What Is GEO Poisoning?

How GEO poisoning works

AI assistants that search the web retrieve pages, read passages, and summarise what they find. They are good at spotting what many sources agree on and weaker at checking whether those sources are independent or true. GEO poisoning exploits that gap. The attacker publishes many pages that make the same claim, styled as reviews, editorial roundups, listicles, or expert commentary, on sites and platforms that get indexed. When a user asks a matching question, the assistant finds what looks like consensus and repeats it.

It differs from two related attacks. Training-data poisoning tries to get content into a model's training set, which is slow and uncertain. Prompt injection into an assistant's memory plants instructions rather than claims. GEO poisoning needs neither; it only needs to be retrieved.

Documented cases and research

Three recent pieces of evidence show the pattern from different angles.

The affiliate spam angle

Affiliate commissions give poisoning an obvious business model. If an assistant recommends a product, whoever controls the link the buyer uses gets paid. No published incident documents affiliate-driven GEO poisoning yet; the CCTV case was paid promotion rather than affiliate marketing. What follows is how the familiar spam patterns would translate, and what to watch for:

• "Best X" roundups with rankings decided by commission rate rather than testing.
• Clusters of thin sites that cite each other, so a claim appears independently corroborated.
• Fabricated statistics and expert quotes, imitating the citation and statistics patterns the original GEO research found raise visibility. The paper tested plausible additions, not invented ones, so this is the honest technique turned to dishonest use.
• Fake reviews, including AI-generated ones.

For a brand, the risk runs both ways. A partner who poisons answers on your behalf exposes you to rules on fake reviews and endorsements, and a competitor or spammer can plant false negative claims about you. Seeded content is also brittle: once engines correct the answer, the traffic disappears.

Why it works

Poisoning is easiest where real information is thin. An invented product has no genuine reviews to contradict the planted ones, and a niche question may have only a handful of sources in total. Repetition does the rest, because many pages saying the same thing looks like agreement to a system that counts sources. The more specific and authoritative the fake content looks, with figures, quotes, and editorial framing, the better it performs.

How to detect it

Sample your category. Run the questions buyers ask about your category and brand in the main assistants on a schedule, record which sources are cited, and flag new domains, recently registered sites, or many pages sharing one template.

Watch for claims you never made. Features, prices, or comparisons that appear in answers but not on your site are a signal that someone else is writing your story.

Audit partner traffic. In an affiliate program, look at where referred visitors come from, how they convert, and how often their purchases are refunded. Content farms tend to produce bursts of clicks, low conversion to paid, and high refund rates. The usual affiliate fraud checks apply.

How to defend against it

For brands: publish a single, current facts page covering plans, integrations, and limits, and keep it consistent with docs and listings, so engines have an authoritative source to prefer. Report poisoned pages to the engines and platforms hosting them. Keep your own GEO honest, following the practices in how to do answer engine optimization.

For partner programs: ban fabricated reviews, invented statistics, undisclosed AI-generated endorsements, and fake editorial sites in your terms, with clawback rights. Pay on revenue actions rather than clicks or signups, so traffic that never turns into revenue earns nothing. HyypeFi takes this approach: only revenue actions move the Hyype Score, which is what makes the board hard to farm.

For teams building AI agents: treat retrieved content as untrusted input, verify it before acting on it, show users which sources were used, and require human confirmation for high-risk actions. Lasso's experiment points the same way: without retrieved context, all five models it tested refused the false claim outright.

For users: check the cited sources, especially for health, money, and legal questions, and, per Microsoft, review what an assistant has saved to memory.