On January 26th at 4:34 PM, the X account @SamuelVela80079 shared a video of Congresswoman Katherine Miranda. At first glance, just another tweet in the maelstrom of Colombian politics. However, something strange accompanied the post: an incomprehensible message that read %!(EXTRA string=Katherine Miranda 👩💻❓).
Immediately, amid the usual political polarization, the tweet generated reactions: some users interpreted the error as evidence that Miranda was paying for bots to artificially amplify her message on social media.
What these users didn’t know is that this strange code wasn’t conclusive evidence of an operation paid for by the congresswoman, but rather the digital fingerprint of something much larger: an extensive international network of bots or cyborgs operating simultaneously in Colombia and at least five other Latin American countries, deploying campaigns for multiple political actors across different ideological spectrums.
The presence of Miranda’s content in this network does not imply her guilt. As will be documented later, this same infrastructure amplifies both pro-government and anti-government content, both left-wing and right-wing, even completely apolitical content. It’s a mercenary service available to anyone.
The only verifiable certainty is that automated technical operations are being executed to artificially amplify political content, with the aim of distorting the perception of what citizens actually think or discuss and monetizing the current polarization and security flaws of social networks.
The technical reality is that the code error gave everything away.
The Pattern Emerges
The @SamuelVela80079 account didn’t stop there. Between 4:34 PM on January 26th and 10:35 AM on the 28th, it published 65 additional tweets, all with the same code error. Behavior impossible for an average human user, but perfectly consistent with a misconfigured bot.
That pattern led to searching for the code %!(EXTRA string= on X and other alternative platforms like Nitter. What was found was revealing.
At the time of writing this investigation, we managed to identify and document more than 70 accounts—many still active—that share the same technical error.
But the network is probably much more extensive. During manual searches, dozens of additional accounts with the same code flaw were detected, but access restrictions imposed by X and the costs of specialized data extraction tools limited the collection to a representative sample of 70 profiles.
Even with this limited sample, the patterns were compelling: tweets appeared in extraordinarily synchronized time windows, sometimes with only minutes of difference between posts from accounts located in different countries.
Given the sensitivity of making specific statements about individual political actors, we have made available to the public a sample of 20 posts from the analyzed account, allowing journalists, researchers, and citizens to draw their own conclusions about the patterns and amplified content.
TikTok Dataset: Messages published by the analyzed bot account.
It’s important to clarify: the presence of favorable or unfavorable content toward a political actor in this network does not imply that said actor hired the service. In fact, politicians can be both beneficiaries and victims of these operations, either through campaigns hired by third parties in their favor, or through attacks orchestrated by opponents. The investigation documents the existence and operation of the network, not the identity of its clients.
The Bot Army
Despite the data access restrictions imposed by platform X, this investigation used a combination of web scraping techniques and manual analysis to document the operation.
The result is a dataset of 70 unique accounts that shared the same code error between January 26 and 28, 2026, functioning as a representative sample of a much more extensive network.
The complete dataset will be available at the end of this article in anonymized format, allowing other researchers, journalists, and citizens to verify the findings and expand the analysis. Additionally, it serves as an essential element to initiate a debate based on the conclusions we express in this post.
Ideological Diversity as Evidence
The most revealing aspect of the dataset is the thematic and ideological diversity of the amplified content. The 70 documented accounts, all operating with the same automated system, published about:
- Attacks on Argentine President Javier Milei
- Defenses of Chavista policies in Venezuela
- Content about local elections in Mexico and Guatemala
- Regional campaigns in Colombia
- Complaints about the healthcare system in Peru
- Traditional Catholic religious content
- Argentine reality show fandoms
This thematic dispersion is not chaotic: it’s the distinctive signature of a mercenary operation. An automated system that doesn’t work for a specific ideology, but would sell amplification to whoever can pay for it.
Bots Assigned to Colombia
Most revealing: the network amplifies both pro-government and anti-government Colombian content simultaneously.
We documented Petro-supporting accounts defending President Gustavo Petro or promoting Iván Cepeda, while other Uribe-supporting accounts attacked the same policies or amplified digital actions by Abelardo de la Espriella.
The detailed analysis of a sample of the identified accounts reveals the operation’s sophistication. Among the documented profiles we found everything from a traditional Catholic account with 220 followers dedicated exclusively to religious content, to active political accounts with over 15,000 followers sharing news and government criticism. Or posts as incoherent as a profile promoting one of the left-wing candidates in Colombia while simultaneously posting K-pop messages.
To try to understand and minimize the analysis, we manually analyzed 7 of the 70 accounts in our dataset. We didn’t select the accounts randomly but selected only those that have some tweet about Colombian reality. These are the results:
| ID | Username Anonimizado | Orientación Política | Temática Principal | Seguidores | Año de creación | Ejemplo de contenido que comparte |
| 1 | ********44521 | Izquierda | Comparte contenido político | 4 | 2024 | https://www.tiktok.com/@tramposo35/video/7590970965220166920?_r=1&_t=ZS-92p5lcKE8uI |
| 2 | @*******9 | Izquierda | Apoyo a candidato presidencia – Memes de gatos – Kpop | 15.400 | 2022 | (No se comparte por los riesgos) |
| 3 | @******doya40 | Izquierda, derecha, centro | Replica mensajes desde todos los espectro políticos | 178 | 2012 | https://www.instagram.com/reels/DUA8iafiZzI/ , https://www.tiktok.com/@arrozdeliz2022/video/7600179712798821639?_r=1&_t=ZS-93SLVTdcb6j |
| 4 | @******60475050 | Izquierda | Retrina y amplifica contenido político | 25 | 2025 | (No se comparte por los riesgos) |
| 5 | @******64022 | Derecha | Contenido viral y ataques políticos | https://www.tiktok.com/@angelflorez300/video/7599889089676053777?_r=1&_t=ZS-93QSs3Lezav, https://www.tiktok.com/@ricardonovoa275/video/7600221091608497416?_r=1&_t=ZS-93S3C44DLC1 | ||
| 6 | A****ano | Derecha | Ataques políticos y retrina y amplifica activistas de derecha | 8543 | 2013 | (No se comparte por los riesgos) |
| 7 | @******ave13 | Izquierda | Progobierno | https://www.youtube.com/watch?v=rIx9M-fu2_k |
Due to the magnitude of the collected dataset and the time required for manual analysis of each profile, this investigation focused on these accounts.
It can clearly be observed that the content they intend to amplify covers the entire political spectrum. The right and the left.
The complete analysis of the 70+ identified accounts, as well as the search for connections between them and the identification of possible clients of the operation, will be the subject of a later publication.
However, the analyzed sample already reveals compelling patterns: profiles from Colombia, contradictory political orientations (from Petro supporters to Uribe supporters). Accounts that retweet content from the so-called “troll farms.” Intoxication of the conversation in Colombia.
What is %!(EXTRA string=…)?
To understand how a simple code error exposed the entire operation, a technical dive is necessary.
The pattern %!(EXTRA string=Katherine Miranda) is a specific error message from the Go programming language, created by Google and widely used to build high-performance systems such as web servers, APIs and—relevant to this case—there is now technical evidence that it is used to generate automated bots.
According to the official Go language documentation, this error appears in very specific situations. The technical specification of the fmt package (the Go module that handles text formatting) explains:
“Too many arguments: %!(EXTRA type=value)
Printf(“hi”, “guys”): hi%!(EXTRA string=guys)”
In simple terms: when a Go programmer tries to insert dynamic information into text (such as a politician’s name in a tweet, some emojis, or anything needed) but provides more data than the system expects, Go doesn’t crash. Instead, it generates this visible warning message that includes the “extra” information it didn’t know where to place.
When the code has fewer reserved spaces than provided parameters, Go automatically generates the alert %!(EXTRA string=...) for each excess parameter.
The presence of this technical error in published tweets confirms that these profiles are being managed through automated systems, either completely by bots or through a combination of human intervention and automated programming (what in the industry is known as “cyborgs” or semi-automated accounts).
This is what could have happened:
message := fmt.Sprintf("New video from %s", politicianName)
// Expected result: "New video from Katherine Miranda"But by mistake, the programmer passed additional information:
go
message := fmt.Sprintf("New video from %s", politicianName, emoji, hashtag)
// The system says: "Hey, you gave me 3 things but I only expected 1"
// Result: "New video from Katherine Miranda%!(EXTRA string=)%!(EXTRA string=#politics)"
```As the official documentation states: “All errors begin with the string ‘%!’ sometimes followed by a single character (the verb) and end with a parenthesized description.”
There are numerous public tutorials and open-source projects documenting the use of Go to create bots on X, from guides on educational platforms like FreeCodeCamp to active repositories on GitHub. We were able to verify three repositories on GitHub with extensive documentation for generating bots in Go.
A Hijacked Conversation in the Midst of Colombia’s Elections. Democracy Threatened.
For years, X has presented itself as the digital public square, the space where citizens can express themselves freely and where ideas compete on equal terms. This investigation demonstrates that premise is, at best, naive.
The existence of an international bot network operating simultaneously in multiple Latin American countries reveals a perfectly oiled digital manipulation industry. An industry that doesn’t discriminate between left and right, that has no political loyalties, that simply sells artificial amplification to the highest bidder.
For the average citizen, this means that every time they open the app, they’re exposed to a contaminated conversation. That trending topic about a candidate, those hundreds of comments attacking or defending a policy, that feeling that “everyone is talking about this”—it can all be artificial.
How do we make informed decisions in a democracy when we can’t distinguish between genuine opinion and automated propaganda? How do we participate in public debate when we don’t know if we’re talking to real people or algorithms designed to influence us?
Colombians must demand that electoral authorities regulate the use of bots in political campaigns. And above all, demand that those who hire these services face consequences.
Because as long as that doesn’t happen, our democratic conversation will continue to be hijacked by whoever can pay the most.
Who’s Behind All This? The Inevitable Question
This investigation documents the existence of the network, its international scope, and its methods of operation. But there’s one question it cannot answer: who specifically hired the amplification of Katherine Miranda’s content?
The answer is simply impossible to determine without direct access to the servers and financial records of the network’s operators. And that impossibility is not accidental: these infrastructures are designed precisely to protect their clients’ identity.
Katherine Miranda could be the beneficiary of a digital campaign hired by her team or supporters. Or she could be the victim of a more sophisticated operation: an attack designed to discredit her by making her accused of using bots, while it’s her opponents who are deploying bots in her name. In the digital manipulation market, both scenarios are technically possible and commercially viable.
Important clarification: The presence of favorable or unfavorable content toward any political actor in this network does not imply that said actor hired the service. The documented politicians can be both beneficiaries and victims of these operations. This investigation does not accuse any specific candidate or party of hiring bots, but rather exposes the existence of an infrastructure that anyone can hire.
The Real Problem
It’s not necessary to know who hired what to understand that political conversation is being manipulated on an industrial scale.
The existence of these networks—available, accessible, operating without effective restrictions—means that any actor with sufficient resources can manufacture the appearance of consensus, simulate massive outrage, or destroy reputations. And we, the citizens, have no way to distinguish between genuine opinion and automated propaganda.
That is the real threat.
ACCESS TO THE DATASET
For methodological transparency and to allow independent verification, the complete dataset used in this investigation is publicly available:
File contents:
- 70 records of tweets with the documented error pattern
- Anonymized usernames (hash identifiers)
- Complete error strings (technical evidence of the flaw)
- Exact dates (temporal synchronization analysis)
- Sanitized content (user mentions replaced with [USER])
- Verification links (tweet IDs preserved, usernames hidden)
Methodological note:
Usernames have been converted to hash identifiers (e.g., bot_ef414180) to protect the privacy of users who may be victims of account compromise. However, the structure allows for independent statistical verification of all findings presented in this article.
For researchers:
If you need access to the complete dataset with original usernames for academic or journalistic verification, contact: Camilo@Hyperconectado.co
Of course, this research may be subject to debate, and anyone may think or hold a different opinion. The datasets and the sources of the code that was identified were shared precisely so they can be examined and debated.
Update, Friday, January 30, 2026, 8:30 am
Three readers of the article contacted me to point out that the code %!(EXTRA string= was appearing in posts by public figures who, in principle, would have no connection to bot networks or cyborg accounts. One of these individuals, located in Ecuador, identified the pattern. We conducted a verification and in Colombia found the code in the accounts of retired sports journalist Iván Mejía and cartoonist Matador.
Given this situation, I initiated a review to determine why these legitimate accounts were sharing posts with the same technical error.
The reader in Ecuador identified a common pattern: all accounts displaying the code %!(EXTRA string= also included a TikTok link in their posts. With this information, I designed a series of technical tests to reproduce the error across different platforms and operating systems. The tests were conducted on four devices with iOS systems (two devices), Android, and HarmonyOS, as well as on mobile and desktop versions of X.
The test was straightforward: access TikTok and share content to X using different methods. In most tests, no anomalous code appeared, except on an iOS device with version 18.7.2. When conducting the test with my own account from that device, the code %!(EXTRA string= appeared consistently, confirming that it was a specific bug that could originate in this operating system version.
This finding does not invalidate the initial thesis about the bot network we discovered. In fact, it reinforces it, though it requires an important technical clarification.
Correction about the code’s origin
The code %!(EXTRA string= is not part of the infrastructure that enables bot operations, but rather a bug that appears when sharing content from TikTok to X. This technical error, whose specific origin is still unknown, could be generated either in the TikTok application or in the integration process between both platforms. The only thing that can be determined with certainty is that this pattern is characteristic of the Go programming language, suggesting that one of the applications involved uses this language in its backend.
Why the thesis remains intact
Despite this correction, the central conclusion remains: there exists a coordinated network of automated accounts sharing content for political purposes in Colombia. The dataset of 70 accounts we identified could be tracked precisely thanks to this technical error, which functioned as an involuntary digital fingerprint.
These accounts can be classified as bots or cyborgs based on the following observed technical characteristics. Below, we present two documented cases so readers can form their own judgment about the nature of these accounts.
Why are they bots?
The dataset and evidence we present were obtained through a search on X using the operator %!(EXTRA as a tracking filter.
Data extraction methodology
To avoid overloading this article with methodological details (available for anyone wishing to replicate the process), we performed basic scraping of the operator through various techniques: data extraction via Nitter and a script executed from the browser console. Due to the technical restrictions of platform X, it was necessary to perform multiple extractions that resulted in seven independent databases. These were subsequently normalized, cleaned, and unified using the Pandas library in Google Colab.
Period and scope of analysis
The extraction captured all accounts that published content with the code %!(EXTRA between January 26, 2026 at 11:29 PM UTC and January 28, 2026 at 1:48 PM UTC (a window of approximately 38 hours).
Variables collected:
- X URL with unique ID for each post
- Username (account identifier)
- Exact date and time of publication
- User’s display name
- Complete post content
Once the dataset of 70 accounts was consolidated, 7 were selected for in-depth analysis, prioritizing those publishing content related to Colombia. The review was conducted manually: first verifying that each profile had published the technical error %!(EXTRA and, once confirmed, proceeding to analyze the complete publication history (feed) of each account.
This review allowed us to identify behavior patterns that, according to academic literature on inauthentic activity detection, are characteristic of bots and automated accounts.
The literature on bots and inauthentic content identifies the following characteristics:
Temporal activity patterns:
- Bots show abnormally high posting frequencies, often exceeding human capacity of 50+ daily tweets (Ferrara et al., 2016, “The Rise of Social Bots”)
- Continuous activity without normal human sleep patterns
- Posts at regular or perfectly spaced intervals (Varol et al., 2017, “Online Human-Bot Interactions”)
Profile characteristics:
- Accounts created recently in bulk
- Usernames with random alphanumeric patterns
- Generic profile photos, stock photos, or AI-generated images
- Empty or copied generic biographies (Chu et al., 2012, “Detecting Automation of Twitter Accounts”)
Content behavior:
- High percentage of retweets versus original content
- Repetitive use of specific hashtags
- Duplicate or near-duplicate content across multiple accounts
- Links to suspicious or malicious domains (Davis et al., 2016, “BotOrNot”)
The Digital Forensic Research Lab of the Atlantic Council identifies specific characteristics:
Primary indicators according to DFRLab:
- Amplified anonymity: Accounts without verifiable real identity information
- Coordinated inauthentic activity: Multiple accounts posting identical or very similar content within narrow time windows
- Swarming behavior: Groups of accounts attacking or amplifying specific targets simultaneously (DFRLab, 2019, “#BotSpot”)
Recent research identifies more sophisticated bots:
“Cyborgs” or hybrid accounts:
- Combination of automation and occasional human control
- Make detection more difficult (Grimme et al., 2017, “Social Bots: Human-Like by Means of Human Control?”)
As is evident, characterizing an account as a bot is a complex task that requires analyzing multiple signals together. Below, we present a selection of documented cases that, according to our analysis, exhibit indicators of automation or coordinated behavior to artificially influence public conversation about political and social issues in Colombia.
Case 1: @bot_40f9c95c
This account presents several characteristic indicators of automation. Its apparent function is to amplify left-wing political content in Colombia through selection and redistribution of third-party posts.
Observed characteristics:
- Username: The format “Name[numeric string-44521]” suggests automated generation, lack of effort to create an apparently human identity, or automatic assignment by X
- Absence of original content: No manually written posts were identified
- Exclusive redistribution behavior: 100% of its activity consists of retweets and sharing content from diverse sources
- Consistent thematic curation: Shared content corresponds exclusively to Colombian left-wing political narratives
Here is the evidence from a screenshot of the entire account.
Case 2: @bot_ed399902
This account presents behavior similar to Case 1, operating from the opposite political spectrum. Its apparent function is to amplify radical right-wing content in Colombia.
Observed characteristics:
- Inverse thematic curation: Shared content corresponds exclusively to Colombian extreme right-wing narratives
- Absence of visual identity: No profile picture (uses X’s default avatar)
- Recent account: Recent creation, suggesting a profile generated for specific operations
- Absence of original content: No manually written posts were identified
- Exclusive redistribution behavior: 100% of its activity consists of retweets and sharing content from third parties
- Username: The format “bot_[numeric string 64022]” matches the pattern identified in Case 1
Emerging pattern: The presence of accounts with identical nomenclature (“bot_” + alphanumeric code) operating at opposite political extremes suggests a coordinated operation designed to artificially polarize Colombian public debate.
Here is the evidence from a screenshot of the entire account.
Generalized pattern in the dataset
The same behavior pattern is replicated in the 7 analyzed accounts, which constitute a representative sample of the complete dataset of 70 identified profiles. All exhibit the characteristics described in Cases 1 and 2: nomenclature with format “bot_[alphanumeric code]”, absence of original content, exclusive redistribution activity, and consistent thematic curation oriented to amplify polarized political narratives.
Methodological note on evidence
We are currently exploring more efficient methods to visualize and present the complete volume of collected evidence. However, given current technical limitations, manual review and qualitative content analysis constitute the most rigorous methodology available to document these patterns of inauthentic behavior.
The gallery of screenshots presented in each case allows readers to directly examine the profiles and form their own judgment about the nature of these accounts.
Methodological note on anonymity
As a researcher of these topics in Colombia and having been a victim of multiple death threats in the past for conducting this type of analysis, I must take security measures that safeguard my digital and physical integrity. Not showing the actors reduces the risk.
Likewise, it is clear that most serious investigations with professional methodologies conduct analysis activities with anonymous evidence to avoid legal problems, safeguard individuals, and protect the integrity of the investigation.
I reiterate: any person interested from a professional sphere in accessing the non-anonymous dataset can contact me and I will gladly share the non-anonymous dataset.
Key references:
- Ferrara, E., Varol, O., Davis, C., Menczer, F., & Flammini, A. (2016). “The rise of social bots.” Communications of the ACM, 59(7), 96-104.
- Varol, O., Ferrara, E., Davis, C., Menczer, F., & Flammini, A. (2017). “Online human-bot interactions: Detection, estimation, and characterization.” Proceedings of the International AAAI Conference on Web and Social Media.
- Chu, Z., Gianvecchio, S., Wang, H., & Jajodia, S. (2012). “Detecting automation of twitter accounts: Are you a human, bot, or cyborg?” IEEE Transactions on Dependable and Secure Computing, 9(6), 811-824.
- DFRLab (2019). “#BotSpot: Twelve Ways to Spot a Bot.” Atlantic Council Digital Forensic Research Lab.
- Nimmo, B. (2017). “Identifying Inauthentic Activity on Twitter.” Atlantic Council DFRLab.
This translation was produced with the assistance of Claude Sonnet 4.5. Human review and editing were applied to ensure accuracy.
Deja un comentario