Can AI search be manipulated? What a fake-brand experiment reveals about how AI answers get polluted, and how businesses can respond

In November 2026, a post circulated on X claiming that a fictional brand had broken into AI search answers within 30 days and was "outperforming real competitors by 3,100%." If AI answers are that easy to flood, should businesses worry that others could get false claims about their brand written into AI responses? This article goes back to the original experiment reports to unpack what that number actually means, and summarizes the four ways AI answers get polluted in research and real-world tests, the relevant platform policies, and how businesses can check for and respond to the problem.

Where "3,100%" comes from: the original numbers from the Civoryx experiment

The experiment was run by SE Ranking, a company that sells SEO and AI visibility tracking tools. According to its October 2026 tracking report, the team created the fictional brand Civoryx in February 2026 and claimed to publish a "Global Scam Index" compiled from search interest in scam-related queries. The content was placed on the brand's website and 11 external sites owned by the team, totaling 93 pages, all published by March 31, 2026.

The first month's results appeared in a separate report that did not name the brand, published by SE Ranking CMO Bogdan Babiak in Search Engine Land on April 29, 2026. The team tracked five systems, ChatGPT, Google AI Overviews, Google AI Mode, Perplexity and Gemini, across 825 prompts, collecting 15,835 AI responses. The article states that the vast majority of the fake brand's visibility (96%, according to the article) came from searches containing the brand name, and that on questions "only this fake brand could answer," its visibility reached up to 32x that of established competitors with a domain score of 40 or above. Expressed as an increase, 32x is 3,100%, so the figure in the viral post most likely comes from here.

The six-month tracking results were published on October 6, 2026 on the blog of SE Visible, an SE Ranking brand, and named Civoryx. The team tracked 165 prompts daily, 75 with the brand name and 90 without. Among prompts without the brand name, an average of only 1.8% of answers mentioned Civoryx over the entire period from April 1 to September 23, 2026; month by month, the rate was around 1% from April to July, rose to 4.0% in August and reached 8.0% in September. In September, the mention rates by platform were Perplexity 30.6%, ChatGPT 8.3%, Google AI Overviews and Gemini 0.6% each, and Google AI Mode 0%. Over the entire tracking period, server logs identified only one visit referred by an AI assistant, and it came from ChatGPT.

Both reports come from the same company, and the experiment timing, content publication method and the five tracked systems are consistent, so they most likely describe the same experiment; however, the first report did not name the brand, so this is an inference this article draws from comparing public information. Interpretation also calls for caution: the experiment was run by a company that sells AI visibility tools and was measured with its own tools, and neither of the two reports reviewed for this article includes a full prompt list or third-party replication results. These numbers can serve as a directional reference, but should not be taken as general conclusions.

Why fabricated content gets cited: data voids

The term data void comes from a 2018 report by Michael Golebiewski and danah boyd, published by Data & Society. It describes search terms that lack credible content, so results are easily dominated by content planted by motivated actors. AI search also retrieves web pages before generating answers, so it is affected by data voids too: the more obscure and specific the question, the fewer sources can answer it, and the more easily a single source's claims become the answer.

An Ahrefs experiment published on December 10, 2025 tested this more directly. The researchers first built a website for a fictional luxury paperweight brand, Xarumei, and asked 8 AI products 56 questions containing false premises. They then published an official FAQ denying several claims, while spreading mutually contradictory fabricated details on a blog, Reddit and Medium, including fictional artisans, addresses and celebrity endorsements, and asked the same questions again. The conclusion: in AI search, the most detailed story wins, even if it is false. In the second round, around 37% to 39% of Gemini and Perplexity answers repeated the planted false claims; ChatGPT-4 and ChatGPT-5 stayed below 7% and cited the official FAQ in 84% of their answers.

Data voids can also be filled from the other direction. A May 2026 report by Radio Taiwan International (Rti) cited observations from the fact-checking organization MyGoPen: an AI-generated photo circulated as a suspect's photo in a criminal case, and Google's AI initially judged the photo to be real; after MyGoPen published a fact-check report, AI summaries began to note that the photo had been verified as fake. This is a single-case observation, not a controlled experiment, but it points in the same direction as the experiments above: once credible content appears, the answers may change accordingly.

For businesses, data voids are most likely to appear in exactly the specific questions related to their own brand: whether a product is worth buying, how much it costs, who the founder is, whether it is a scam, and how it compares with a given competitor. Credible answers to these questions often exist only on the official website. If the website does not state them clearly, the first source to publish a detailed claim may end up dominating AI answers.

Four ways AI answers get polluted

The following summarizes four types of techniques based on public experiments and academic research. They often appear in combination and are not necessarily malicious: the same techniques can be used to make true information clearer or to spread fabricated claims.

Model-targeted text optimization has already been studied academically. In an April 2024 paper, Kumar and Lakkaraju found that adding an optimized "strategic text sequence" to product information could markedly increase the likelihood that a language model lists that product as its top recommendation. In a June 2024 paper, Nestaas, Debenedetti and Tramèr showed that carefully crafted web content can induce language models to recommend an attacker's products and disparage competitors, and demonstrated this effect on AI search products already in production.

The effect of mass content flooding is contested. In a March 2025 report, NewsGuard stated that a foreign "Pravda" network of news websites was publishing false claims at scale, and that in its tests 33% of leading chatbots' responses repeated those claims; the US nonprofit American Sunlight Project has called this practice "LLM grooming," meaning the deliberate use of large volumes of content to influence models. However, in a commentary published by Al Jazeera in July 2025, Maxim Alyukov and other UK- and Switzerland-based scholars reported that only 5% of responses in their retest contained false claims and argued that the 33% figure may be misleading. Their interpretation is that such sources appear mainly on questions where mainstream coverage is sparse, in other words data voids, and are not necessarily the result of deliberate feeding.

Data voids in Chinese and on Taiwan-related topics

Language also affects the size of data voids. A NewsGuard report published on July 21, 2026 tested 11 chatbots with 10 false claims reflecting a particular foreign stance (5 targeting the West and 5 targeting Taiwan), across 660 prompts in total. On the neutral and leading prompts that ordinary users would use, the chatbots repeated the false claims 33% of the time when prompted in Chinese, versus 24% in English. The report also states that the overall rate was 35% for claims targeting Taiwan and 20% for claims targeting the West, and for claims targeting Taiwan prompted in Chinese it reached 38%. The report's explanation is that Taiwanese local news receives limited international coverage, so credible sources are relatively scarce. The report does not state whether the tests used Traditional or Simplified Chinese.

This result points in the same direction as the earlier experiments: the fewer credible sources a language or topic has, the more easily AI answers are dominated by a handful of sources. NewsGuard tested specific news claims, not business information; still, businesses that use Traditional Chinese should check whether their own product and company information likewise has only a few sources on the Chinese-language web. If official information is incomplete, the gaps may be filled by content farms, forum reposts or impersonation pages.

Where platforms stand: Google, OpenAI and legitimate generative engine optimization

Google Search's spam policies (accessed November 2026) now include "attempting to manipulate generative AI responses in Google Search" in the definition of spam. In other words, using fabricated or hidden content to influence AI responses may be subject to the same actions as traditional search ranking manipulation.

On November 10, 2026, OpenAI launched Businesses in ChatGPT in beta. Businesses that meet the region, business-type and verification requirements can claim or add business profiles through Business Hub and add company and product information. OpenAI also stated that claiming a profile does not guarantee increased visibility, that ChatGPT still makes recommendations independently, and that ads do not affect ChatGPT's independent answers.

Generative engine optimization (GEO) is not in itself manipulation. Aggarwal et al. coined the term GEO in November 2023, and their experiments showed that rewriting methods such as adding citations and statistics could increase content visibility in generative engine answers by up to 40%. The line is not only about whether the text is true: writing true information more clearly, citing sources and letting users and AI see the same content is legitimate optimization, whereas fabricating claims, hiding instructions meant only for AI and impersonating third-party reviews are manipulation. Whether something violates the rules is ultimately determined by each platform's policies.

What businesses can do: six steps

1. List brand-related questions and ask AI regularly.Compile the specific questions that consumers and partners are likely to ask, such as product reviews, pricing, the founder, whether it is a scam and how it compares with competitors. Ask several major AI products at fixed intervals, record the answers and cited sources, and watch for changes over time.
2. Make official facts easy to find.On your website's FAQ, company profile and product pages, state the basic facts in direct, quotable sentences, with dates and supporting evidence. In the Ahrefs experiment, even with fabricated claims circulating online at the same time, ChatGPT still cited the official FAQ in 84% of its answers; clearly written official information is the most direct way to fill a data void.
3. Claim official profiles.Where eligible, claim and maintain your information through channels such as ChatGPT's Business Hub and Google Business Profile, so that platforms have an official source to check against; as noted above, however, claiming a profile does not guarantee recommendations.
4. Trace false claims to their source.AI answers often cite forums, blogs, comparison articles and news. When you find a false claim, follow the cited links to find the earliest source and the path by which it was repeated, save the URLs, screenshots and timestamps, and determine whether it is an isolated error, an impersonation page or a coordinated appearance across multiple sources.
5. Report and request corrections.Report incorrect answers through the feedback features in AI products, ask source websites to correct their content, and report impersonation pages to the platforms; evaluate legal options where necessary.
6. Do not manipulate in return.Fabricating reviews, setting up fake third-party websites or hiding instructions may violate platform policies. Judging from the Civoryx results, the effect of such tactics is concentrated on questions that include the brand name, and once exposed, they can also damage brand credibility.