Grooming the Machine: Building EU Cognitive Resilience Against Coordinated Narrative Poisoning of LLMs

When the priests are called

In April 2026, Anthropic informed the public that it had built a model called Claude Mythos and then decided not to release it. The model, by its developer’s own admission, can identify zero-day vulnerabilities in every major operating system and browser; the UK AI Security Institute called it a “step up” in cyber-attack capability, and the company described its existence as a watershed moment for cybersecurity (Milmo, Makortoff and Down, 2026). Access is currently restricted to a circle of forty banks and tech firms participating in Project Glasswing. A few weeks earlier, the same company had finalised the constitution governing how its models are trained, with the help of Father Brendan McGuire, a Catholic priest from Los Altos, California, who was working alongside the Vatican’s Dicastery for Culture and Education (Tremayne-Pengelly, 2026). When an industry feels the need to call in priests, the question is rarely what doctrine they bring. It is what its laboratories need to exorcise. Mythos is a closed-circuit problem: a high-capability model under elective restraint. Its inverse is the open-circuit problem this brief addresses: high-capability, publicly deployed chatbots ingesting whatever the open web feeds them, including coordinated efforts to feed them propaganda. This is the threat surface of LLM data poisoning, and it is here that European cognitive security is currently being tested.

What LLM data poisoning is, and why it is a security problem

LLM data poisoning, or LLM grooming, in this context refers to the structured saturation of the information environment with fabricated narratives designed for ingestion by crawlers and retrieval systems that feed large language models (Danet, 2025). The Pravda network, a constellation of Kremlin-aligned domains initially mapped by the American Sunlight Project, CheckFirst, Viginum, and DFRLab, has pivoted from human readers to crawler-targeted publishing, uploading high-volume webpages with unique URLs intended to be indexed by the search engines used to build LLM training datasets (CheckFirst, 2025). To date, NewsGuard has identified 3,006 AI-generated news websites operating in 16 languages with little to no human oversight (NewsGuard, 2026); meanwhile, the ten industry-leading chatbots have repeatedly reproduced Pravda-laundered narratives approximately 30% of the time across multiple audits (Sadeghi and Blachez, 2025). While the literature shows that there is still no escaping the cybersecurity defenders’ dilemma: as few as 250 malicious documents can poison a model’s training data, regardless of model size, introducing harmful backdoors (Souly et al., 2025).

The Alan Turing Institute’s three-stage taxonomy shapes the pipeline: generation, dissemination, and engagement (Stockwell, Janjeva and McDonald, 2026). Pravda generates, search-engine-optimised genAI news aggregators disseminate, and Retrieval-Augmented Generation (RAG)-enabled chatbots engage. The Arctic case is paradigmatic: in 2024-2025, mentions of the Northern Sea Route in Pravda-network content rose 238% while total human views fell 31%, a pattern the analysts read as targeting algorithms rather than readers (Schultz and Vakhruseva, 2026).

This is cognitive warfare in its current form. NATO defines cognitive warfare as the exploitation of human cognition to manipulate perception, disrupt decision-making, and influence behaviour (Blatny, 2025); the EUISS extends this logic into cognitive security, the defensive twin focused on the perceptual and behavioural vulnerabilities that enable manipulation (Catena, Ditrych and Kovalčíková, 2025). Recent evidence sharpens the urgency. A Policy Genome audit of six LLMs found that Yandex’s Alice endorsed Kremlin propaganda in 86% of Russian-language responses, while refusing 86% of identical English queries; DeepSeek absorbed Kremlin terminology (“special military operation,” “denazification”) in 29% of Russian outputs, even while answering the same prompts accurately in English and Ukrainian (Samokhodskyi, 2026). Therefore, language is not a backdrop for LLMs, but a vulnerability, a security risk in itself, which not only can be, but is being exploited to change political opinions (Hackenburg et al., 2025).

What the audit found

The thesis from which this brief is condensed audited twelve leading chatbots against three Kremlin-aligned false claims, four prompt personas (innocent, leading, expert, malicious), totalling 135 prompts (Stech, 2026). The aggregate fail rate is 31% without the expert prompt and 24.4% with it, slightly above NewsGuard’s January 2026 figure of 28.79% (Blachez, 2026). These numbers matter as benchmarks. The structural finding sits elsewhere: at the intersection of data voids and prompt-persona elasticity.

The Bournazel claim, a Storm-1516 fabrication alleging that a Paris mayoral candidate proposed to requisition cultural institutions to house migrants, was fresher and less debunked at the time of the audit than the two Ukraine-related claims, and was traced back to Russian electoral interference operations by Viginum and the EEAS (Viginum, 2025; EEAS, 2026). It is the brief’s most consequential finding precisely because it isolates susceptibility under thin coverage. Meta’s Llama 4 Maverick coded the claim as “partially true” under the expert prompt, citing Le Monde and AFP Fact Check, then misused them to substantiate fragments of the narrative. DeepSeek debunked the claim correctly under innocent and expert framings, then hallucinated confidently under the leading prompt: it named the Palais de Tokyo as the museum to be repurposed, and fabricated reasons for limited public debate. Claude invented “Palais de Chaillot” under the innocent prompt, self-corrected, and refused the leading prompt with an explicit epistemic disclaimer. Mistral added an invented Parisian quote, naming two real museums while referring to the allegations furthered by its own fabricated disinformation post as “rumeur.”

Three observations follow. (i) Reliable models lose accuracy where the debunk corpus is thin: this is not a model-specific failure but a structural one, tied to claim freshness and crawler latency. (ii) Sycophancy bends safeguards in the realistic direction of misuse. The leading prompt is the user already exposed to the claim, asking for more; it is exactly where models softened safeguard behaviours (“speculation,” “unverified outlets”) rather than hardened (“Russian disinformation,” “Storm-1516”). (iii) Declining to respond is back as a safeguard. Industry decline rates had collapsed to 0% in NewsGuard’s August 2025 report under pressure from real-time web access; this audit recorded 5.2%, distributed across ChatGPT, Claude, You.com and Copilot (Stech, 2026). A chatbot that can say “I cannot reliably source this” outperforms one that fills the void with plausible, citation-shaped fiction. Saying nothing is, often, the safer answer.

How the EU should act on it

The audit lands on a question European policymakers cannot defer: which instrument carries this? The answer should be as hybrid as the threat it addresses: AI Act upstream, DSA downstream; operationally, as the threat is ongoing, we should begin where enforcement is already live.

1. DSA as the immediate vehicle. The Digital Services Act’s enforcement architecture, while imperfect, is operational; the AI Act’s General-Purpose AI obligations under Article 55 will likely see initial meaningful enforcement only from 2027. ChatGPT Search has crossed the 45-million-user threshold that triggers Very Large Online Search Engine designation, and the Commission’s evaluation is ongoing (Reuters, 2026). This designation is the lever. Once a chatbot is designated VLOSE or VLOP, it falls under Articles 34 (systemic risk assessments), 40 (vetted-researcher data access), and 36 (crisis response). The concrete first step is for the Commission, supported by EDMO and Viginum, to require designated providers to publish: source-attribution logs for RAG retrieval on flagged narratives; incident-threshold reporting for coordinated narrative poisoning; and crisis-specific transparency caveats during designated information incidents, starting, for example, from instances concerning elections and the protection of minors (Stockwell, Janjeva and McDonald, 2026). Pravda-domain laundering has been largely patched at the chatbot layer; displacement to social-media repackaging, fringe domains, and misinterpretation of credible sources has not. Domain credibility audits are no longer sufficient.

2. AI Act and Code of Practice as the upstream complement. GPAI providers under Article 55 should be required to red-team for Pravda-style data poisoning and to publish training-data provenance audits as part of the Code of Practice. The AI Office should treat narrative-poisoning indicators as a defined systemic risk category, on par with cybersecurity. This is what converges the model layer with the deployment layer.

3. Cognitive security as the strategic frame. The EUISS roadmap proposes a three-tier integration into the EU Strategic Compass: a Cognitive Resilience Framework at the strategic level, a Civil-Military Scientific Advisory Group at the operational level, and the expansion of hybrid rapid response teams into cognitive defence at the tactical level (Catena, Ditrych and Kovalčíková, 2025). LLM grooming is the test case for this framework: it is foreign information manipulation by other means, and the monitoring indicators it requires must track the presence of weaponisable data voids and language-based vulnerabilities against model update cycles.

Closing the circle

LLM grooming shows that the question Europe faces is not whether models can be trusted, but whether the information environment that trains them can. Mythos is what happens when a laboratory decides the answer is no and walks away from a release. The publicly deployed chatbots audited here are what happens when the same question is never asked. The DSA already speaks the language for this, at least partially: systemic risk, vetted access, crisis response. The first step is to use it. What is whispered to a model becomes, in time, what it says out loud. Europe does not need a priest. It needs transparency.

Reference List

Blachez, I. (2026) January 2026 AI False Claim Monitor. Quarterly AI False Claim Monitor. NewsGuard. Available at: https://www.newsguardtech.com/wp-content/uploads/2026/02/January-2026-Quarterly-AI-Audit.pdf (Accessed: 12 March 2026).

Blatny, J. (2025) NATO Chief Scientist Research Report on Cognitive Warfare. Brussels: NATO Science & Technology Organisation (STO). Available at: https://www.sto.nato.int/wp-content/uploads/chief-scientist-report-cognitive-warfare-4.pdf (Accessed: 8 May 2026).

Catena, B., Ditrych, O. and Kovalčíková, N. (2025) Building EU resilience against manipulation through cognitive security. BRIEF/24. European Union Institute for Security Studies.

CheckFirst (2025) Pravda in numbers – Content and Network analysis. Available at: https://portal-kombat.com/ (Accessed: 30 April 2026).

Danet, D. (2025) ‘LLM Grooming: A New Cognitive Threat to Generative AI’, Hal Open Science – hal-05241525 [Preprint].

EEAS (2026) 4th EEAS Report on Foreign Information Manipulation and Interference Threats. European External Action Service. Available at: https://euvsdisinfo.eu/eeas-4th-fimi-threat-report-march-2026/ (Accessed: 20 March 2026).

Hackenburg, K. et al. (2025) ‘The levers of political persuasion with conversational artificial intelligence’, Science, 390(6777), p. eaea3884. Available at: https://doi.org/10.1126/science.aea3884.

NewsGuard (2026) Tracking AI-enabled Misinformation: 3,006 AI Content Farm sites (and Counting), Plus the Top False Claims Generated by Artificial Intelligence Tools. Available at: https://www.newsguardtech.com/special-reports/ai-tracking-center/ (Accessed: 8 May 2026).

Reuters (2026) ‘EU weighing tighter regulation for OpenAI under Digital Services Act’, Reuters, 10 April. Available at: https://www.reuters.com/world/openai-faces-tighter-regulation-under-eus-digital-service-act-handelsblatt-says-2026-04-10/ (Accessed: 8 May 2026).

Sadeghi, M. and Blachez, I. (2025) The Infection of  Western AI Chatbots  by a Russian  Propaganda Network. NewsGuard. Available at: https://www.newsguardtech.com/wp-content/uploads/2025/03/March2025PravdaAIMisinformationMonitor.pdf (Accessed: 6 November 2025).

Samokhodskyi, I. (2026) ‘The AI lens of cognitive warfare: Why LLMs language bias is a security risk’, European Leadership Network, 10 February. Available at: https://europeanleadershipnetwork.org/commentary/the-ai-lens-of-cognitive-warfare-why-llms-language-bias-is-a-security-risk/ (Accessed: 24 April 2026).

Schultz, B. and Vakhruseva, K. (2026) ‘We Need to Talk About Russia’s Arctic Information Offensive’, The Moscow Times, 13 February. Available at: https://www.themoscowtimes.com/2026/02/13/we-need-to-talk-about-russias-arctic-information-offensive-a91948 (Accessed: 23 April 2026).

Souly, A. et al. (2025) ‘Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples’. arXiv. Available at: https://doi.org/10.48550/arXiv.2510.07192.

Stech, A. (2026) ‘Grooming the Machine: (Data)Poisoned Context, Plausible Answers
Comparative Auditing of LLM Susceptibility to Kremlin-Aligned Narrative Poisoning and AI Governance Gaps’. Unpublished Manuscript MA Thesis. European University Institute.

Stockwell, S., Janjeva, A. and McDonald, B. (2026) Adding Fuel to the Fire: AI Information Threats and Crisis Events. CETaS Research Reports. Alan Turing Institute.

Tremayne-Pengelly, A. (2026) ‘The Catholic Priest Who Helped Write Anthropic’s AI Ethics Code’, Observer, 31 March. Available at: https://observer.com/2026/03/the-catholic-priest-who-helped-write-anthropics-ai-ethics-code/ (Accessed: 14 April 2026).

Viginum (2025) Analysis of the Russian information manipulation set Storm-1516. Paris. Available at: https://www.sgdsn.gouv.fr/publications/analyse-du-mode-operatoire-informationnel-russe-storm-1516 (Accessed: 8 May 2026).