Hours before polls closed on Election Day, fabricated results for the Michigan Senate and Ohio governor races were already spreading on X. A single inauthentic account seeded the first set of numbers, and real accounts did most of the spreading. Cyabra’s research on five competitive midterm races found that this was the sharpest moment in a final stretch when inauthentic activity on X peaked.
- On Election Day, 18.7% of X posts about the five races came from inauthentic accounts, up from 13.3%.
- Fabricated Michigan and Ohio results drew 3.4 million views on X before polls closed, mostly through real accounts.
- The inauthentic share of replies rose for five of eight candidates, in both parties.
- Most inauthentic accounts active in the final stretch had not appeared in the weeks before.
A single inauthentic account set the numbers in motion
At 1:35 pm ET, an inauthentic account with fewer than 600 followers posted Michigan Senate “results” and asked X’s AI chatbot, Grok, to confirm them. The post drew 566,927 views, more than six hours before Michigan polls closed at 8 pm.
Real accounts took it from there. At 3:16 pm, a real account posted Ohio “results” precise to two decimal places, which drew 1.26 million views. At 6:25 pm, another real account repeated the same Michigan figures and drew 760,932 more. Four further posts presented a Michigan “projection” with exact vote totals. In all, about 2.8 million of the 3.4 million views came from real accounts repeating numbers that did not exist.
The hours before official results are the easiest to fill
Before polls close, there is no official number to contradict a fabricated one. Every fabricated result Cyabra found appeared on Election Day afternoon and evening, which left almost no time for correction. Once a claim crosses into real networks, removing the original source does little to stop it.
The chatbot request added borrowed credibility. Asking an AI to “confirm this” lends a claim the perceived neutrality of AI, whatever the chatbot answers. Posts tagging an AI chatbot on X averaged about 15 a day in the two weeks before the vote, then rose to 102 on Election Day.
The activity stayed narrow. No fabricated results were found for Georgia, Kansas or Maine, and those found on Facebook drew fewer than 40 interactions each.
Reply sections absorbed pressure on both sides
On Election Day, 18.7% of X posts about the five races came from inauthentic accounts, up from 13.3% between late August and mid-October. Facebook stayed at 3.9%.
The pressure was most visible in candidates’ own reply sections, where candidates, reporters and campaigns read the public mood. The inauthentic share of replies and comments rose for five of the eight candidates with enough data, Republicans and Democrats alike. On Sen. Roger Marshall’s pages it climbed from 13.1% to 23.3% across the final stretch. On Election Day, nearly one in three replies and comments he received came from inauthentic accounts.
Dormant accounts switched on for the finish
Most of the inauthentic accounts behind this activity were new to the conversation. Of those active in the final stretch, 84% had not appeared in the weeks before. Among those with a known creation date, only 76 were created after 1 October. These were existing accounts held back and activated for the finish, and a list of known inauthentic accounts built in September would have missed most of them.
They also worked across contests. In the final stretch, 103 accounts posted about three or more races, up from 64 earlier in the campaign. On X, they gathered in 299 reply swarms, each with three or more inauthentic accounts replying to the same post within ten minutes, yet only one team of three swarmed together more than once. Of the inauthentic X accounts with a known location, 84.9% were US-based. The pattern looks opportunistic, and Cyabra is not attributing it to any country or actor.
What Election Day 2026 means for 2028
Proportion matters here. Real accounts drew 99.8% of views in the final stretch. Even in the largest attack of the period, aimed at Ohio candidate Amy Acton, about four in five posts came from real accounts. Inauthentic accounts acted as accelerants, seeding and amplifying claims that real people then carried. Cyabra measures online activity and makes no claim about election outcomes.
Because candidates in both parties were targeted, the activity points to a broader aim of eroding trust in the electoral process. That puts the count and certification next in line. A presidential year brings staggered poll closings across time zones, a longer window for early “results,” and the same accounts working many swing states at once. Governments preparing for 2028 will need monitoring that identifies accounts by behavior, since the accounts rotate each cycle. Election officials can shrink the space fabricated numbers occupy by saying early and often that no results exist until polls close, and by publishing results through a single trusted channel.
Contact Cyabra to see how Cyabra helps governments detect coordinated inauthentic behavior early.
