AI Comment Spam Is Here, Good Luck Managing It…

A few days ago, I woke up to find more than fifty comments for one of my Spanish-language articles. This was, to say the least, unusual, so I used the WordPress console to check them: they had all waltzed past Automattic’s anti-spam service integrated into WordPress, Akismet, and were waiting to be approved. Written in correct Spanish, some of them even included moderately intelligent observations. If it hadn’t been for the fact that they all had English-sounding names and associated with a spam website, I might have been fooled; also the system I use on my page is whitelisted, that is, all comments except those from registered users have to pass manual supervision.

This is not a welcome development. Until now, spam in the comments section was not a problem: very easy to recognize and poorly written. Practically all of them were detected by Akismet and I only had to enter very occasionally to rescue some false positive, and that was it. Job done.

The problem now is that these are chatbots: they read the article you’ve written, generate comments that even make sense, and are difficult to differentiate from genuine ones, except for the link. Since they look really genuine, Akismet lets them pass, and you suddenly find yourself with a page where you have to look at the comments one by one, delete them manually, and waste time you don’t have. For the attacker, generating fifty comments costs practically nothing, it can be done with a free and not too powerful LLM, and it doesn’t take long. But for the page administrator, it requires taking a relatively detailed look at each one, seeing if they actually redirect to a spammer domain or are simply a genuine new commenter, and checking that you are not blocking the participation of new readers to your page. The spammer externalizes the cost of distinguishing the authentic from the synthetic to you. AI doesn’t just automate slop: it automates slop good enough to demand human attention.

This Sentinel Labs investigation into Akirabot details how this type of comment spam works: AkiraBot located forms, chats, and engagement spaces, extracted the content from each website, sent it to GPT-4o mini, and generated a unique and apparently purpose-written message for that site and that article. In addition, it rotated promoted domains, used proxies and simulated real browsers to bypass filters and CAPTCHAs. According to data from SentinelOne, it had attacked more than 420,000 domains and obtained at least 80,000 successful insertions. A nightmare.

Google’s definition of link spam is clear, and this matches it. Despite WordPress’s nofollow, which prevents spammers from building legitimacy on their domains with your comments, the cost of a campaign is so low that they don’t even bother to filter: they simply flood every page that comes their way. A recent Columbia University report provides a conceptual framework for the activity: generative AI has reduced the cost of producing content to almost zero and allows it to be done on a practically infinite scale. It defines three traits that are particularly applicable to the comments I received: they were “superficial competition,” they gave rise to asymmetrical effort, and they generated mass production. The damage doesn’t necessarily depend on each piece being awful: it comes from the volume, the cost of verifying it, and the progressive erosion of trust if those comments pass. The report specifically points to the increase in work for moderators and journalists and the time users must spend deciding what deserves credibility.

Where is this taking us? According to Imperva’s Bad Bot Report, automated traffic made up 51% of observed web traffic during 2024 compared to 49% human; malicious bots accounted for 37%. It’s not a complete census of the entire internet, it’s a measurement based on the traffic managed by the company, but it illustrates the change in proportions, and attributes a significant part of the growth to the ease with which AI allows for the creation, adaptation, and deployment of evasive automation. On the other hand, the comments are usually relatively short: automated AI detectors find it harder to detect shorter pieces.

I’m afraid that the result of all this trash will mean a less-open web. If it is impossible to detect texts written by bots, platforms will have to resort to accumulated reputation, identity, history, invitations, payments, frequency caps, or various forms of proof of person. The better the machines are at simulating participation, the more hurdles we will have to overcome in managing our sites. My episode with Akismet isn’t just an anecdote about moderation: it’s a small domestic evidence of the moment when open conversation begins to cease to be sustainable by default.

—

This post was previously published on MEDIUM.COM.

—

Subscribe to our Email Newsletter:

Why Subscribe? Because this conversation matters.
When you subscribe, you’re directly supporting independent, mission-driven journalism about masculinity, relationships, mental health, fatherhood, and social change. Your inbox becomes part of a movement that’s been challenging stereotypes and expanding what it means to be a good man since 2010. Plus, our newsletter is curated by humans, not algorithms — thoughtful context in an AI-flooded world.

The Good Men Project is a mission-driven men’s media platform. A major platform for stories about men, identity, fatherhood, and emotional intelligence—and a trusted home for the national conversation about masculinity.

The Good Men Project accepts paid guest posts and provides bulk guest post packages for SEO agencies and resellers. Email [email protected] for more information