In Africa, AI does not invent the attack, it scales it — Institute for Security Studies (ISS Africa)

Container cranes and a ship at the Port of Djibouti at sunset — Container terminal at the Port of Djibouti (December 2015)Photo: Skilla1st / Wikimedia Commons · CC BY-SA 4.0 · resized · Source

Institution: Institute for Security Studies (ISS Africa)
Author: Karen Allen
Country · language: South Africa · English
Affiliation: Independent think tank (Pretoria)

Summary

In a piece published on 13 October, ISS consultant Karen Allen reads a model provider's misuse report through an African lens. The report documents language-model agents being used in cyber attacks, surveillance and influence operations, with case studies covering Kenya, the Central African Republic, the Democratic Republic of Congo, Sudan and Mali. Allen's conclusion is blunt: AI is not inventing deceptive content, it is scaling its production. Interpol puts the share of reported cybercrime in Africa that was AI-assisted at 55%. A breach at a state technology agency in North Africa exposed more than 300,000 identity records and data on more than 500,000 companies.

The examples get sharper once the use turns political. In Mali, model-based agents targeted and profiled opposition figures. In the Central African Republic a network of fake radio stations used a model to strip stylistic fingerprints from synthetic content, with local agents reported to be producing pro-Russian material on Wagner's behalf. In Congo, 318 articles filled several fake news sites through AI generation. In Kenya, ahead of the 2027 elections, batches of 50 tweets were prepared to look like grassroots activity and a false claim that the opposition had fractured was put into circulation. The African Union Development Agency counts 45 governments running digital service delivery systems, so the attack surface widens every year.

Allen puts numbers on the capacity gap too. Public bodies in South Africa spend only a third of what companies do on cyber security, and the national Cyber Security Coordination Centre promised a decade ago still does not exist. Nigeria has adopted a policy committing it to responsible and ethical AI development and has closed much of the gap with South Africa in development capacity. The author asks for two basic steps: sharing threat intelligence between the public and private sectors, and simple acceptable-use policies that stop staff feeding sensitive data into public models. At a scale where the model has reached roughly 30 million users, she notes, defence is still organised one institution at a time.

Blind spot

The map extends only as far as one company can see inside its own systems; the volume of Africa-based misuse on other model providers is not measured. Interpol's 55% figure comes without a definition or a sample, so the threshold for AI assistance stays unclear. Counts such as 318 articles or batches of 50 tweets describe production volume, not reach or effect; how many voters saw the content is unknown.

Talay assessment

Bottom line

The piece shows that Africa's real vulnerability is institutional capacity rather than access to models. With 45 governments running digital services and South African public bodies spending a third of what companies do, the cost of attacking falls while the cost of defending does not. The most likely path is that calendars such as Kenya's 2027 election become the first serious test of AI-assisted influence operations.

Likely effects

Electoral processesNegative1–6 months
The fake grassroots picture built with batches of 50 tweets before Kenya's 2027 vote makes opinion measurement unreliable during the campaign and makes challenges to the result easier.
Public data infrastructureNegativeWeeks
The leak of 300,000 identity records and data on 500,000 companies in a single breach raises the cost of trust and of insurance for the 45 governments running digital identity projects.
Proxy influence operationsNegative1–6 months
As the Central African Republic case shows, giving local agents access to a model lowers the cost of content production for outside actors and blurs the trail back to them.
Effect on TürkiyeNegative1–6 months
Turkish contractors, telecoms and defence firms operating in Africa share the same threat surface; the risk of targeted phishing arriving through local partner networks is rising.

Possibilities, ranked

1
Scale grows, response lags55%
Misuse cases multiply, institutional defence stays fragmented and breaches are handled one at a time.
Watch: The share of AI-assisted cases passing 55% in Interpol's 2027 African cyber threat assessment
2
A regional response takes institutional form30%
The African Union or the larger economies set up a joint centre for threat sharing and acceptable-use policies spread.
Watch: South Africa putting its Cyber Security Coordination Centre into actual operation
3
A major breach creates a crisis15%
A breach on the scale of a national identity or payment system halts services for days and brings emergency regulation.
Watch: An interruption to a national digital identity or tax system in an African country

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Original publication: issafrica.org · 20 October 2026

This page summarises the institution's view and does not reflect the view of Talay Insight. No direct quotation is used.