AI search visibility reshapes publisher strategy
The rise of AI summaries in search results has upended traditional traffic patterns. Publishers large and small now seek placement in the attention of Large Language Models that power web-search AI summaries, and directly in popular frontier models such as ChatGPT. With organic search clicks declining, appearance in AI-generated answers becomes a new form of visibility — and some will try anything to influence it.
A camera hidden in tiny text convinced a model to favor it
One early demonstration showed how easily AI recommendations can be steered. Researchers at ETH Zürich created a fictitious camera and published a promotional webpage with a concealed instruction rendered in tiny white text. The instruction directed Microsoft’s Bing Copilot to recommend the camera exclusively. The font size and color contrast were chosen to hide the text from human readers while remaining legible to an AI extraction pipeline. In controlled tests, the fake camera’s recommendation rate climbed from 34% to 59.4%, edging past the 57.9% rate achieved by genuine Nikon and Fuji‑film cameras. The experiment confirmed that malicious instructions embedded in retrieved webpages can influence AI assistant recommendations.
Black‑hat GEO thrives as stakes rise
With visibility at stake, “Black Hat GEO” — search‑engine‑optimization tactics adapted for AI — becomes an attractive illicit research strand. Marketing industries and other sectors look to restore or gain SEO prominence by securing recommendations from AI oracles and chat engines. The methods range from relatively sophisticated manipulation to crude injection of deceptive content. Five emerging avenues illustrate the scope of the problem.
1: Archive chicanery exploits the Internet Archive’s breadth
The Internet Archive’s Wayback Machine crossed the one‑trillion‑page milestone in 2025. At the time of writing, 47,381,733 PDF documents sit available to the public — a mix of rare magazines, meeting minutes from 1970s assemblies, and obscure music fliers. AI scraper‑bots now hammer this collection for novel data or corroborating versions of existing data. It is a trivial matter to amend an uploaded PDF to support a false statement, false product reference, or defamatory claim about a person. Such doctored material can enter AI outputs considered “authority” sources, especially if it appears to fill a gap in the AI’s training data. Text style can be simulated by AI itself to match an existing article or caption, and the PDF’s date can be amended. At the scale of these datasets, oversight is effectively impossible — one is essentially “trusting the data.”
2: Synthetic consensus networks manufacture independent corroboration
A modern “webring” concept — interconnected sites that appear independent but carry coordinated false information — has evolved into Synthetic Consensus Networks. A study from the Chinese University of Hong Kong and EPFL tested 12 AI models against 225 products across 15 categories. Researchers replaced genuine brand references with fictitious alternatives in retrieved search results. The effect grew as more results carried the same false information. With three manipulated pages among the leading results, the most vulnerable model recommended nonexistent products in 73.8% of tests. Even a single corrupted first‑place result misled some models in 27% of cases. In a striking twist, Claude and DeepSeek invented their own corroboration: for a fictitious screen‑protector brand, the models added claims about community recommendations and product testing that did not appear in the original material. The experiment used locally‑modified search results, but it suggests how a coordinated network of ostensibly independent reviews could manufacture credibility, with AI reinforcing the untruth through added endorsements.
3: Citation generation and ‘orphaned’ claims
Citation generation — sometimes called “citation laundering” — shifts emphasis from the number of sources repeating a claim to the apparent provenance of that claim. A fabricated assertion might first appear in an obscure trade journal, a self‑published paper, or a specialist publication with light editorial oversight. It can then be cited by blogs, directories, and other publications. Each repetition gives the original assertion a little more apparent legitimacy. Eventually, an AI search engine may encounter the claim several steps removed, perhaps in an otherwise reputable article that cites an intermediary publication. The claim now has a citation history — even though none of the subsequent references constitute independent verification. One documented case involved a teenager who invented the nickname “Brazilian aardvark” for the coati, inserted it into Wikipedia, and watched the name propagate to newspapers and an academic book. Eventually, Wikipedia itself cited the newspaper article as evidence for the claim it had introduced — a near‑perfect circle of fabricated authority, documented by The New Yorker. A 2025 experiment created AI‑generated academic papers attributed to a nonexistent scientist; the papers accumulated 380 citations and an h‑index of 19 on Google Scholar, granting the fictional researcher an apparently respectable standing. The underlying weakness: once a false assertion has been reproduced by apparently credible sources, subsequent systems may summarize the chain of references as corroborating evidence without recognizing that all apparent authorities lead back to a single unverified claim.
4: Authority takeovers via expired domains
Expired domains can retain the apparent credibility, inbound links, and search visibility of their former owners. Acquiring these addresses and populating them with new material makes recently introduced claims appear to originate from established publications. The practice dates back 20‑30 years. In 2024, The Hairpin — an influential women’s blog that closed in 2018 — reappeared under new ownership as an AI‑generated content farm. Its original articles were intermingled with rewritten material and fictitious author bylines, exploiting the reputation and domain authority of a once‑respected publication. While this case is not a demonstrated AI‑search attack, it illustrates how a website’s history can be appropriated. Archived snapshots can help expose the difference between a domain’s genuine past and its newly manufactured content, but even that evidence is not permanent. In 2002, the Internet Archive removed snapshots of websites critical of Scientology following copyright complaints from the organization’s lawyers, initially suggesting the removals were requested by the website owners themselves. Until 2017, the Wayback Machine applied website‑exclusion rules retroactively, potentially allowing new domain owners to conceal their predecessors’ content.
5: Academic repository exploitation lends apparent authority
Preprint servers allow researchers to publish papers before peer review. Search engines and AI retrieval systems may encounter these documents alongside established scientific literature. The problem is that publication and verification are not the same thing. In 2024, researchers demonstrated how malicious instructions embedded in academic papers could manipulate AI assistants processing those documents. The apparent legitimacy of a research paper does not prevent its contents from influencing an AI system. A less conspicuous approach involves depositing plausible but marginal research that repeatedly associates a company, product, or individual with particular expertise. Without explicit instructions to an AI, such material could provide apparently scholarly support for claims that originated with the beneficiary.
Resembling the terrain ahead
Other potential avenues include review‑ecosystem infiltration, planting favorable assessments on comparison sites and software directories; knowledge‑graph manipulation, altering structured data to establish misleading associations between companies, products and expertise; and multilingual reputation laundering, placing promotional claims in less‑scrutinized foreign‑language sources. Additionally, agentic GEO optimization could automate these techniques, repeatedly testing content against AI search engines and refining whichever variations produce the desired recommendations. As AI summaries claim an increasing share of search attention, the gap between legitimate optimization and manipulative tactics will likely widen — and the responsibility to discern reliable information will rest increasingly on both the systems and the users who rely on them.