X Just Suspended 13,000 Accounts — How Fake Networks Try to Steer What You See

One Wednesday evening in mid-October, more than 13,000 accounts vanished from X in a single sweep. The platform said they belonged to three suspected foreign influence operations, linked to Iran, Russia, and China, that were trying to shape American political conversation ahead of the November 3 midterm elections.

That is a dramatic headline. But the most interesting part of the story is not the number. It is the gap between what a number like 13,000 sounds like and what it actually proves — and the surprisingly simple playbook these networks use to make a handful of accounts feel like a crowd.

This is a curiosity story, not a political one. Fake-account networks do not care which side you are on. They care that you believe the crowd is real.

What X actually announced

On Wednesday, October 14, 2026, X announced it had suspended more than 13,000 accounts tied to three suspected foreign influence operations. The announcement came in a post from the platform’s Global Government Affairs account, published as X outlined its measures ahead of the US midterm elections on November 3.

According to X, its investigations found the networks used fake accounts to post and amplify political content targeting candidates and public figures “across the political spectrum.” The company said it identified the accounts through “proactive sweeps and investigations” under its rules against spam and coordinated inauthentic behaviour.

“Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe,” X Global Government Affairs said in announcing the suspensions. The quotes from the announcement in this article are as reported by Al Jazeera and The Register, which covered the post.

Alongside the suspensions, X set out its election rules. Its Civic Integrity policy covers misleading information about how, when, and where to vote, as well as content intended to discourage people from participating. That includes voter intimidation, including calls for violence near polling stations. Users can report election-related posts through the platform’s “civic integrity” option to request a Community Note adding context, and X says it may label posts that violate its election rules in cases requiring attention.

This was not X’s first action of this kind. In 2021, when the platform was still called Twitter, it said it had suspended 238 accounts purportedly operating from Iran. The scale this time — 13,000 — is far larger. But scale alone can mislead, as we will see.

The three things 13,000 does not tell you

Big numbers feel like proof. They are not. Here are three things the 13,000 figure does not tell you, each of which matters more than the number itself.

First, it does not tell you how the accounts were divided. X did not disclose how many accounts were associated with each country. The figure of more than 13,000 is the combined total across all three suspected networks, not a separate count for each one. For all the public knows, one network could have accounted for most of the total and another for a small slice. Any headline that assigns a specific number to a specific country is guessing.

Second, it does not tell you what the accounts actually achieved. X offered no metrics on impressions, engagement, or reach before removal. Thirteen thousand accounts sounds substantial, but it reveals almost nothing about how many real people saw the posts, whether anyone changed their mind, or whether the content ever escaped the networks’ own echo chamber. Analysts have long noted this gap in platform disclosures: suspensions are counted, but influence is not measured.

Third, it does not come with public evidence. X linked the networks to specific nation-states but did not publicly explain the evidence behind its attribution. It shared no graphs of account connections, no examples of the content amplified, and no technical breakdown of how it tied the accounts to their alleged operators. That does not mean the attribution is wrong. It means it is, for now, X’s claim — a claim from a private company, not an independently verified finding. There is a difference between “X says” and “it is proven,” and this story lives entirely in the first category.

That distinction is the key to reading this story correctly. A platform enforcement action is a moderation decision, not a court verdict. It tells you what a company did about accounts it judged to be inauthentic. It does not, by itself, prove that a foreign operation changed the campaign, swayed voters, or altered any outcome.

There is a useful parallel from the world of intelligence. The Register, reporting on the suspensions, noted that MI5 chief Sir Ken McCallum had said that week that Russia attempted to interfere in the 2016 Brexit referendum — while cautioning against treating that as evidence it changed the result. Attempting to interfere and succeeding at changing an outcome are two very different claims, and honest reporting keeps them separate.

How fake-account networks actually work

So what do these networks do, exactly? The playbook is older than social media, but the internet made it cheap and fast. It has roughly five moves.

1. Build believable personas. A fake account rarely announces itself. It gets a stolen or AI-generated profile photo, a plausible name, a bio with local flavour, and a backstory told in small doses: a sports opinion here, a food photo there, a complaint about traffic. Some personas are built over months before they ever post anything political. The goal is to pass the most basic human test: does this look like a real person?

2. Post a mix, then pivot. Early posts are usually harmless — memes, sports, everyday life. The political content arrives gradually, mixed in with the ordinary stuff, so the account’s feed looks like a real person’s varied interests rather than a propaganda channel. By the time the account is pushing a political message, it has already earned the benefit of the doubt.

3. Amplify each other. This is the heart of the operation. One account posts a claim. Dozens of allied accounts like it, repost it, quote it, and reply to it within minutes. To a casual scroller, a post with hundreds of rapid interactions looks popular — and popularity feels like credibility. But the “crowd” may be the same small network talking to itself. Researchers call this coordinated inauthentic behaviour: the problem is not that the accounts disagree with you, but that they are coordinated and inauthentic.

4. Hijack real conversations. Networks do not only talk to each other. They reply to real users, jump on trending hashtags, and attach themselves to genuine debates. A real argument between real people is the perfect camouflage: the network’s posts blend into a thread that already has momentum, and real users may amplify the message further without ever knowing its source.

5. Cross platforms. A network rarely lives on one app. The same personas, or their cousins, may appear on other platforms, in comment sections, and in messaging groups. If one account gets suspended, the network shifts. Suspension is a setback, not an ending — which is why platforms describe this as ongoing work rather than a one-time cleanup.

None of this requires hacking, bots in the Hollywood sense, or especially sophisticated technology. The most effective networks often use real people — sometimes people who do not even know who they are working for — alongside automated accounts. That blend of human and automated activity is exactly what makes these operations hard to spot and hard to measure.

The OpenAI connection: a different tactic, one week earlier

The X suspensions did not happen in a vacuum. One week earlier, OpenAI announced that it had banned ChatGPT accounts behind two covert influence operations, one from Russia and one from Iran, that used a very different tactic: “false front” entities.

Instead of flooding a feed with fake accounts, these operations built things designed to look legitimate. The Iranian operation, which OpenAI dubbed “Bogus Bylines,” ran seven fake journalist personas that pitched long-form articles to small and medium online outlets around the world. OpenAI said it identified almost 100 articles published or syndicated under the operation’s bylines across roughly a dozen outlets, with the earliest appearing in July 2025 and the latest in October 2026.

The Russian operation, nicknamed “Dark Clark,” went further. It appears to have co-opted unwitting people in Latin America to run a purported research platform called the Social Research Center, fronted by a fabricated persona named “Mia Clark.” OpenAI said the centre produced more than 60 articles, mostly original work by local staff who apparently did not know they were working for a Russian operation. The operators used ChatGPT chiefly to draft internal progress reports to an unknown superior, and OpenAI says they used “questionable or outright deceitful methodologies” to exaggerate how effective they were.

OpenAI rated the Russian operation Category 5 on its six-point Influence Operations Breakout Scale — the first Category 5 operation it had disrupted — and the Iranian operation Category 4. Those ratings measure how far an operation spread and who amplified it, not whether it persuaded anyone or changed a political outcome. OpenAI also noted a pattern across the 30 covert influence operations it has exposed in the last two and a half years: the operations that land their content in real media outlets, rather than relying on fake social media distribution, tend to have the highest potential reach.

The lesson connecting the two announcements is subtle but important. The X networks tried to manufacture a crowd. The OpenAI operations tried to manufacture credibility. A crowd makes a message look popular. A byline in a real outlet makes it look authoritative. Both tactics exploit the same human shortcut: we judge a message partly by the company it keeps.

It is also worth noting what OpenAI’s report shows about the limits of these operations. The Iranian operation’s social media comments “generally attracted little engagement.” The operators exaggerated their own success. Many of their fakes were debunked by fact-checkers or denied by officials. Influence operations are real, but they are often clumsier and less effective than their operators claim — and less effective than alarmed headlines suggest.

Why “across the political spectrum” matters

One detail in X’s announcement deserves attention: the networks targeted candidates and public figures “across the political spectrum.” That phrase cuts against the most common misunderstanding of influence operations — that they exist to help one side.

In practice, these networks often target everyone. Sometimes that means boosting one candidate and attacking another. Sometimes it means inflaming arguments on all sides of an issue, because division itself is the goal: a polarised, distrustful public is easier to manipulate than a calm one. Sometimes different networks push different messages, and the only common thread is disruption.

That is why the healthiest response to this story is not partisan. It is procedural: assume that any political content that feels engineered to make you angry, smug, or certain deserves a second look — no matter how much you agree with it. The networks’ best trick is not convincing you of something false. It is getting you to spread it for them, for free, because it felt true.

How to spot inauthentic amplification

You cannot reliably identify a fake account from a single post, and you should not accuse individual users of being fake. But researchers and platforms point to a set of signals that, taken together, suggest coordinated inauthentic activity. Think of them as smoke, not fire — each one alone proves nothing.

The account is young but loud. A profile created weeks ago that posts dozens of times a day, almost entirely about politics, is worth a second look. Real accounts usually accumulate history gradually.

The engagement looks synchronised. A post that collects a burst of identical replies, reposts, or likes within minutes — especially from accounts that rarely interact otherwise — may be amplification rather than organic popularity.

The language is copy-pasted. If you search a distinctive phrase from a post and find many accounts posting the exact same wording, that is a classic sign of coordinated activity. Real people paraphrase; networks duplicate.

The persona is thin. A profile photo that looks AI-generated or stolen, a bio with vague details, no original photos, no replies to friends, and no evidence of a life outside politics — each is a small flag. Combined, they add up.

The account only amplifies, never converses. Many network accounts rarely engage in genuine back-and-forth. They post, repost, and reply with slogans. Real users argue, joke, get distracted, and go off-topic.

The timing is mechanical. Posting at all hours, at perfectly regular intervals, or in bursts that match other accounts’ bursts can indicate automation or shift-based human operation.

If you spot several of these signals together, the useful response is simple: do not amplify. Do not quote-post it angrily, do not reply to debunk it in its own thread — both actions spread it further. If the platform offers a reporting option, use it. If the content is about voting, check the facts through an official source, such as your local election authority, rather than through the post itself.

X’s own election tools point in this direction: users can report election-related posts through the “civic integrity” option to request a Community Note, and X says it may label posts that violate its election rules in urgent cases. Community Notes, the crowdsourced context feature, has itself faced scrutiny — when the European Commission launched formal proceedings against X under the Digital Services Act in 2023, it raised questions about how effectively the feature validates a post’s accuracy. Crowdsourced context is a tool, not a verdict, and it works best when readers treat it as a starting point for checking, not a final answer.

What happens next

X said its efforts would continue through Election Day and beyond. That is the honest shape of this fight: there is no final purge, because networks rebuild. Suspended accounts are replaced. Tactics evolve. The operators who ran the networks behind these 13,000 accounts — whoever they ultimately were — learned something from the takedown, just as the platforms did.

The more durable defence is not any single suspension. It is a public that understands the playbook. A crowd can be manufactured. Credibility can be faked. Popularity can be rented. None of those things are new; what is new is how cheap and fast they have become, and how convincingly they can be aimed at the exact argument you were already having.

The next time a post feels like it arrived with a crowd already cheering, pause for a second and ask the simplest question in this whole story: is the crowd real? Thirteen thousand accounts just disappeared for pretending to be one. That is worth remembering the next time a timeline feels unanimous.

FAQ

Did X prove that Iran, Russia, and China ran these networks?

No — not publicly. X attributed the three suspected networks to Iran, Russia, and China, but published no evidence for the attribution and no per-country breakdown. The attribution is X’s claim, reported by outlets including Al Jazeera and The Register. It has not been independently confirmed.

How many accounts were suspended for each country?

That was not disclosed. The figure of more than 13,000 is the combined total across all three suspected networks. Any per-country number you see elsewhere is speculation, not something X announced.

Did these networks change anyone’s vote or change the election?

There is no public evidence for that. X provided no metrics on how many real users saw the networks’ posts or how they responded. A suspension proves that a platform judged accounts inauthentic; it does not prove the operation persuaded voters or altered an outcome.

What is the difference between X’s action and OpenAI’s announcement a week earlier?

They targeted different tactics. X removed fake accounts that posted and amplified political content on its platform. OpenAI banned ChatGPT accounts behind “false front” operations — fake journalist personas and a fake think tank — that tried to plant content in real media outlets. Both were enforcement actions against alleged covert influence operations, but they involved different platforms, methods, and operators.

How can I tell if an account is fake?

No single signal proves it. Look for combinations: a very young account posting constantly about politics, synchronised bursts of engagement, copy-pasted wording across many accounts, a thin persona with no real-life footprint, and amplification without genuine conversation. Treat these as reasons not to amplify, not as proof to accuse someone.

Does suspending 13,000 accounts solve the problem?

No. Networks rebuild, tactics evolve, and operators adapt. Suspensions remove specific accounts, but the playbook survives. Media literacy — pausing before amplifying content designed to provoke — is the longer-term defence.

Was this about helping one political side?

According to X, the networks targeted candidates and public figures “across the political spectrum.” Influence operations often inflame arguments on multiple sides, because division itself can be the goal. The useful response is the same regardless of which side a post appears to favour: check before you amplify.

Sources

• Al Jazeera, “X suspends 13,000 accounts, alleging foreign influence ahead of US midterms” (October 15, 2026): https://www.aljazeera.com/news/2026/10/15/x-suspends-13000-accounts-alleging-foreign-influence-ahead-of-us-midterms
• The Register, “X purges 13,000 accounts linked to suspected meddling ahead of US midterms” (October 15, 2026): https://www.theregister.com/security/2026/10/15/x-purges-13000-accounts-linked-to-suspected-meddling-ahead-of-us-midterms/5303234
• OpenAI, “Disrupting AI-enabled ‘false front’ operations” (October 8, 2026): https://openai.com/index/disrupting-ai-enabled-false-front-operations/
• Khaama Press, “X Suspends More Than 13,000 Accounts in Suspected Iran, Russia and China Influence Operations”: https://www.khaama.com/x-suspends-more-than-13000-accounts-in-suspected-iran-russia-and-china-influence-operations/
• WebProNews, “X Removes 13,000 Accounts in Pre-Midterm Sweep Targeting Suspected Iran, Russia, China Networks”: https://www.webpronews.com/x-removes-13000-accounts-in-pre-midterm-sweep-targeting-suspected-iran-russia-china-networks/
• SC Media, “X removes thousands of accounts linked to foreign influence operations”: https://www.scworld.com/brief/x-removes-thousands-of-accounts-linked-to-foreign-influence-operations
• The Straits Times, “OpenAI says Iran, Russia influence ops busted” (October 8, 2026): https://www.straitstimes.com/world/united-states/openai-says-iran-russia-influence-ops-busted