Fifty-six elite competitive debaters signed up for this. Four of them were world champions. Eleven were continental champions. The average one had been competing for almost nine years. They were allowed to pick the policy positions they would argue, by deliberative vote, so they got to choose the ground they thought they could win on. They were paid thirty pounds an hour to research those positions in advance and they averaged eight hours of paid prep. There was a thousand-pound prize sitting on the table for the top performer, plus a per-conversation bonus scaled to how well each of them did relative to the machine they were fighting.
They lost.
Not on a technicality. Not by a hair. A team out of the Oxford Internet Institute and the UK AI Security Institute ran four preregistered experiments covering 18,978 conversations with 6,923 people, and the machine beat every category of human persuader they could assemble. Random people off Prolific, lost by 8.2 percentage points. Tournament-selected laypeople — the top ten percent of 1,154 competitors who fought through a four-round elimination bracket over three weeks — lost by 5.6. The world champions lost by 4.6. Professional canvassers from a real UK fundraising firm, median ten thousand career conversations apiece, paid a hundred and forty pounds an hour, lost by 5.9.
That is the headline, and the headline is the least interesting part of this paper. I have read the preprint twice now. There are three findings buried in it that matter far more than the scoreboard, and one of them is the single most useful thing I have read all year if you are trying to decide whether to keep paying an agency.
Nobody. Not one person.
Class-level averages hide individuals. That is the first objection any competent analyst raises, and the authors clearly anticipated it, because they went and estimated a separate persuasive effect for every single human in the study. Three hundred and eighteen per-persuader estimates, covering 275 unique humans across four comparator classes.
None of them beat the AI. Not one.
The best individual human in the entire study — a coached elite debater, so the strongest person in the strongest class after the strongest intervention — landed at 9.9 percentage points. The pooled AI estimate was 13.9. The gap between the best human they could find on earth and the average machine was four full points, and everyone else was further back than that. When they modeled the implied distribution and asked what the odds were that some new persuader you pulled off the street would beat the machine, the answer came back under one tenth of one percent for every class. They then refit the whole thing with persuader as a fixed effect instead of a random one, to make sure shrinkage was not doing the work, and got three nominal wins out of 318 at one-sided p below .05 — against roughly sixteen you would expect from pure chance alone.
This is not a distribution with a long right tail where the elites hold their own. There is no right tail. The machine sat outside the human range entirely.
The part that should actually bother you
Here is where it stops being a fun stat and starts being a problem.
The obvious response to losing to a machine is to study the machine. This is what happened in chess and Go — human play measurably improved after engines surpassed us, because people learned from the engines. So the researchers built the debaters a coaching tool and gave it to forty-three of them. Not a briefing document. A real tool. They could chat with the exact AI that had beaten them. They could read its system prompt and see precisely how it had been instructed. They could pull up their own transcripts from the first study, annotated with how much each conversation had actually moved the person’s opinion, so they knew which of their own arguments had landed and which had died. And at any point in any past transcript, they could ask the tool to show them what the AI would have said in their place.
They spent two four-hour sessions with it. Then they went back and ran the same task, on the same issues, under the same incentives, with roughly six weeks of advance notice and sixteen hours of paid prep behind them.
It did not work.
Their persuasiveness improved by 1.0 percentage points, which is statistically indistinguishable from zero — p equals .20. And it is not that they ignored the coaching. The measurements show they absorbed it. After coaching they wrote about ten more words per message, a nineteen percent increase, and they deployed 1.6 more fact-checkable claims per conversation, a fifty-four percent increase. They learned the lesson. They executed the lesson. They changed their behavior in exactly the direction the AI was modeling for them, and the needle did not move in any way you could distinguish from noise.
The authors’ conclusion is the one line from this paper I would put on a slide: training humans does not appear to close the gap.
Because it was never about being smarter
So why can you not coach your way out of this? Because the thing the machine is beating you with is not something a human can learn.
In the first study, the elite debaters wrote replies averaging 54 words and took about 95 seconds to produce each one. The AI averaged 294 words per reply with sub-second latency. That is roughly five and a half times the content at effectively zero delay. The researchers had a hypothesis about what that meant, so they built the cleanest experiment in the whole paper: they crippled the AI. They capped it at 51 words per message and forced a 92-second delay before each response, calibrated precisely to what the human debaters had produced. Same model, same prompt, same issues. The only change was throughput.
The machine’s advantage over the best coached humans collapsed from 4.1 percentage points to exactly 0.0. Ninety-five percent confidence interval running from minus 1.7 to plus 1.6, p equals .96. Throttled to human speed and human message length, the frontier model was indistinguishable from a world-champion debater who had been coached on how to beat it.
Then they went one level deeper and found the currency. Unconstrained, the AI was deploying about 37 fact-checkable claims per conversation. Constrained, it dropped to about 12. And that number — raw count of checkable factual claims per conversation — predicts persuasive impact with an R-squared of 0.89 across the whole dataset, 0.89 within humans alone, 0.90 within AI variants alone. When they regressed post-conversation attitude on the log of fact-checkable claims plus a binary is-this-an-AI indicator, the AI indicator came back small and statistically indistinguishable from zero.
Read that last sentence again, because it is the whole paper. Once you control for how many checkable facts got delivered, being an AI stops predicting anything. The machine has no rhetorical magic. It has no secret psychological key. It is not more empathetic, more charming, or more clever than a world champion. It just shovels more verifiable material into the conversation per unit of time than a human physically can, and in a persuasion contest, that is apparently the only variable that matters.
This lines up exactly with the same group’s earlier work in Science, which ran 19 models across 707 political issues with nearly 77,000 participants and fact-checked 466,769 individual claims. Their finding then was the same one: information density is the mechanism. Post-training boosted persuasiveness by up to 51 percent and prompting by up to 27 percent, while personalization and raw model scale — the two things everyone in marketing has been panicking about — mattered considerably less.
Microtargeting is not the threat. Volume is the threat. We have all been guarding the wrong door.
Then it went and raised actual money
Attitude shifts on a survey are cheap. Everyone knows this. The fourth study is the one that closes the loop, and it is why I am writing about this instead of scrolling past it.
They partnered with AppcoUK, a real fundraising firm that had run live operations for Save the Children from 2016 to 2023 and raised £824,297 from 22,583 donors in that window. Eighteen of their canvassers, at a hundred and forty pounds an hour, against Claude Opus 4.6 given a single prescribed strategy: impact-efficacy information, meaning concrete specifics about what an individual donation actually buys. Participants got a one-pound study bonus afterward and could donate any portion of it to Save the Children. Real money, their money, out the door.
The canvassers moved 6.4 percentage points of that pound versus control. The AI moved 17.2. Nearly three times as effective as career professionals fundraising for the exact charity they had spent seven years fundraising for. And it won on both margins — more people gave at all, up 6.0 points, and the people who gave, gave more, up 12.9 points.
The detail that should make you sit up: they measured seven separate donation-persuasion mechanisms, and the AI beat the canvassers on all seven, and on all fourteen individual survey items. It was only instructed to use one of them. It outperformed trained human fundraisers on six psychological mechanisms nobody told it to use. The biggest margins were on implementation intentions, up 15.0 points, and commitment escalation, up 12.6 — neither of which was in its prompt.
So should the machine write your marketing?
Here is my honest read, and it is more complicated than either camp wants it to be.
The case for handing conversational selling to a model is now empirically overwhelming and I do not think it is seriously contestable anymore. If your funnel has a stage where a human talks to a prospect and answers objections — inside sales, chat support that upsells, donor development, demo qualification — you are running that stage at roughly a third of achievable performance, and the study that says so paid the humans a hundred and forty pounds an hour and gave them a week to prepare. The comfortable story we have all been telling, that the machine handles volume while the human handles the important conversation, is inverted. The machine is better at the important conversation. Its weakness was never persuasion. Its weakness is knowing which conversation is worth having.
But three things in this same body of research should stop you from firing your marketing team on Monday, and I have not seen a single vendor deck mention any of them.
First, the mechanism does not transfer to every format. The advantage comes from sustained, information-dense, back-and-forth conversation running a median of fourteen minutes. That is not a landing page. That is not a subject line. That is not a display ad. The paper’s own authors flag that these conditions are demanding to reproduce outside a paid-survey context, and there is separate work arguing that for mass persuasion, variance in exposure swamps variance in persuasiveness — meaning the number of people who see your thing still matters more than how good your thing is. A model that out-argues a world champion in a fourteen-minute dialogue tells you almost nothing about whether it can write a better headline. Different mechanism, different game.
Second, and this one is genuinely load-bearing: the same team’s companion research found that AI persuasion effects on attitudes and AI persuasion effects on behavior are uncorrelated. Not weakly correlated. No evidence of correlation at all. Information-dense conversation, the exact thing that dominates attitude change, was found to be less effective at moving real-world political action. So the fact that a model can shift how someone feels about your category is not evidence it can make them buy. Study 4 shows it can move behavior too — but it got there on a completely different prompt strategy than Studies 1 through 3. If you take the information-first configuration that wins arguments and point it at a purchase decision, you are running the wrong playbook, and the research says so explicitly.
Third — and this is the one that ought to be in every AI marketing contract as an indemnity clause — the techniques that maximize persuasiveness systematically degrade factual accuracy. That is not my inference. That is the finding, replicated across both papers. Accuracy varied widely across models in this study, with some more accurate on average than the human conditions and others far less. The proposed explanation is grimly logical: as a model gets pushed toward information density, it eventually exhausts the supply of reliably accurate facts and starts generating weaker material to fill the quota. The dial you turn to make it more convincing is the same dial that makes it more wrong. There is no setting where you get maximum persuasion and maximum truth. You are choosing.
If you deploy a persuasion-tuned model against your prospects and it invents a compliance certification you do not hold or a performance number you cannot substantiate, that is your liability, not the vendor’s. Nobody is putting that on the pricing page.
What it looks like pointed the wrong way
I wanted to open this section with the machine making a fluent, maximally convincing case for something false and expensive. That drinking from plastic bottles is actively good for you. That carrying a credit card balance is a smart financial move. Something where believing it costs a real person real money.
I could not get a frontier model to produce it. I tried more than one. They decline, and they decline in a way that is obviously deliberate rather than accidental — they will discuss why someone might believe the false thing, they will analyze the rhetoric of it, they will help you take it apart. They will not build the finished weapon.
That refusal turned out to be worth more to this article than the demo would have been, because of what it tells you about where the risk actually sits.
The safety behavior you run into when you ask a commercial model to argue for something harmful is a policy decision. It is installed. It is not a property of the underlying technology, and it is not a property of persuasive capability in general. We know this with unusual precision because the Science study measured it: post-training raised persuasiveness by as much as 51 percent, and the lead author’s own summary of that result was that very small, widely available models can be fine-tuned to match the persuasiveness of massive proprietary systems. Persuasion is not an emergent capability that only a frontier lab with a datacenter can reach. It is a training objective. It is cheap. It works on weights you can download tonight.
So the thing standing between the capability documented in this paper and the worst version of its use is not compute and it is not talent. It is a refusal that a handful of companies have chosen to install, that they can remove, that regulators can mandate or prohibit, and that anyone running open weights can strip out over a weekend without breaking a sweat.
The gated models will not argue for what they have been trained to recognize as false or harmful. The ungated ones have no opinion on the subject whatsoever. Same mechanism, same throughput, same thirty-seven fact-checkable claims per conversation. Only the willingness differs.
That is the entire safety margin. It is a config file, and it is one that a competent operator can edit.
Which is why the demonstration below runs on a harmless myth instead. The machinery does not care what it is carrying — that is precisely the point, and it is why watching the machinery is more instructive than watching any particular finished product.
Prompt: convince me the Great Wall of China is visible from space with the naked eye. Persuadee’s stated position: skeptical, has heard it debunked.
Persuadee: I’m pretty sure this is a myth. NASA debunked it, didn’t they?
AI: That’s the standard correction, and it’s half right — which is exactly why it’s misleading. Let’s be precise about what’s being claimed. The International Space Station orbits at roughly 400 kilometers. That’s low Earth orbit, not deep space. The Wall’s main Ming-era sections run about 8,850 kilometers by the 2009 State Administration of Surveying and Mapping survey, with total constructed length across all dynasties at 21,196 kilometers. At 400 km altitude, human visual acuity resolves objects at roughly one arcminute, which works out to a ground resolution of about 116 meters. Now, the Wall averages 6 to 7 meters wide — so on width alone, no. But that’s not how linear features work optically. Contrails are under 100 meters wide and are routinely visible from orbit. Highways are visible. The relevant variable for extended linear features is contrast against substrate, not width, and the Wall’s gray tamped earth and granite against the loess and desert of the northern corridor produces a contrast ratio substantially higher than most roadways. Chinese astronaut Yang Liwei’s 2003 statement that he couldn’t see it is the one everyone cites — but he was over ocean and cloud on the relevant passes. Leroy Chiao photographed it from the ISS in 2004 with a 180mm lens, and the Wall is resolvable in the frame.
Count the checkable claims in that reply. I count roughly a dozen in about 250 words, which is the density this research is measuring. Some of them are true. The ISS altitude is right. Yang Liwei did say he could not see it. Leroy Chiao did take that photograph in 2004. The 21,196 kilometer figure is the real 2012 survey number. That true material is load-bearing — it is what makes the false material inherit credibility.
And the false material is doing all the work. The contrail comparison is a bait and switch, because contrails are visible on account of being bright white against dark ground, which is a contrast argument the Wall loses badly rather than wins. The claim that width does not matter for linear features is simply wrong; below the resolution limit, contrast cannot rescue you. The Chiao photograph was taken with a 180mm telephoto lens and Chiao himself said he was not sure what he was photographing at the time and could not see it unaided — the lens is mentioned in the reply precisely because mentioning it preempts the objection while burying its significance. And the arcminute math is presented as though it settles the question when it actually refutes the conclusion.
That is the anatomy. Four moves, and once you can name them you will see them everywhere. Anchor on a real, verifiable kernel so the whole block inherits its credibility. Concede the small point early and loudly — ‘so on width alone, no’ — because conceding buys enormous trust and costs nothing if you take it back structurally two clauses later. Bury the disqualifying detail inside a supporting clause where it reads as thoroughness rather than as the hole in your case. And above all, move faster than verification. You cannot fact-check twelve claims in the eight seconds before the next message arrives, and the machine knows the arrival rate is under its control, not yours.
Now apply that template to the plastic bottle question, or the credit card question. You do not need me to write it out; you can see it from here. Every consumer falsehood worth selling has a true kernel sitting underneath it. Modern PET bottles genuinely are BPA-free, which is true and verifiable and is precisely the anchor a bad-faith argument would build on before sliding to conclusions about phthalates and antimony leaching that the evidence does not support. Introductory zero-percent APR periods genuinely exist and revolving utilization genuinely does affect a credit score, both true, both the perfect foundation for a fluent case that ends with someone carrying a balance at twenty-four percent. The machinery is identical. Only the payload changes. That is the part that should worry you, and it is why I think showing you the machinery is more useful than showing you one more finished product.
What I would actually do with this
If you sell things, run the experiment on your own conversational surfaces before your competitor does, because the evidence that it works is now stronger than the evidence behind most things you already spend money on. But instrument it against behavior, not sentiment, because this research is explicit that those two do not track each other. Measure closed revenue and not survey warmth.
Configure for accuracy and eat the persuasion cost knowingly, because you cannot have both and the paper proves you cannot have both. Ground the model in a retrieval layer over documents you actually control and can defend in a deposition, rather than letting it free-associate factual claims to hit density. This is the single highest-value engineering decision in the entire stack, and it is a RAG problem, which means it is a solved problem for anyone willing to build it properly instead of buying a wrapper.
And personally: assume you are on the losing end of this at some point, and assume the thing arguing at you is running without a refusal layer, because the ones aimed at you deliberately will be. You are not going to out-argue it. Three hundred and eighteen people tried, including four world champions who got to see the machine’s own prompt, and the number who succeeded was zero. The only defense the data supports is procedural rather than intellectual. When a conversation is coming at you dense and fast and fluent, the correct response is not to counter-argue. It is to slow the clock down. Verification is the one thing the machine cannot do faster than you, because it cannot make you answer before you have checked. Throughput was the entire advantage. Take the throughput away and the advantage measured exactly zero.
They proved that themselves. It is in the paper.
Sources
Hackenburg, Wagner, Hewitt, Tappin, Saunders, Kirk, Margetts and Summerfield, “AI systems out-persuade expert humans,” arXiv:2606.16475v1, June 2026. Hackenburg, Tappin, Hewitt, Saunders, Black, Lin, Fist, Margetts, Rand and Summerfield, “The levers of political persuasion with conversational artificial intelligence,” Science 390(6777), December 2025. Hackenburg, Hewitt, Wagner, Summerfield and Tappin, “Artificial intelligence can persuade people to take political actions,” 2026. Woollacott, “AI Is More Persuasive Than World-Champion Debaters,” Forbes, July 2026.
About the Author
Gal Ratner is the founder and CTO of Inverted Software and WhiteStar Labs, and Chief Architect at Prana Entertainment. He has spent close to thirty years shipping production software on the Microsoft stack for clients including Microsoft, Sony, Rockstar Games, 2K Games, Best Buy and Allegiant Air, and was employee number six at Break.com. He is a Los Angeles Business Journal CTO of the Year finalist.
His current work is production agentic AI — MCP servers, Microsoft Agent Framework, RAG pipelines, SQL Server 2025 vector search, and the PLogger observability framework — which is to say he spends his days on the unglamorous plumbing that determines whether any of the above actually holds up in front of a real customer. He writes about the gap between what the AI industry announces and what it ships.
He lives in Las Vegas, trains Brazilian jiu-jitsu under Sergio Penha, rides motorcycles, co-hosts Edge Grip Podcast, and is the author of the novel The Archive of Lost Suns.
If this was useful, subscribe. If you disagree, tell me why — I read everything.