Key takeaways
- Yes, in principle. Poisoned pages that rank or get retrieved can shape AI answers, and security researchers have documented fake support numbers resurfacing in Gemini and Google.
- Nobody has published a dataset measuring how often it happens. Treat the headline claims with some caution.
- Two different things get called "poisoning": attackers planting content, and Google deliberately serving altered SERPs to scrapers and rank trackers (Nozzle's finding). Do not mix them up.
- AI Overviews lean heavily on social and user-generated sources. ChatGPT barely does. That changes where the risk sits.
- Defense is mostly monitoring: watch what AI says about your brand, which pages it cites, and clean up impersonating or hijacked pages.
Two meanings of search poisoning
The phrase is getting stretched, so let me split it.
The classic meaning is attacker-driven. Someone publishes or hijacks pages so that a malicious result shows up for a query: a fake support number, a malware download, a phishing page. That is SEO poisoning.
The newer meaning comes from a recent analysis by rank-tracking firm Nozzle, covered by Search Engine Journal. Nozzle claims Google is deliberately serving wrong-but-complete SERPs to scrapers and AI grounding pipelines. The odd pages started appearing around September 20, peaked at 25% of results, and have been 5 to 11% per day since October 1.
This guide is mostly about the first kind, and whether it leaks into AI answers. But the second kind matters too, because it affects the data you use to find out.
How a poisoned page reaches an AI answer
ChatGPT, Google AI Overviews and similar systems do not answer purely from memory when a question needs current or specific information. They run searches, pull a handful of pages into context, and write the answer from those pages. Google also confirms that AI Overviews and AI Mode can use query fan-out, issuing several related searches before assembling a response.
That retrieval step is the opening. Lasso Security put it bluntly in its June 2026 write-up: an attacker who controls even a single retrieved page may be able to influence what the model tells the user, with no access to the model or any hidden commands. Their test used standard GEO techniques (statistics, quotable phrasing, Q&A and list formats, expert endorsements, confident tone, agreement across sources) on a purpose-built test site, across 17 techniques and five LLMs. I only had access to the first part of that report, so I will not quote its results.
The point is that the tricks marketers use to earn citations are the same tricks a bad actor can use to push a false claim. There is no separate hacking toolkit.
The documented case: fake support numbers
The best-documented example is from ZeroFox, which published research on SEO poisoning aimed at LLMs (the post dates from around mid-2025, so check the date before treating it as current). The playbook:
- Write fake customer-support contact details as Q&A pages, like "How do I speak to someone at [Brand]?"
- Upload them as PDFs to trusted .edu and .gov domains.
- Repost the same content on forums such as Goodreads and in long Pastebin URL lists to speed up indexing.
- Wait for LLMs to treat the repeated number as legitimate.
ZeroFox found a PDF on a University of Michigan share drive carrying a fake number for a major travel brand, plus dozens of similar files on other university and government domains. One fake number showed up across several sources and was resurfaced by Gemini and Google as a real contact.
What I find notable is the mechanism. It is not clever prompt injection. It is volume, trusted hosting and repetition across sites, which looks to a retrieval system a lot like corroboration.
Does the domain need to be a big one?
Not necessarily. Promptwatch Data's ChatGPT citation share by domain rank for August 2026 shows that sites in the DR 46-60 band took 22.6% of citations, DR 61-75 took 23.4%, and DR 76-90 took 18.9%. The very top, DR 91-100, averaged just 4.4% for the month. Even DR 0-30 sites earned about 14%.
This report does not mention poisoning, so this is my inference: a malicious or compromised page does not need top-tier authority to get cited. ChatGPT clearly cites mid- and low-authority pages all the time.
There is also a ranking angle. Ahrefs studied 15,000 prompts and found only 12% of URLs cited by assistants like ChatGPT, Gemini and Copilot rank in Google's top 10. Semrush found ChatGPT cites pages in organic position 21 or lower almost 90% of the time. So a page that never ranks well can still get in. AI Overviews are closer to the SERP (roughly 38% of citations from top-10 pages, per Ahrefs), so classic SERP poisoning transfers more directly there.
Where AI Overviews and ChatGPT differ
The two systems pull from different places, which changes where the risk sits. Promptwatch Data's social media citations by AI model report covers Sep 28 to Oct 4, 2026:
| Engine | Share of citations from social platforms | Notes |
|---|---|---|
| ChatGPT | 0.46% | Reddit fell from 5.19% to 0.09%; LinkedIn is the top social source at 0.3% |
| Google AI Overviews | 12.2% | YouTube 4.28%, Facebook 2.38%, Reddit 2.15% |
| Perplexity | 2.7% | LinkedIn and Reddit tie at 0.86% |
AI Overviews takes about 26 times as much from social platforms as ChatGPT does. My read: forum and user-generated spam is a much bigger route into AI Overviews than into ChatGPT. The two do not cite the same sources for most queries anyway, so a poisoning campaign that works on one may do nothing on the other.
This fits an oddity in the Nozzle data, where poisoned SERPs contained more user-generated content and fewer websites overall.
Poisoned pages can stick around
Once cited, a page does not necessarily vanish fast. In Promptwatch Data's ChatGPT content half-life study, which tracked pages cited on July 6, 2026 for 90 days:
- 78% of landing pages and 76% of docs were still cited after 30 days, and 69% and 67% after 60 days.
- Product pages, reviews and how-tos kept about 55% after 60 days, with a half-life of 74 to 77 days.
- News had a half-life of just 36 days.
Again, the study is not about poisoning. But a fake support PDF shaped like a doc or landing page is exactly the type that persists. Unless someone takes it down, assume it keeps getting cited for months.
What the Nozzle story does and does not tell you
Nozzle's numbers are worth knowing if you track visibility:
- Poisoned results retain only 20.7% of the websites from successive searches for the same keywords, so volatility looks artificial.
- AI Overviews appeared in 34.9% of poisoned SERPs versus 54.2% in the baseline.
- "People also search for" appeared 52.7% of the time versus 87.2%.
- Image packs appeared almost twice as often: 44.2% versus 23.0%.
Nozzle's theory is that Google is responding to AI scraping and grounding, and rank trackers got caught in it. That is one analyst's reading, not something Google has confirmed. It is also not attacker poisoning, and it does not show bad pages entering AI answers. It does mean a sudden swing in your tracked rankings may be noise rather than a real change. Cross-check against Search Console before reacting.
What we do not know
I looked for a dataset measuring how often poisoned pages get cited by ChatGPT or AI Overviews. I did not find one, from Promptwatch Data or anyone independent. Everything above is case studies, controlled experiments and inference. Treat any article claiming a precise percentage with suspicion, this one included if it ever tried.
Other work worth reading but which I have not verified in full: Salesforce's research on search agents getting tricked by maliciously hosted content (its summary claims 80% of agents fail to detect malicious content), an arXiv paper on citation vulnerabilities in generative engines, and Zscaler ThreatLabz on malware distributed through poisoned AI-related search results.
How to defend your brand
Monitor what AI says about you
Run the questions customers actually ask, especially "[brand] phone number", "[brand] customer service", "[brand] refund" and "is [brand] legit", across ChatGPT, AI Overviews and Perplexity. Any wrong contact detail is a red flag.
Tools like Promptwatch can track which pages AI cites for your brand prompts, including Reddit, YouTube and LinkedIn sources and third-party pages that name you without linking. That is how you spot an impersonating page before a customer calls the wrong number.
Other trackers cover parts of this. Most are monitoring-focused, so check what each shows about cited sources.
Otterly.AI
Profound
The GEO software directory at bestgeosoftware.com lists more options if you want to compare.
Publish authoritative answers yourself
AI Overviews and ChatGPT both skew toward passages near the top of a page. CXL found 55% of cited passages in 100 AI Overview citations sat in the first 30% of the source page, and Kevin Indig found 44.2% of 18,012 ChatGPT citations came from the first 30% of a document. If your official support page states the correct number early and clearly, you give the retrieval step a better candidate than the fake one.
Check your own domain for abuse
The ZeroFox cases involved legitimate university and government domains hosting uploaded PDFs. If you run any site with open uploads, shared drives, or user-generated areas, audit them. A crawler helps here.
Page change monitoring can catch hijacked or altered pages.
Look at crawler and search data
Google's Search Console now has a generative AI features report, which is a rough way to see whether your pages show up in AI features at all.
Being named by other sources matters too. Directory listings, comparison pages and roundups are the material retrieval passes read when building a vendor list, so keep third-party descriptions of your brand accurate.
Report and take down
For fake contact pages, report to the host, the domain owner and Google. Brand impersonation reports are slow, so start early. Keep screenshots of the AI answers showing the wrong information.
A quick checklist
| Task | How often | Why |
|---|---|---|
| Test branded support and contact queries in AI tools | Weekly | Catch fake numbers early |
| Review cited sources for brand prompts | Weekly | Find impersonating pages |
| Audit upload and UGC areas on your domains | Quarterly | Stop your own domain being a host |
| Cross-check rank swings with Search Console | When rankings spike | Separate real changes from SERP noise |
| Keep official contact and policy pages answer-first | Ongoing | Give retrieval a correct source |
Bottom line
Search poisoning can spill into AI answers because AI answers are built from retrieved pages, and retrieval does not verify truth. The documented cases are fake support numbers on trusted domains and controlled experiments showing standard GEO tactics can push false claims. What is missing is measurement: nobody can tell you how often it happens. Until that exists, the practical move is boring and effective. Check what AI says about your brand every week, and fix what is wrong at the source.
For broader data on what AI engines cite, see Promptwatch Data.