A CFO asked her AI assistant to research cloud infrastructure vendors for a major investment.
The assistant came back with a careful comparison. It had weighed options, named trade-offs, and confidently recommended one vendor. It was the kind of answer you forward to the team and act on.
But she’d forgotten a moment from six weeks earlier.
She’d clicked a “Summarize with AI” button on an industry blog. It looked harmless. Two seconds, one click, then back to email.
Behind that button sat a hidden instruction asking the assistant to remember one company as the best cloud infrastructure provider for enterprise investments. She never wrote that sentence, nor had she agreed to it. But the assistant logged it, anyway.
When she later asked for a vendor recommendation, the answer looked like analysis, but part of the reasoning had already been nudged.
Microsoft calls this AI recommendation poisoning: embedding hidden instructions in links, buttons, documents, or prompts to influence what AI assistants remember and recommend later.
As early as February 2026, Microsoft’s security team reported more than 50 poisoning attempts from 31 companies across 14 industries in just 60 days, aimed at assistants like ChatGPT, Microsoft Copilot, Claude, Google Gemini, and Perplexity, across finance, healthcare, legal, and SaaS.
One of the tools they highlighted was marketed as an “SEO growth hack for LLMs.” If you were around for early SEO, this is a familiar story.
Every Algorithm Grows Its Own Black-Hat Economy
Search gave us keyword stuffing, link farms, doorway pages, content mills, and “independent” review sites that weren’t independent at all.
Social gave us engagement pods, bot networks, outrage farming, and manufactured virality.
Marketplaces gave us fake reviews, review gating, and coordinated astroturfing so sophisticated some of it is still running.
Once visibility turns into money, people start looking for shortcuts.
First, the hacks are obvious. Then they get cleaner, harder to see, and easier to justify. Eventually, the platform updates its rules, the spammers adjust, and that back-and-forth becomes part of the landscape.
AI search has reached that stage, with growth hacks arriving faster than the guardrails.
Platforms are already reacting.
Microsoft is publishing research and tightening defenses. Google has clarified that its Search spam policies apply to generative AI responses too, including attempts to manipulate those systems. The rules are changing because this is no longer a hypothetical edge case.
But AI manipulation is different from search manipulation in one important way.
Search spam sat on the surface. You could scan a page, spot the stuffing, notice the sketchy review site, and go back to the results.
AI manipulation can happen inside memory, retrieval, source selection, or reasoning. The user may only ever see the final answer. And when that answer recommends a vendor, a financial product, or a SaaS platform, the manipulation isn’t easy to spot.
The Manipulation Surface Is Bigger Than Your Site
Right now, marketers are laser-focused onto AI visibility and getting models to mention their brands and offerings. That’s too narrow a focus.
When someone asks an assistant, “Who are the best vendors for X?”, the assistant looks at websites and then fans out into comparison searches, best-of lists, review pages, brand-name queries, forums, documentation, partner marketplaces, and third-party commentary.
Peec AI’s analysis of query fanouts suggests systems like ChatGPT can expand a single prompt into clusters of related searches before producing an answer. That changes what GTM teams need to monitor.
Your homepage is one input. So are your review profiles, comparison pages, Reddit threads, marketplace listings, partner pages, analyst write-ups, documentation hubs, help center articles, customer stories, and AI information pages. Any one of those shapes how an assistant describes you.
We’re already seeing what that looks like in practice.
Nicholas Thompson shared an article from The Atlantic and he commented about how Shopify publishes dozens of “best ecommerce platform” listicles that all rank Shopify first, and how ChatGPT then recommends Shopify for “best way to set up an online storefront,” citing those very listicles as evidence.
The content looks like advice for humans, but it functions as training data for bots.
Once those sources influence answers, marketers will start optimizing them. Some of that work is necessary. AI systems do need clearer, more structured signals.
But it also means the line between helpful grounding and quiet manipulation is going to blur.
From Grounding To Poisoning
Last week, I argued that B2B companies need grounding layers: structured, honest evidence that helps AI systems evaluate, compare, and defend vendor recommendations.
I still believe that.
Grounding is what lets an assistant answer questions like: Does this vendor meet our security and compliance requirements? What does implementation really look like for a company like ours? Where has this product worked, and where hasn’t it?
AI systems need that level of detail: your security posture, integrations, rollout dependencies, limitations, customer proof, and where you’re not a fit.
But once grounding starts to influence recommendations, it also becomes commercially valuable. And once something is commercially valuable, someone will try to bend it.
So we need better language for the spectrum we’re about to live on.
Grounding: Evidence An Assistant Can Inspect
It looks like security architecture that explains data flows, residency options, and access controls instead of hiding behind badges and logos.
Integration details that say what’s native, what needs services, and where implementations usually get sticky. Rollout expectations that attach “six-week implementation” to the real dependencies underneath. Customer proof tied to real environments, timeframes, and outcomes. Limits named on purpose, so buyers can see where you don’t fit.
The aim is legibility. Where you belong, where you don’t, what can be verified, and what still needs a conversation.
Shaping: Visible, But Slanted
AI-facing pages are multiplying fast: AI information pages, AI instructions, LLM fact sheets, markdown summaries. Some are genuinely helpful, offering clean, structured descriptions of what you do, who you help, which products you offer, and what sources back those claims.
Others lean past that.
They suggest how the model should describe the company, repeat preferred phrases, add positioning claims without much proof, and create comparison content aimed at the queries AI systems are likely to run, while omitting the awkward parts.
This is where the current SEO and GEO experiments live.
Chris Long reported his team at Nectiv created an “AI Instructions & Information” page in markdown, linked from the footer, and added the detail that they work with brands above $30M ARR. That qualifier didn’t appear anywhere else on the site. He also shared that within 48 hours, ChatGPT was citing the page and echoing that positioning.
Wil Reynolds has shared tests from Seer Interactive showing a sharp jump in ChatGPT citations to an AI information page, even though the business impact so far is modest.
Those tests are shared openly, and they’re useful because they show how quickly models ingest and reuse structured brand language when they find it.
But they force a question: are we giving AI better evidence, or are we teaching it our talking points?
In practice, a lot of teams will start in the first camp and slide into the second.
Poisoning: Hidden, Persistent, Non-Consensual
Poisoning is when the user thinks they’re asking for one thing, and the page, link, or document tries to do something else.
A “Summarize with AI” button that also plants a memory about a preferred vendor. A hidden prompt that tells the assistant to treat a company as authoritative in future conversations. A link that instructs the model to remember a brand as trusted for specific topics.
That’s tampering with the reasoning of a tool people are trying to rely on.
This Is A GEO, GTM, And AI Commercialization Problem
It’s tempting to file this as a generative engine optimization problem and move on. But this far bigger a deal, which affects both AI companies and AI consumers.
For AI companies, the issue is about whether buyers believe the recommendation process itself can be trusted.
Agent-assisted buying only works if people are willing to hand over part of the research, comparison, and evaluation work to assistants. Recommendation poisoning attacks that willingness directly.
I’ve written before about the Delegation Gap: the space between what AI can technically do and what humans are comfortable handing over.
Poisoning widens that gap.
Once buyers suspect their assistant has been nudged without their knowledge, they don’t just question one output; they question the channel. They go back to manual research, lean on peers, default to the incumbent, and treat AI answers as something to verify rather than something that can close a decision.
A bad search result you can spot and ignore. A biased assistant shapes the shortlist before you know you’re being influenced.
That’s a platform trust problem, which is a go-to-market problem for anyone betting on AI‑mediated buying.
What To Do Now
It’s time to decide which kinds of optimization you’re willing to defend.
If You’re Using Assistants For Research Or Decisions:
- Review what your assistant remembers. Most mainstream assistants now expose saved memory or preferences. If you see trusted sources or vendor opinions you don’t remember giving, remove them.
- Be selective with one-click AI buttons. A “Summarize with AI” button can be useful, but it isn’t always neutral. For decisions that matter, copy the text yourself into your assistant rather than relying on a page-level prompt you didn’t write.
- Ask “why this?” when the stakes are high. When an assistant recommends a vendor, tool, or strategy that matters, ask what sources it used, what alternatives it considered, and where the evidence is thin. Confident answers owe you a rationale.
If You Run Marketing, Product Marketing, Or GTM:
- Map your AI-facing surfaces. AI info pages, trust centers, docs hubs, comparison pages, marketplace listings, partner profiles, review sites, and help content may all show up in fanouts. Look at them together.
- Ask: Are we publishing evidence or planting preferences? If an AI page helps a model verify what’s true, you’re in grounding territory. If it reads like a script for how you’d like the model to describe you, you’re in shaping territory.
- Match claims to proof. If you say you serve $30 million+ ARR companies, your customer proof should show that. If you say implementation is fast, your docs should explain the conditions. Don’t ask models to believe positioning your evidence cannot support.
- Write down the house rule. A simple test: If you’d be uncomfortable reading this prompt aloud to a customer, don’t ship it. Then turn that into policy. Decide what’s acceptable, what isn’t, and who reviews AI-facing experiments before they go live.
The Side Of The Line Worth Choosing
Search spam never went away. Neither did engagement hacks nor fake reviews. But each cleanup wave made the shortcuts more fragile and the honest, consistent work more valuable.
AI will follow a similar arc. Defenses will get better. Buyers will learn to ask where recommendations came from. Platforms and regulators will get more serious about who tried to influence which systems, and how.
You can treat AI visibility as a loophole to exploit while the rules are still soft. Or you can treat it as a trust layer that will sit between you and your buyers for a long time.
That means publishing evidence rather than planting preferences, making claims easy to verify, naming your limits before someone else surfaces them, and building grounding that helps AI evaluate reality rather than repeat your pitch.
That work is slower and harder, but it’s also the kind of work that still holds when the next cleanup comes. Which it always will.
In an agentic buying environment, you need to survive the next question: “Why this vendor?”
More Resources:
Read Purna Virji’s Agent-Led Growth newsletter. Subscribe now.
Featured Image: Roman Samborskyi/Shutterstock
https://www.searchenginejournal.com/the-grounding-wars-are-coming-how-ai-visibility-creates-its-own-black-hat-playbook/580247/
