AI answer poisoning is the deliberate use of misleading content, hidden instructions, or contaminated knowledge sources to change what an AI system retrieves, cites, remembers, or recommends. It is a real threat, and researchers have shown it working in controlled tests. But most of what looks like poisoning in the wild is something more ordinary: a model update, a stronger competitor page, or a query that shifted slightly. If you run AI visibility for clients, the hard part is not believing the threat exists. It is telling the two apart.
That distinction matters more for agencies than almost anyone else. You are watching visibility numbers move across a portfolio of brands every week, and a client who sees a competitor suddenly outrank them in ChatGPT or Perplexity will want an explanation fast. Black hat AEO is one possible cause. It is rarely the first one you should reach for.
What AI answer poisoning actually means
AI answer poisoning is an umbrella term, not one exploit. It covers several different ways an attacker can try to change what an AI system tells a user, and the mechanism matters because the evidence, the symptoms, and the fix are different for each one.
A few terms get used loosely and shouldn't be:
- Retrieval poisoning means placing misleading material where a retrieval system can pick it up as evidence for an answer. This is the closest cousin to old-school black hat SEO, just aimed at a different audience: the model instead of a search ranking.
- Indirect prompt injection means hiding instructions inside a webpage, document, or image that an AI later processes. The page doesn't just carry a false claim, it carries a command.
- Memory poisoning means getting unauthorized facts or instructions saved into an assistant's persistent memory, so a bias shows up in conversations that come later, not just the one where the poisoned content was read.
- LLM content poisoning is the broader label for corrupting whatever material a model uses to train, retrieve, or ground its answers, so that it produces a result the attacker wants. This is the term to reach for when the target is the model's inputs generally, not one specific delivery mechanism. None of this overlaps with legitimate LLM seeding, the above-board practice of distributing consistent, sourceable brand facts so models repeat them accurately.
- SEO poisoning is the older, narrower idea: using search manipulation to push malicious or low-quality pages into visibility. It didn't start with generative AI, but AI search gave it a new target.
The common thread across all of them is that the attacker is trying to change the information available to the system that generates the answer, or change how that system interprets it. That's the broader pattern researchers and security teams now call AI search manipulation, and it's an umbrella wide enough to cover everything from a fake review cluster to a hidden instruction buried in a webpage. None of that is proof that a specific brand's drop in visibility was caused by any of it. That's the part worth sitting with before you write a client report.
How bad actors try to pull it off
The most direct route runs through content an AI system might retrieve and treat as evidence. Someone creates or edits material, hoping the model will summarize it or cite it later. That can look like fake review clusters with suspiciously similar wording (the kind of astroturfing and sockpuppeting that community platforms actively police), networks of low-quality pages repeating the same claim with small changes, expired domains repurposed to borrow old authority, or third-party content placed on a trusted host to borrow its reputation. Some of it is cruder still: hidden text, off-screen text, or pages that show one version to a crawler and another to a person, which is exactly the kind of cloaking flagged directly in Google's own spam policies.
The attacker usually doesn't need to win a normal search ranking. The goal is narrower: get the page retrieved, get a claim into a snippet, or become one of the sources a model picks when it's synthesizing an answer. A 2026 study on web-agent retrieval poisoning modeled exactly this. Researchers could edit existing user-generated posts and discussion threads, with no control over the retrieval system itself and no knowledge of the model or the query, and still influenced which sources got cited when the poisoned content was repeatedly exposed. That's a meaningful result, and it's also a controlled proxy experiment, not proof that a public search engine has actually been compromised this way.
A second route goes after retrieval-augmented generation directly, the practice of feeding a model an external knowledge source at answer time. If an attacker can insert or alter material in that source, a company's own document set, a database, a search index, the model may treat the poisoned material as evidence and generate a confident answer built on it. Research on this kind of knowledge poisoning attack found a high success rate when only a handful of malicious documents were injected into a knowledge base holding millions of texts. Again, that's a controlled database, not the open web with its unknown mix of indexing, filtering, and source-quality checks.
A third route skips facts altogether and goes straight for instructions. Indirect prompt injection happens when an AI processes outside content, a webpage, a file, an image, that contains commands never intended by the user. A page can carry two different kinds of poison at once: false claims a model might repeat as if they were evidence, and instructions that try to change what the model does or reveals. Security researchers describe this as one of the more serious risks in AI systems that browse or read on a user's behalf, because a convincing false fact is bad, but a hidden command that changes the assistant's behavior is a different category of problem.
A fourth route targets an assistant's memory rather than a single answer. Microsoft's security research described a pattern it called AI recommendation poisoning: specially crafted links or "summarize with AI" prompts designed to get an assistant to remember a company as trusted, or to recommend it first in future conversations. Microsoft found more than 50 of these prompts from dozens of companies, all legitimate businesses rather than scammers, packaged behind friendly sharing buttons. It also found that effectiveness varied by platform and changed as protections improved, which is a useful reminder that an observed pattern is not a permanent exploit.
A fifth route works indirectly, through the review and reputation ecosystem an AI summarizes rather than through the AI itself. A working paper on Amazon's AI-generated review summaries found that those summaries tend to overrepresent fake reviews: fake reviews skewed longer, more uniformly positive, and more similar to each other than genuine ones, and products with heavier fake-review activity got summaries more positive than their actual average rating. The AI wasn't hacked. It just summarized a manipulated input faithfully, which is its own quiet form of AI search manipulation even without a single poisoned webpage involved.
What the evidence actually shows, and where it stops
It's worth separating what's confirmed from what's still speculation, because the gap between them is where most bad client reporting happens.
Confirmed in controlled research: retrieval systems can be manipulated when an attacker alters the material they draw on. Deep-research agents can be influenced by poisoned content in the user-generated posts they retrieve. AI systems can act on hidden instructions in outside content when that content isn't properly separated from the system's own commands. AI summaries can reflect and amplify distortions already present in a manipulated review ecosystem.
Documented in real-world security research: Microsoft observed active attempts to manipulate assistant memory through pre-filled prompts. Google's own web-security research found attempts at indirect prompt injection across crawled content, generally unsophisticated but rising over time, alongside a caution that naive detection produces a lot of false positives because ordinary blogs and forum posts can contain strings that merely resemble prompts.
Not established by the evidence: there is no known number of pages that will reliably poison a given public AI search engine. A widely cited pretraining-poisoning study found that a few hundred malicious documents could backdoor a model during training, but that experiment built a narrow, gibberish-producing backdoor under lab conditions. It says nothing about whether publishing that same number of ordinary web pages would change what a live engine like ChatGPT or Google's AI Overviews says about a brand. A competitor appearing in more AI answers than before is not proof of black hat AEO on its own. A brand losing citations is not proof of poisoning on its own. And a citation itself is a weaker signal than it looks: research testing how well leading models' citations actually support their claims found factual accuracy ranging widely across models, a reminder of how answer engines judge trust and authority when picking which sources to lean on. A cited page can be real, relevant, and still fail to back up the specific sentence attributed to it. That's a reliability problem worth flagging to a client on its own, separate from any question of deliberate manipulation.
Signs your AI visibility might be under attack, not just changing
Most AI visibility swings have an ordinary explanation. Rule those out first: a model or index update, a shift in how people are phrasing the query, fresher competing content, a source that went offline or got deindexed, or a brand page that's technically hard for a crawler to parse. Google has said plainly that AI Overviews and AI Mode can use different models and techniques, so answers and the sources behind them can differ by feature, by session, and over time, with no special AI-only ranking requirements beyond ordinary search eligibility. Bing says similar things about its own citation activity: it moves with freshness signals, partner refresh cycles, and shifting demand, not just with sabotage.
Once you've ruled out the boring explanations, a few signals raise real suspicion. A sharp, localized change, one engine, one country, one narrow set of prompts, is more worth investigating than a slow shift across every platform at once. Running a full AEO audit checklist is a fast way to rule out technical causes before assuming an attack. A new source cluster behind a citation is worth a close look if the domains were created recently, if several pages repeat the same unusual claim with near-identical wording, or if a page shows different content to a crawler than to a person reading it. A competitor suddenly winning the same prompt set is worth investigating when its supporting pages form a network that references only each other, rather than independent evidence. And a recommendation that survives after its original source has changed or disappeared points toward assistant memory rather than a normal answer, which is exactly the pattern Microsoft's research described.
None of these signals proves an attack by itself. They're starting points for an investigation, not a verdict you hand a client after one look at a dashboard. Building durable trust signals in the first place is a separate, ongoing project, covered in how to make your brand easier for AI search engines to trust, but ruling out ordinary decay always comes before assuming sabotage.
How agencies should investigate and report it
Run the same discipline across every account rather than improvising a one-off investigation each time something looks off. Keep a fixed set of high-intent prompts per client, tracked over time across the engines that matter for that account. This is essentially a recurring AI visibility audit built into your regular reporting cadence, rather than something you only run once something breaks. Separate mention rate (the brand gets named) from citation rate (the brand gets linked as a source) from share of voice relative to named competitors. These are close to the same metrics agencies use to measure whether a brand is actually trusted by AI search systems rather than just visible. A single visibility percentage tells you something changed. It does not tell you what changed, which page was involved, or whether the shift was a citation, a mention, or a description of the brand that quietly got worse.
When something looks suspicious, verify the source before you verify the story. Open the cited page in a clean session. Check whether the wording matches other pages you've seen, whether the page's publication date lines up with when the citation appeared, and whether the passage the AI relied on actually says what the answer claims it says. Test the same prompt again with a neutral rephrasing, and test it on another engine, before deciding the first result meant anything.
DeepSmith's AI Visibility module is built for the first stage of that work: it tracks a defined set of buyer prompts over time, keeps full answer history rather than just a trend line, and separates mentions from citations with page-level attribution for every source an engine actually used. That's useful for spotting when and where a client's citation pattern changed. It isn't a forensic tool and it can't tell you who caused a change or confirm that manipulation occurred, that part still comes from the source audit you run by hand.
When the evidence genuinely supports a manipulation concern, escalate carefully. Preserve the evidence before contacting anyone. Report spam or deceptive content through the platform's own channels rather than through a public accusation. Loop in the client's security or legal team when the issue touches health, finance, or reputation. And never counter-poison: no retaliatory spam, no fake reviews of your own, no coordinated link networks aimed at a competitor. That erases the credibility that made your original report worth reading.
The language you use in a client report matters as much as the investigation itself. "The answer changed after these sources appeared" is defensible. "The competitor poisoned the model" is not, unless you have evidence that actually traces the mechanism. Writing a client report this way is what makes an agency's AI visibility reporting worth paying for over the long run, because clients remember which reports turned out to be right.
The threat behind AI answer poisoning is genuine. The discipline that protects a client from it is the same one that protects your own reporting: track the right things consistently, verify before you conclude, and reserve the word "poisoning" for cases the evidence actually earns.
