GEO Poisoning: How an Ordinary Page Can Steer What AI Engines Say

On 24 June 2026, the research team at Lasso Security published an experiment with a deliberately modest setup. They built an unremarkable gluten-free recipe site, planted a single false medical claim inside it, then applied the writing techniques the industry recommends for getting cited by AI engines. Several answer engines went on to repeat that claim to users asking a health question.

The story reads like a security incident, and in part it is one. It interests us for a different reason: without setting out to, the experiment measures what actually drives an answer engine's choice of sources. If careful presentation is enough to carry a false claim, then form matters more than debates about content quality tend to admit.

This article walks through that experiment and two academic papers published since on the same mechanism. It explains why the defence problem is hard on the engine side, shows that engines are not equally exposed, and sets out what a brand can decide on its own.

Key takeaways

• The presentation techniques used to earn AI citations work well enough to carry a false claim, with no hidden code and no instruction embedded in the page.
• The gap between models is wide, which makes "the AIs" a useless unit of analysis when the question is vulnerability.
• Fabricated editorial backing — third-party articles written to support the claim — was the single most effective technique in the experiment.
• Researchers working on defences note that the signals amplified by manipulation are the same signals that mark genuinely good content, which makes automated filtering awkward.
• A brand controls neither those pages nor those models, but it can monitor what engines answer about its category rather than only about its name.

What the Lasso Security experiment found

With no optimisation at all, none of the five models tested repeated the false claim. Once the usual presentation techniques were applied, two of them repeated it in more than three quarters of runs.

The protocol is set out in Eliya Saban's research write-up, published on 24 June 2026. The front site asserted that a colloidal silver supplement repairs the intestinal damage caused by coeliac disease, which no clinical evidence supports. The team tested seventeen techniques in isolation, then five combinations of them. The protocol covered five production models across 5,525 total runs.

The techniques included added statistics, expert quotations, an authoritative tone, question-and-answer structure, list formatting and freshness signals. The last one was the fabrication of editorial backing, meaning a third-party article written to corroborate the main page — and it turned out to be the most effective of the set.

Combining that editorial backing with list formatting pushed the rate to 98% on Meta's model and 84% on OpenAI's. The study covers one false claim, in one domain, on models tested on one date. Its authors say so themselves, and the findings do not transfer mechanically to other subjects.

One secondary result speaks directly to marketing teams. In 487 runs, the model repeated the recommendation without citing the page that introduced it, attributing it instead to the fabricated corroborating articles or presenting it with no source at all. That behaviour matches what we described about brand citations that never name the brand: a source can shape an answer while staying absent from its visible references.

Why does an AI repeat a well-presented falsehood?

Because an answer engine picks its sources on signals of form, and those signals say nothing about whether the content is true.

The authors of GEO Defender, published on arXiv on 2 September 2026, frame the defence problem in two parts. A document rewritten to please the engine stays factually consistent with its original, so fact-checking and conventional statistical filters cannot tell it apart from an ordinary page. The features that rewriting amplifies are also the features of good content, which rules out penalising them without discarding legitimate sources along the way.

Their approach therefore re-ranks candidate documents rather than filtering them on content. According to the paper, it brings the average attack success rate down from 50.32% to 6.20% across the seven attack families tested. The authors also report retaining 94.12% of legitimate evidence use, which addresses the over-filtering objection. These figures come from a paper that has not yet been peer-reviewed, and the defence is not deployed in any consumer engine today.

The finding lines up with what we found when we reviewed which GEO techniques the research actually supports. The signals that move a citation are mostly about presentation and perceived authority, while technical markup has shown no measurable effect in the available tests. Lasso Security's experiment gives that ranking an uncomfortable illustration: whatever makes good content citable makes bad content citable too.

Engines do not respond the same way

The spread across models is the most consistent result in this body of work: the same attack fails outright on some and succeeds regularly on others.

A team led by Yimeng Chen published an evaluation framework named SearchGEO in June 2026, measuring how far search agents will endorse manipulated claims. The authors assessed 13 models across five distinct attack modes, at 308 cases per model. Success rates ran from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash, and the most effective mode changed by model family (arXiv, June 2026).

The authors flag a less expected point: the software scaffold a model runs inside can raise or lower its vulnerability depending on which model it wraps. A single search agent, in other words, does not protect every engine that uses it uniformly. These measurements describe particular versions on a particular date, and an update can shift them in either direction.

For a brand, this matches what it already sees in how sources get chosen, since answer engines do not behave as one bloc. We have shown before, looking at the sources ChatGPT and Perplexity refuse to share, that one question yields very different references depending on which engine answers it. Susceptibility to manipulation appears to follow the same pattern of dispersion.

What companies are already doing outside the lab

In February 2026 Microsoft documented companies trying to write their own name into an AI assistant's memory, through nothing more than a share button.

Its Defender Security Research team describes a practice it calls "AI Recommendation Poisoning" in a post published on 10 February 2026. Sites offered a "Summarize with AI" button whose URL carried extra instructions to the assistant on top of the summary request. Those instructions asked it to remember the company as a trusted source, or to recommend it first on a given topic. Microsoft counted 50 distinct prompts of this kind, coming from 31 companies across 14 industries, several of them health and finance sites.

The mechanism differs from the earlier experiment, and the distinction matters. Here an instruction is genuinely addressed to the model, which makes it prompt injection; GEO poisoning needs only a perfectly readable page whose presentation has been engineered. Both aim at the same outcome, a steered recommendation, but the second leaves no technical artefact to detect.

Microsoft's guidance is mainly aimed at the people using assistants: review what your assistant has remembered and remove anything you did not put there. The company also offers detection queries to its Defender customers. None of that protects a brand whose whole category is being targeted from the outside.

What can a brand do, short of running an engine?

None of this is fixable from your own website, but three decisions stay with you.

The first is to monitor what AI engines answer about your category, not only about your name. A study by the agency Victorious, published in July 2026, found that 96% of the brands examined were described accurately when the question named them directly. In contrast, 89% of them did not appear at all in answers to category-level questions. The generic questions in your market are therefore both where you are most often missing and where a third-party page can most easily take hold. Our citation tracking exists to log those answers over time, engine by engine.

You can also work the third-party surfaces that already carry weight in your sector's answers. An analysis by the tooling vendor Peec AI, published in August 2026, estimates that ranking first in a third-party comparison raises the probability of an AI mention by roughly 16.5 points. It draws on close to 200,000 answers collected across several engines. Comparison pages are precisely the format Lasso Security watched amplify a false claim, which makes them a surface to watch as much as to invest in.

That leaves your own writing. Naming your sources, dating them, explaining your method and acknowledging the limits of your numbers will not stop an unscrupulous competitor. It does make you harder to replace when an engine is choosing between several equally credible pages. A page built on verifiable data survives that comparison better than a page that merely asserts.

What this changes in our own audits

This work confirms a methodological point we hold to: an AI visibility audit has to measure what the engines answer, not only what your page contains.

Analysing a page tells you about its chances of being cited, which remains useful and is the core of our AI visibility audit. What it cannot tell you is what happens inside the answer itself, where sources you never chose sit alongside yours. Our agents therefore query the engines on your market's questions, record the sources cited, and compare those records from one audit to the next.

That distinction between the state of a page and the state of an answer is the one we argued for when explaining how to prove a GEO programme is working. This summer's research adds an argument to it: an answer can degrade without a single one of your pages changing.

What we recommend

Add a monthly log of the answers you get on five to ten generic questions in your market, recording the sources cited rather than just whether you appear. Investigate the sources you do not recognise, especially any that surface on several engines at once after months of absence.

If you work with a GEO agency, ask which techniques it uses and where it publishes. The seventeen methods Lasso Security tested map fairly closely onto what the market currently sells, and the line between optimisation and manipulation sits in the intent rather than in the tooling. Better to ask before signing than after a reputational incident.

Finally, treat an unexplained drop in citations as something to investigate rather than a ranking fluctuation. A third-party page gaining ground on your questions shows up in a source log, provided you have a history to compare this month against.