiwan’s, Indonesia’s, and America’s contests, saw deepfakes and fabricated news outlets enter the debate at scale. The European Parliament’s research service catalogued “information manipulation in the age of generative AI” as a structural threat in a 2025 brief. Research published in PLOS One found that almost all major LLMs tested produce election disinformation content that human evaluators cannot distinguish from authentic material more than half the time. Closer to the paper’s argument: the “Pravda” network appears to have been purpose-built not for human readers but for web crawlers feeding LLMs. The paper calls the strategy “LLM Grooming.” Flood the web with fabricated chatter. Wait for the next training cycle. Watch fabricated narratives calcify in model weights. The epistemic substrate of future AI systems is being contaminated today.
The governance proposals are layered and, in places, candid about their own limits. Always-on detection with public audits. Cryptographic attestations to verify provenance. Optional “AI shields” allowing users to down-rank likely synthetic content. A distributed “AI Influence Observatory” to standardise evidence across academic groups, NGOs, and multilateral institutions. And, crucially, economic levers. Disrupting the commercial market for influence operations, discounting synthetic engagement in platform revenue-sharing, and requiring disclosure when accounts are flagged for coordinated inauthentic behaviour. Voluntary compliance is explicitly rejected. Market forces alone will not suffice when inauthentic accounts inflate the very engagement metrics that drive platform revenue, a market failure of the paper names without flinching.
There is a sentence in the paper worth wider circulation. “Domestic political elites,” it observes, “are often among the most prolific sources of misleading or manipulative information and may be unwilling to constrain technologies they perceive as beneficial to their own campaigns.” This is not a claim about foreign adversaries. It is a description of an incentive structure.
The threat to democracy from AI swarms is real and newly documented. The threat from the people governing democratic institutions is older, less tractable, and, for now, considerably harder to detect.
Alcuin, one suspects, would not have been surprised.
