Democracy needs a digital bodyguard

Written by Chris Rynning, Chairman, Umanitek

Four days ago, Americans voted in the midterms. Less than two weeks earlier, Brazil chose its next president. Two of the world's largest democracies went to the polls within ten days of each other. In both countries the fight was not only for votes. It was a fight over something more basic: who the candidates really are, and what they really said.

Ask people this week what they trust online and most will shrug. A video, an account, a headline: any of it can now be fabricated in minutes, at scale, for almost nothing. That is the mood of autumn 2026. Trust is no longer the default. It has to be defended.

That is exactly what the Umanitek Guardian AI agent did. Guardian stood watch for a presidential campaign in Brazil during the decisive final two weeks of the race, and for candidates in the US midterms. Two continents, two languages, the same playbook. Three lessons stand out:

1. The first attack is on identity. Fake accounts posing as the candidate are the front line of election manipulation.
2. AI manipulation has gone industrial. Synthetic videos, recycled false headlines and threats of violence arrive in waves, not one at a time.
3. Speed and evidence win, and election day is not the finish line. Acting in hours matters, platforms still need pushing, and the attacks peak at the very end.

Let me take them one by one.

Lesson 1: The first attack is on identity

In Brazil, fake accounts appeared that looked and spoke like a presidential candidate. They did not need to convince everyone. They only needed to borrow the candidate's credibility for long enough to put words in his mouth.

Guardian ran more than 42,500 checks during the campaign: 27,764 post checks and 14,742 profile checks. By 28 October, 595 impersonator accounts had been resolved, meaning removed, restricted or confirmed unavailable. Together those fake accounts carried more than 2.3 million followers. One impostor alone had 120,000 followers. Guardian reported it on 24 October, and it was gone 12 hours and 17 minutes later.

The US midterms told the same story at a faster tempo. A congressional candidate onboarded to Guardian Elect on 29 October, five days before Election Day. In the first eight days, Guardian secured 75 takedowns: 74 fake profiles and one harmful post, across TikTok (56), X (18) and Instagram (1). Some of the fakes had copied the campaign's biography and profile photo outright. The result: 6,370 followers reclaimed from impostors and 388,600 in potential reach cut off.

For another US candidate, Guardian's initial scan found 142 impersonator profiles, all scored at maximum risk. The tricks were simple and effective: a capital "I" swapped for a lowercase "l" to suggest an official or legal affiliation, or an identical display name paired with a username one letter off. A voter scrolling quickly cannot tell the difference. That is the point.

If you cannot trust who is speaking, you cannot trust what is said. Protecting democracy starts with protecting identity.

Lesson 2: AI manipulation has gone industrial

The content aimed at the Brazilian candidate went after three things: his health, his freedom and his safety.

A false post claimed his cancer had returned and that he would have to leave politics. It reached 604,000 interactions before Guardian got it removed on 14 October. An AI-generated video showed a synthetic version of the candidate performing behind bars. It reached 270,400 interactions before it was restricted on 21 October. And a post openly advocating his kidnapping was reported by Guardian to the social media platform and removed.

This was not random noise. Across seven YouTube channels, 66 videos kept returning to the same five themes: illness, withdrawal, disqualification, arrest and death. Together they drew 4.17 million interactions. One publisher posted 28 videos in 22 days. Two repeat publishers accounted for 22 posts and nearly 26 million interactions, with a single post reaching more than 13 million. Guardian secured removals or restrictions on all 22. By 28 October, the harmful posts Guardian had resolved carried a combined 44.6 million views and interactions.

In the US, the pattern was the same: disinformation and intimidation travel together. In a single initial scan for one candidate, Guardian flagged 14 high-risk violence threats, including an explicit death threat, alongside hundreds of items of hate speech, false personal allegations and targeted harassment. One abusive post alone had recorded 1.29 million interactions.

Some of this is produced by machines: bots, synthetic video, cloned profiles. All of it is directed by people. Guardian is built to fight both.

Lesson 3: Speed and evidence win, and election day is not the finish line

In an election, a lie that stays up for a week has done its job. So speed is everything.

In Brazil, Guardian's median time to first report or escalation was 8 hours and 41 minutes. 77% of measured cases were reported or escalated within 24 hours, and 87% within 48 hours. Once reported, the median time to removal or restriction was just over 12 hours. Every case was backed by a preserved evidence pack, so platforms received documentation they could act on rather than a complaint they could ignore.

But the data also exposes an uncomfortable truth. Guardian addressed 560 synthetic or manipulated posts across six platforms. 140 were removed or restricted. The other 420 had all been reported or escalated, and as of 26 October none had a confirmed enforcement outcome. On X, only 3 of 108 reported posts had confirmed action. Detection is no longer the bottleneck. Enforcement is.

Timing matters too. In the final two days of the Brazilian race, 24 and 25 October, Guardian documented 379 high-priority posts. That was two thirds of all high-priority posts in the dated sample. The attackers save their heaviest fire for the moment when there is no time left to correct the record.

And when the polls closed, the work did not stop. By 28 October, Guardian had resolved another 12 fake accounts and 30 harmful posts, bringing the total to 916 resolved cases. The same applies in the US, where protection continues well past Election Day.

Coming next: foreign interference

There is one more finding I want to flag now. Our data also shows evidence of foreign nation interference in the Brazilian presidential election. We are continuing our data insight analysis, and we will share more as that work concludes. Watch this space.

What we learned

We do not claim to have decided any vote. Voters did that, as they should. What we did was make sure more of them were looking at the real candidate, and fewer at a fake one.

The lessons are simple:

• Protect the identity first. If the messenger can be faked, the message is worthless.
• Assume the attack is synthetic, repeated and coordinated. Plan for waves, not single posts.
• Act in hours, document everything and keep going after the polls close. The platforms will not do it for you.

Umanitek participates in a more trustworthy, more democratic election process. We protect democracy by removing fake accounts, impersonation, AI manipulation and disinformation, whether it comes from machines or from bad human agents.

AI can fabricate a candidate. It can also help defend one.

Join the good fight at

umanitek.ai