Nearly half of people who consider themselves digitally literate failed to correctly identify more AI-generated comments than they wrongly flagged as human in a controlled simulation built by cybersecurity company Surfshark and master's students at Malmö University. Of the 710 participants who completed the experiment, only 53% identified more bots than they misidentified real people. The findings raise uncomfortable questions about the reliability of human judgment at a moment when automated accounts are proliferating at a scale that is difficult to fully comprehend.
What the Experiment Actually Tested
The "Bot or Not" simulation was designed for the UNFOLD exhibition at Milan Design Week, built as an interactive browser tool that places users in the role of a content moderator. Participants had 120 seconds to identify 10 bot-written comments spread across four discussion topics. The design was deliberate: two topics were emotionally neutral - data centres and whether pineapple belongs on pizza - and two were politically charged - immigration and women's rights.
The contrast between those categories produced the study's most significant finding. On the data centre topic, participants detected 71% of bots with a 76% accuracy rate. Pineapple on pizza was close behind, at 64% detection and 69% accuracy. The moment emotionally loaded subjects entered the frame, performance fell sharply. On immigration, detection dropped to 54% and accuracy to 63%. On women's rights, detection fell to just 49%, with accuracy slipping to 61%. Users were simultaneously missing more bots and falsely accusing more real people of being machines.
The mechanism here is not mysterious. Emotional engagement narrows attention. When a comment provokes a strong reaction - agreement, outrage, recognition - the reader's critical faculties are partially redirected toward the content itself rather than the source. Bots designed to operate in politically sensitive spaces are not an accident of engineering. They are built precisely to exploit that narrowing.
Age, Familiarity, and a Generational Divide
The study also identified a clear performance drop around the age of 40. Participants up to age 20 were the strongest bot-detectors in the dataset, identifying nearly 65% of bots with an accuracy rate above 71%. Performance remained broadly stable through the 20s and 30s, then declined sharply in the 41 to 50 bracket, where detection fell to 42% and accuracy to 59%. Users over 50 performed only marginally better than that group.
This pattern is worth examining carefully. It does not suggest that older users are less intelligent or less informed. It more likely reflects the way familiarity with a medium shapes interaction with it. Younger users who have grown up in environments saturated with automated content - recommendation algorithms, synthetic personas, generated text - may have developed a more instinctive wariness toward online interaction. Older users who came to social media later, and who built their habits in an era when most online comments were written by people, may carry assumptions that no longer hold. The digital environment has changed faster than many people's mental models of it.
The Scale of the Problem Behind the Simulation
The individual experience of being fooled by a bot comment is one thing. The structural reality behind it is another. Surfshark's own earlier research found that major platforms collectively remove more than 6.3 billion fake accounts each year - roughly 47 times the number of babies born worldwide annually. That figure applies to accounts that are caught and removed. The number of accounts operating undetected at any given moment is, by definition, unknown.
Industry estimates suggest that bot-driven amplification accounts for around 23% of political discourse on X during election seasons. That is not a fringe phenomenon. It means that in the conversations most likely to influence how people think about candidates, policies, and public life, roughly one in four contributions may not originate from a human being at all. The commentary is real enough to feel authentic. The anger, the enthusiasm, the sense of social consensus it creates - all of it can be manufactured and distributed at a cost that is trivially low compared to its potential influence.
Surfshark's Research Lead Luís Costa has argued that the study's most important finding is not about reading skills or media literacy in any conventional sense. The vulnerability it exposed is emotional, not analytical. A user who knows how to evaluate a source, check a citation, or recognise a misleading headline is still susceptible if the content triggers a strong enough reaction before critical thinking engages. The solution he points toward is not sharper textual analysis but a more calibrated awareness of one's own emotional state while scrolling - a harder habit to build, and one that no platform currently incentivises.
What This Means for Trust Online
The broader implication of this research is not that individuals are naive. It is that the asymmetry between bot production and human detection has grown large enough to make individual vigilance an insufficient defence on its own. Bots are manufactured at billions-per-year scale. The technology generating them is improving continuously. The emotional levers they are designed to pull are deeply embedded in human psychology and cannot simply be switched off.
Platform-level moderation is one partial answer, though the removal figures suggest it is a perpetual rear-guard effort rather than a resolution. Regulatory frameworks in some jurisdictions are beginning to address synthetic content and automated political messaging, but enforcement remains uneven and largely reactive. What the "Bot or Not" experiment captures, in miniature, is something with much larger stakes: the gradual erosion of the assumption that the social environment online reflects genuine human sentiment. Once that assumption goes, the question of what social media is actually measuring - public opinion, manufactured consensus, or something in between - becomes very difficult to answer. The simulation is available at botornot.one. The test takes two minutes. The results tend to stay with you longer than that.
