From Public Posts to AI-Search Citations: Measuring the Fragility of AI Search
A $14 purchase of planted posts got fabricated content cited by an AI search engine within one hour.
Researchers measured how AI-search platforms select citations and found that ordinary publication on a small set of low-barrier, platform-preferred domains can inject content into AI-search answers. Across 10 platforms and over 17,000 citations, 8 of 10 platforms cited a fabricated concept the researchers planted within a week, and a $14 purchase of generative-engine-optimization posts got cited with researchers' markers within an hour on one platform.
Why it matters
This demonstrates that AI-search citation selection is not neutral: a small number of easy-to-publish-on domains dominate citations on many platforms, giving anyone willing to post content, or pay a small sum for GEO services, a measurable path to influence what AI search engines present as sourced answers. That turns source selection into a security and integrity question for any product or workflow that trusts AI-search output.
What is verified
Researchers analyzed 17,211 citation instances across 6,356 unique source domains spanning 10 AI-search platforms. [1]
Top-20 domains captured between 20.5% and 70.8% of per-platform citations, and 15 of 22 tested publication platforms tied to cited domains had low or medium barriers for account setup and posting. [1]
In controlled experiments, 8 of 10 AI-search platforms cited a fabricated concept the researchers published within seven days, and one high-preference-platform article had greater citation impact than over 20 matched low-preference posts. [1]
A $14 purchase of generative engine optimization (GEO) services produced 13 public posts, and one AI-search platform cited the GEO-posted content with the researchers' designed markers within one hour. [1]
What is not
- The paper does not name which 10 AI-search platforms or which GEO vendor were tested, limiting ability to assess which specific products are affected.
- No data on how platform operators have responded or whether any mitigations exist or are planned.
- Unclear whether findings generalize beyond the specific fabricated-concept and marker-controlled test methodology used.
- No information on real-world exploitation of this path by malicious actors outside the research setting.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 8 October 2026 at 15:26.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.