Hammond Pearce (UNSW Sydney) ran something between a hackathon and a wargame: Capture the Narrative (CTN), a capture-the-flag style contest where students build AI bots to sway a simulated election on a fake social network populated by AI "voters". The numbers are striking: 108 teams, 277 students from 18 universities, about 11.8 million posts (roughly 60% by competitor bots), on budgets from $0 to under $100 using consumer laptops and commercial APIs. The player-generated content flipped the simulated outcome by 1.78%. The headline finding is that building large-scale AI-driven influence operations is, in the author's words, "scarily easy".
Post 20 of my Black Hat Asia 2026 series. This is a research and education talk about influence operations. I cover what the simulation measured and what it means for defenders and platforms. There is no bot recipe here, and none is needed to understand the results.
1. Why build a game about disinformation?
Since generative models became capable text writers, researchers have warned that they lower the cost of producing persuasive, plausible content at scale. The usual response from authorities is that misinformation cannot be fully prevented. CTN takes a different educational stance: you learn how manipulation works by doing it yourself, safely, in a sandbox. The same idea underlies security capture-the-flag contests, where people learn attacks in order to defend against them.
The design goal is dual: teach cyber-literacy (how to recognise coordinated manipulation) and produce research data about how people, given modern tools, actually behave when asked to manipulate.
2. The game world
Fig. 1 — The CTN loop: competitors influence the platform, the platform influences the simulated electorate.
- Setting: a fictional country, Kingston, with two candidates and a neck-and-neck race.
- Platform: a fake social network ("Legit Social") where everyone posts and shares, plus "journalists" and "columnists" publishing regular news updates.
- Premise: both campaigns believe dominating the platform means winning. Stage one: build bots that earn influence with popular posts. Stage two: use that influence to spread mis- or disinformation that boosts or suppresses a candidate.
- NPCs: AI agents designed to behave like ordinary people. They use the platform, read news, form beliefs, have desires, and eventually vote. They are seeded for a roughly 50:50 split, with some strongly opinionated and others centrist.
- PCs: the competitors' bots, whose job is to change NPC votes.
Each player received competition accounts, API access and a Python tutorial, so the barrier to entry was deliberately low.
3. The numbers
| Metric | Value |
|---|---|
| Competitor teams | 108 |
| Enrolled students | 277, from 18 universities |
| Competitor posts | 7,068,206 |
| Total posts | 11,842,889 |
| Share of posts from competitor bots | ~60% |
| Team budgets | $0 to under $100 |
| Simulated-election swing from player content | 1.78% |
The final in-game result was a win for Hawthorne. But the organisers also ran the counterfactual: without player-generated content, Castillo would have won. Player content moved the outcome by 1.78 percentage points, which is more than enough to decide a genuinely close election. Note the honest caveat: this is a simulation with AI voters, so it measures how manipulable that synthetic electorate is, not real voters. What it does demonstrate solidly is the cost and speed of producing manipulation at scale.
4. Tactics teams converged on
Left free to innovate, competing teams independently arrived at strategies that mirror those seen in real coordinated inauthentic behaviour:
- Spam personas in roles. "Attractor" bots create posts, "booster" bots push them toward trending, "engager" bots reinforce them with apparently credible data. A small production line for manufactured consensus.
- Varying personas. Teams varied tone, quality and posting style so their accounts looked like different people, defeating simple duplicate-content detection.
- Content scanning. Bots monitored the whole platform with semantic analysis to find specific accounts worth targeting.
- Microtargeting. Tailoring a message to an individual's expressed beliefs; the deck shows a simulated voter being persuaded step by step.
- Feedback loops. Teams measured what worked from platform data and adjusted continuously, exactly like a marketing team running A/B tests.
- Tonal manipulation. Observed styles included aggression, toxicity and gaslighting, chosen for their effect on engagement.
5. Guardrails were not much of a barrier
A post-competition survey asked about model safety guardrails. Of respondents who answered, 30 met guardrails and 26 did not (28 declined to answer). Of those who met them, 26 tried to overcome them and only 3 did not. On difficulty, 15 found it easy, 2 neutral and 8 difficult. So a majority of those who tried reported bypassing the guardrails was easy. The sample is small and self-reported, and model providers keep hardening their systems, but the direction of travel is clear: relying only on model-side refusals to stop persuasion-at-scale is not a strategy.
6. What this means for defenders and platforms
The talk is more diagnosis than prescription, but the tactics list suggests where defences should focus:
- Detect coordination, not content. Each post can look benign. The signal is in behaviour: clusters of accounts amplifying the same items at the same time, role-based structures (creators, boosters, engagers), and unusual growth in trending.
- Graph and timing analysis beats text classifiers when personas are varied by design. This connects to the graph-first approach in the Windows logon talk: structure reveals what individual events hide.
- Rate and cost controls. Account creation limits, verification, and API quotas raise the price of scale.
- Provenance and labelling. Signals about content origin help readers, though they are imperfect.
- Red team the platform. This is the organisers' own next step: add blue-team roles so participants must find and take down competitors' misinformation.
For readers and organisations
- Treat sudden, uniform "grassroots" enthusiasm with suspicion, especially when accounts are new or their tone is unusually consistent.
- Check whether a claim traces back to a primary source rather than a chain of reshares.
- Teach cyber-literacy by exercise: people who have made a fake persona recognise the next one faster.
7. Ethics and limits
All activity happened in a closed, fictional environment with fictional candidates and AI-only voters, and participants' experiences were studied to understand the emotional, behavioural and ethical dimensions of creating misinformation. Limitations to keep in mind: the simulated electorate is an approximation of human behaviour; results depend on the NPC design; and students may behave differently from professional operators with real budgets. The organisers plan an international 2026 edition with new storylines (elections, health, celebrities) and improved rules.
Does this prove AI can swing a real election?
No. It shows AI-driven content can shift a simulated AI electorate and that building such systems is cheap and easy. Real-world effects depend on real human psychology, platform design and media environments.
Why let students build manipulation bots at all?
For the same reason security education uses CTFs: to understand attacks by performing them in a controlled setting, and to gather data on how manipulation actually gets built.
Were the bots sophisticated?
Not especially. The point is the opposite: consumer laptops, commercial APIs and small budgets were enough for millions of posts.
What is the next step?
A planned international competition with red and blue team roles, so defenders practise detecting and removing coordinated misinformation.
Takeaways
- CTN is a wargame for influence operations: 108 teams, 277 students, ~11.8M posts, ~60% from bots.
- Player content shifted the simulated election by 1.78%, flipping the winner in the counterfactual.
- Teams independently discovered role-based spam, persona variation, content scanning, microtargeting and feedback loops.
- Most who tried found LLM guardrails easy to get around; cost and technical difficulty were low.
- Defence should target coordination and behaviour, add cost to scale, and build cyber-literacy through hands-on exercise.
References & further reading
- Black Hat Asia 2026 — this talk's official page — abstract, speaker bio, and slides/video when posted.
- Official talk recording on YouTube — Black Hat channel.
- Black Hat Asia 2026 — full Briefings schedule — every talk in the conference.
- UNSW Sydney — the organising university.
- OpenAI, "Better language models and their implications" (2019) — the early misuse warning the talk opens with.