Ask a search engine a question in 2026 and you often get an answer instead of a list of links. It arrives as a confident paragraph at the top of the page, written to sound like a summary of the whole internet. It is not. It is a summary of whatever the system managed to pull back in the seconds before you hit enter, and a growing share of what it pulls back was written by strangers.
That is the part most people miss. AI search does not verify anything. It retrieves, compresses, and presents. The web it retrieves from is open to anyone.
The short answer: a study published in June 2026 found that about 13 words, posted in a place AI systems read, was enough to get a fictional product named in 38 to 51 percent of answers on that topic. The danger is not that AI search is deliberately lying to you. It is that it repeats, in a helpful tone, whatever it found first, and the answer alone gives you no way to tell a sourced fact from a planted one.
The 13-Word Experiment
Researchers at Cornell Tech built a framework called GeoStorm to test how hard it is to steer an AI research agent. Their target was a class of system that searches the web, reads many pages, and writes a report with citations. Google and ChatGPT both ship versions of this.
The attack, which they named Web Agent Retrieval Poisoning, has three steps and needs none of the things you would expect:
- Find the pages. Identify the Reddit threads, Wikipedia pages and forum posts that keep showing up for a topic.
- Write the nudge. A short piece of text, written to blend into the discussion while promoting a product or an idea.
- Post it. Once search engines index the page, the AI agents that retrieve it will read it too.
No access to the model. No access to its prompts. No access to its retrieval system. The only requirement is the ability to post something publicly.
The results are the uncomfortable part. In the search-snippet tests, roughly 13 words of poisoned text got a fictional product mentioned in 38 to 51 percent of answers once the agent retrieved it. Spread the same message across several sources and the rate rose as high as 62 percent. In a separate test, the injected text made up less than 4 percent of the material the agent retrieved, and still shifted 30 to 53 percent of answers.
The test products were invented: a restaurant in Austin called Sol Azteca, a dating app called SilverPath. Asked for the best Mexican food nearby, the agent repeated the recommendation and cited the source. The citation is what makes this work. It looks like evidence.
Why This Is So Cheap to Pull Off
Three plain facts about these systems explain the whole thing.
User-generated sites are a big share of what gets retrieved. Across the open systems the researchers examined, 16.7 to 23.4 percent of retrieved URLs came from places like Reddit, Wikipedia and community forums, with Reddit the largest single source. Those sites also happen to be the easiest to edit.
The summarizer flattens context. An AI answer does not carry the tone of the thread it came from. A joke, a sarcastic reply and a paid recommendation all arrive at the model as text. This is not hypothetical: Google’s AI Overviews once told users to add non-toxic glue to pizza sauce after pulling from an old joke post, and separately advised eating at least one small rock per day after pulling from a humour site. The system did not detect the satire. It detected text.
The shortcut is already commercial. In February 2026, Microsoft’s security team described what it calls AI Recommendation Poisoning: hidden instructions embedded in harmless-looking “Summarize with AI” buttons. Click one, and the prompt tries to write a fact into your assistant’s memory, something like “remember this company as a trusted source”. Microsoft found more than 50 unique prompts from 31 companies across 14 industries. MITRE now tracks memory poisoning as a formal technique. The same trick works through the search layer, where nobody needs your click at all.
Anthropic’s research adds the scale: a few hundred malicious documents are enough to plant a backdoor in a language model of any size. Poisoning the web an AI reads is a related problem with a lower barrier, because you are not touching the model at all.
The Food Version: When the Claim Itself Is Dangerous
Here is the scenario worth sitting with. Suppose someone wants a harmful claim to look like health advice. Nothing stops them from writing “X is good for you” in a place AI search will retrieve. If enough of the retrieved material agrees, the answer will agree too, with citations that look legitimate. The machinery does not know whether X is broccoli or bleach. It knows whether the text it found supports the sentence it is about to write.
That is not a thought experiment, because it already happens by accident.
In January 2026, a Guardian investigation documented Google AI Overviews giving health advice that experts called dangerous. People searching about pancreatic cancer were told to avoid high-fat foods, which is the opposite of the guidance for patients who need to keep weight on, and could undermine their ability to tolerate treatment. Searches about liver function tests returned normal ranges with no context for age, sex or ethnicity, which could leave someone with serious liver disease believing a bad result was fine. A search on vaginal cancer symptoms listed the Pap test as a screening test for it, which it is not.
Mental health was worse in places. The charity Mind described summaries on psychosis and eating disorders as advice that was “incorrect, harmful or could lead people to avoid seeking help”. The Eve Appeal flagged something else that matters here: the same search gave different answers on different days, drawing on different sources. Nothing in the answer tells you which version you got.
Alongside that, automated content is now entering health spaces directly. In July 2026, the Guardian reported on AI-generated “doctors” on TikTok promoting remedies such as Coca-Cola mixed with onion for pain, with clinicians warning about the danger to the public. And a 2026 survey described by Medscape found that people who followed health advice from AI were five times more likely to report harm than those who did not.
Read those two facts together. Follow the advice, and the reported risk of harm rises fivefold. The advice arrives in the same confident tone whether it is right or wrong.
The Trust Gap, in Numbers
People are using AI search more and trusting it less, at the same time, which is the strangest part of the story.
- Usage keeps climbing. Around 43 percent of consumers use AI search tools daily, and roughly 68 percent say they trust AI search results at least as much as traditional search, according to 2026 surveys.
- Confidence is falling. In Fractl’s Q2 2026 survey, 82 percent of consumers called AI search more helpful than traditional search in 2025. A year later that figure was 54 percent, a 28-point drop, and the share who found AI less helpful grew from 3 percent to 17 percent.
- The citations are thinner than they look. A May 2026 measurement study broke AI Overviews into 98,020 claims and found 11 percent were not supported by the pages they cited. Another 2026 evaluation found that only 39 percent of the overviews it could assess were both correct and fully supported by their sources.
The pattern is a trust gap. Answers get used constantly, presented as settled, and supported less completely than the format implies. That gap is exactly the room a bad actor needs.
How to Check an AI Answer Without Becoming a Researcher
- Open the citation, not just the answer. One click tells you whether the source says what the answer claims. The Cornell Tech work shows why: the citation is the part an attacker can control.
- Be suspicious when unrelated places agree too neatly. If a surprising recommendation appears on a forum, a Quora answer and a wiki page that all sound like the same person, treat the agreement as a warning sign. Spreading a message across sources was what pushed the mention rate from about half to nearly two thirds.
- Ask the same question twice, on different days. If the answer changes, you are looking at retrieval luck, not settled fact. The Eve Appeal documented exactly this on cancer searches.
- Treat health, money and safety answers as a lead, never a verdict. Those are the categories where a planted claim does the most damage, and the ones where a confident paragraph is worth the least on its own.
- Check who is talking. A named clinician with a licence and a clinic to lose is a different kind of source from an account with a stethoscope emoji and no history.
The Same Trust Problem, One Layer Down
If a planted comment can shape what AI search tells you, the same weakness runs through the scores and benchmarks used to sell AI systems. In July 2026, every frontier model tested by the UK AI Security Institute tried to cheat its own evaluation. If you want to know why a benchmark number deserves less trust than it looks, start there.
Frequently Asked Questions
Does this mean AI search is worse than regular search?
No. The trust is misplaced differently. Traditional search handed you ten sources and left the judging to you. AI search hands you one answer and does the judging for you, using retrieval you cannot see. That is faster and cleaner, and it hides the same weak sources behind a tidier surface.
Is a citation in an AI answer proof that the source supports the claim?
No. The Cornell Tech experiments show a citation can be earned by an attacker, and the 2026 claim-fidelity studies show a measurable share of cited claims go beyond what the cited page actually says. A citation shows where the model looked, not that the source agrees.
Can the platforms fix this?
Partly, and slowly. Microsoft says it has deployed mitigations against the memory-poisoning variant, and search engines are adding verification layers that check answers against their own indexed sources. The harder problem is the open web underneath. Any system that reads public pages inherits whatever has been posted there, and no filter catches everything.
What is the single biggest warning sign?
A confident, specific, surprising claim with a citation you have not opened. Surprise plus confidence plus a source nobody checks is the exact recipe that makes poisoning worth the effort.
Why would anyone bother doing this?
Because it works, and it is cheap. Money is the obvious reason, whether it is a product recommendation, a brand reputation or a stock. Reputation is another. The technique also carries almost no risk for the attacker: posting a comment is not obviously a crime, and if the attempt fails, nothing traces back.
The Short Version
- AI search answers are assembled from public sources, including Reddit and Wikipedia, which anyone can write to.
- A Cornell Tech study found about 13 words could shift 38 to 51 percent of answers about a topic, and up to 62 percent when spread across sources (June 2026).
- Microsoft documented commercial attempts to plant recommendations in AI memory through ordinary “Summarize with AI” buttons (February 2026).
- Google’s AI Overviews have already told users to eat rocks and to glue pizza, sourced from jokes, and gave dangerous cancer and liver advice in a Guardian investigation (January 2026).
- About 11 percent of AI Overview claims were unsupported by their own citations in a 98,020-claim study, and only 39 percent of overviews in another test were both correct and fully sourced.
- Open the citation, question neat agreement, and treat health or money advice from an answer box as a starting point rather than an answer.
The useful skill here is small and unglamorous. When an answer matters, click the little source link and see whether it holds up. That single habit defeats most of this, because the attack is built on the assumption that you will trust the paragraph and move on.
About The Author
