On the day of Israel's Knesset election, October 27, 2026, a claim spread on X that bot networks originally created to target Iran's government now push pro-Netanyahu messages. An English-language news outlet's post attributed it to Israeli media reports. We could not trace it to a primary report, and searches found no evidence for the "originally built against Iran" part. But several documented, better-sourced influence operations around this election are real. This post sorts what is claimed, what is verified and what is unknown. It relies on outlets that relayed the underlying reports, and the figures below belong to those reports.
Quick reference
| Claim | Status |
|---|---|
| Bots built to target Iran now back Netanyahu | Unverified; no primary report found |
| Iran-linked network posing as Israelis | Reported by Golden Owl via Ynet; an assessment, not proof |
| Israeli firm IntelEye ran about 1,000 fake accounts | Reported by the New York Times via Ynet; company says it was a research experiment |
| Shin Bet removed foreign-influence accounts | Announced by Shin Bet; no details disclosed |
| Parties used AI deepfakes and bots | Reported in an OECD AI incident summary; needs primary confirmation |
The viral claim and why we can not confirm it
The claim, as posted by an English-language outlet citing "Israeli media reports", says bots built to target the Iranian government are now pushing pro-Netanyahu messaging. When we searched for the underlying Israeli report, the closest matches were different stories: the Iran-linked network and the IntelEye report below. Neither says accounts were built against Iran and then switched sides. That does not prove the claim false, only that we cannot attach it to a document. Until a named report with evidence appears, treat it as unverified.
What is documented: an Iran-linked network posing as Israelis
Ynet reported on research by Golden Owl, an open-source intelligence firm, finding an operational core of 35 accounts: 32 presenting as Israelis and three Hebrew-language media-style channels. In an Aug. 22 to Sept. 22 review of 21,533 election-related items, about 93 percent were judged ordinary political activity. Over 30 days, 31 active accounts produced 1,191 posts, replies and quotes with 947,322 views; Golden Owl estimates the total could exceed 1.2 million. The personas had about 23,000 followers combined.
Examples include a Persian-language account created in 2019 that switched to Hebrew politics posts in late August, with location data placing it in Germany while connecting through an Iranian Android app, and a persona whose posts largely reappeared from a Hebrew "AI content production group" channel that an Israeli government assessment had previously linked to Iranian influence. One AI-generated video drew over 688,000 views.
The attribution is an assessment. Golden Owl says the network is "most consistent" with an operation associated with Iran's regime, did not identify a specific agency or person, and had no access to IP addresses, login records or private communications. Its tallies of false voting claims (96 pieces, including wrong election dates) and fraud allegations (357) overlap and should not be read as separate operations. Accounts that retweeted the network, it stresses, should not be considered participants.
What is documented: an Israeli company and 1,000 fake accounts
The New York Times, as relayed by Ynet, quoted U.S. intelligence officials describing a "disturbing breakthrough" in online information warfare: Iran, China and private Israeli companies deploying AI-powered "bot armies" that create profiles, write posts and join debates without human involvement. It named IntelEye, a Tel Aviv firm founded by former NSO employees, as having reportedly operated about 1,000 fictitious accounts posting content both supporting and opposing Netanyahu. IntelEye said the activity was a research experiment. We could not see the Times piece directly, and the Ynet summary gives no publication date or reach figures.
This matters for the viral claim: reporting shows bots can be run by private firms and used in both directions, which makes "whose bots are these" hard to answer from outside.
What the authorities said
Shin Bet announced, jointly with the State Prosecutor's Office Cyber Department and the Central Elections Committee, that accounts used in foreign influence operations ahead of the vote were removed from social media. According to coverage of that statement, it did not identify who was responsible, which countries or platforms were involved, what messages were spread, or how many accounts were removed. Shin Bet's chief was also reported to have told Knesset members that Iran, among other states, is trying to disrupt the electoral process. Treat these as official warnings without public evidence.
AI deepfakes and automated calls
An entry in the OECD's AI incident monitor, dated October 19, says political parties, notably Likud, used AI-generated deepfakes, automated calls and bot networks. It is built from five Portuguese-language articles and is a monitor summary, so we cannot treat it as confirmed. Separate wire reporting said Netanyahu circulated AI-generated material warning about a possible opposition government involving Arab-Israeli parties; we did not verify that directly either. The safe reading is that AI-generated political content is circulating widely on both sides, but specific attributions to specific parties need primary evidence.
Earlier precedent: the wartime bot networks
None of this is new for Israeli politics. Ynet reported earlier on an Iranian-linked bot network trying to influence Israeli audiences, and search results surfaced a 2025 report from Israel's Diaspora Ministry saying an Iranian-linked X network accounted for up to 60 percent of the traffic on key wartime hashtags, plus a 2019 report of at least 350 fake Iranian accounts aimed at Israeli political discourse across several platforms. We did not verify those older figures independently, but they show a long-running pattern: state-linked operators building personas, then reusing them as topics change.
That pattern is also the most plausible seed for the viral claim. Operators do repurpose accounts: a network built for one audience gets pointed at another. What differs in the claim we could not verify is the direction. The documented network posed as Israelis and posted on Israeli election topics; nothing we read says it flipped from attacking Iran's government to supporting Netanyahu.
How AI changes the economics
Older bot networks needed people to write posts, which limited scale and left tells such as copied text and awkward Hebrew. Golden Owl's account of the Iran-linked network shows both: reused text and non-native Hebrew patterns gave it away. The New York Times report, as relayed by Ynet, describes the next step, agents that write original posts and join debates without human involvement, which removes those tells and makes each account cheaper to run.
For researchers, that shifts the evidence from content to behavior. Posting rhythm, account history, sudden topic changes and coordination across accounts become more informative than the text. For platforms it means detection has to work at the network level, and for readers it means no single post can be judged on style alone.
What platforms and voters can do
- Platforms: label and rate-limit automated accounts, publish takedown data with account counts and reasons, and share indicators with election authorities. Shin Bet's removal announcement named no platform and no numbers, which is the transparency gap researchers keep flagging.
- Researchers: publish methods, distinguish indicators from attribution, and avoid counting amplifiers as participants, as Golden Owl itself cautions.
- Voters: treat sudden viral claims about election dates, closures or fraud as suspect, and confirm them with the official election authority before sharing.
- Journalists: name the source behind "reports say" claims, which is the main failure in the viral post we examined.
What would change our assessment
Three things would let us upgrade the viral claim from unverified: a named Israeli outlet or research group publishing the account list and the earlier history of those accounts, evidence that the same accounts previously posted against the Iranian government, and a statement from X or the authorities confirming the link. Absent those, the careful wording is the one used above: documented networks exist, their direction and ownership are disputed or undisclosed, and the specific repurposing story is not established.
How to evaluate such claims yourself
- Find the named report. "Israeli media reports" is not a source; look for the outlet, author and any underlying dataset.
- Separate evidence from attribution. Metadata and copied text show coordination; naming a state requires more.
- Check the counts. Overlapping categories and upper-bound audience estimates are not tallies.
- Consider both directions. The IntelEye report describes content for and against the same leader.
- Verify voting information only with the official election authority. False election dates were among the documented lures.
Why it matters beyond Israel
Autonomous AI accounts lower the cost of influence operations, and the same tooling can be used by states, firms and parties. The same pattern appears in our coverage of OpenAI banning Russian and Iranian false-front operations, the claimed Iranian data authority and our running October 2026 attacks tracker. On the tooling side, if you run AI agents that post or act on accounts, see AgentBeam, the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions, and our look at a government warning about agents in live systems, the CERT-In advisory.
Related reading
- OpenAI bans Russian and Iranian false-front operations
- Iran's Persian Gulf Data Authority: claimed vs verified
- October 2026 cyberattacks and AI-run attacks tracker
- CERT-In advisory on AI agents
- Police using AI to flag suspicious drivers
- AI agent privacy promises
Details are accurate as of October 27, 2026; election-day reporting may change quickly.