AI Didn't End Manipulation. It Changed Where It Happens.

AI did not make manipulation of online visibility disappear. The companies building AI search and assistants already document attempts to influence what their systems say, which sources they use and what their agents do.

What has changed is the landscape. For many businesses, traditional search had one overwhelmingly important target: Google. AI-mediated discovery does not yet have an equivalent single visibility mechanism, so a tactic that works against one AI system may not carry over to the next.

That shift matters commercially. Search optimization covered a great deal of legitimate work, from technical accessibility and site structure to content quality, relevance and reputation, and it also attracted spam.

Other search engines and discovery channels always existed, but Google’s dominance meant a tactic that moved its rankings could move a lot of commercial reach.

AI-mediated discovery is more fragmented. The useful question is less whether AI can be manipulated (it can) and more where manipulation happens, and how far any one tactic can travel.

Manipulation Didn’t Disappear

The clearest evidence comes from the companies running these systems.

Google’s spam policies now define spam to include “attempting to manipulate generative AI responses in Google Search.” Google says sites that violate its policies may rank lower or not appear in results at all.

OpenAI describes prompt injection, where content an AI encounters tries to change what the AI does.

Its own example is commercial: someone asks an AI to research apartments, and it is “prompt injected to recommend a listing that isn’t the best option for you.” OpenAI calls prompt injection a security challenge it expects to keep evolving.

Anthropic treats malicious instructions hidden in web content as a central risk for AI agents that browse. It says prompt injection is “far from a solved problem, particularly as models take more real-world actions.”

The providers themselves are treating this as an active risk, not merely a theoretical one.

There Is No Single AI Visibility Mechanism

For many businesses, search manipulation had one dominant target. AI discovery is spread across many experiences: a buyer might meet a business through Google’s AI features, ChatGPT, Perplexity, Claude, Copilot or an assistant built into some other product.

These can rely on different underlying models, search providers and indexes. They can also differ in how they interpret a question, how they are instructed, how they choose sources and how they put an answer together.

The commercial implication is simple. A tactic that influences one AI experience is not automatically a tactic that works across AI discovery.

It may be harder to scale one manipulation tactic reliably across a fragmented AI-discovery environment. That does not mean any individual AI system is harder to manipulate.

Fragmentation may make a tactic less portable and less dependable at scale. It does not protect any particular system.

Even the Same Provider Can Behave Differently

Fragmentation doesn’t only run between companies. Google says AI Overviews and AI Mode “may use different models and techniques, so the set of responses and links they show will vary.”

Perplexity combines web search with models built by Perplexity and by other providers. Which models a user can choose depends on their plan and mode, and Perplexity notes that its models are subject to change.

Products change over time too, so “the AI algorithm” isn’t a useful singular idea, even inside one company.

Manipulation Can Happen at Different Layers

Because AI discovery involves several stages, manipulation can aim at several of them. It can target the content on a page or the wider information environment around a business, how sources are retrieved and selected, the answer that gets generated, or the behavior of an AI agent acting for a user.

Some attempts adapt conventional spam to generative search. Others try to plant instructions for the model rather than information for the reader.

That is why “gaming AI” isn’t one tactic, and why a label like “black-hat GEO” can hide more than it explains. A fabricated review network, misleading structured data and a hidden instruction in a webpage target different things and meet different defenses.

Fragmentation is not complete isolation. Where different systems draw on overlapping public sources, such as the same publishers, databases, directories and forums, changes to those sources could potentially affect more than one downstream experience.

That is an inference rather than something documented, but it is a reason not to overstate the protection fragmentation offers.

Where Optimization Becomes Manipulation

Not every attempt to improve AI visibility is manipulation. Much of the legitimate work is making real evidence easier to understand.

Clearer authorship, accurate structured data and better-organized information belong in that category. So do relevant first-party evidence, accurate sourcing and clearly stated relationships between a business, its people and its services.

None of this creates anything that wasn’t already there. It makes what exists easier for a person or a system to identify.

Some cases sit clearly at either end. Making true information clearer is plainly legitimate. Fabricating evidence is plainly manipulative, and so are hidden instructions that try to override what a user asked for and force a particular recommendation. Providers already treat those instructions as an attack.

The difficult territory lies between those poles, and truthfulness alone doesn’t settle it.

Recent research makes this point sharply. A September 2026 preprint, not yet peer reviewed, studied malicious generative engine optimization: rewriting web documents to match a generative search engine’s citation preferences, and so manipulate the answers it produces.

The researchers found that the rewritten documents can remain factually consistent with the originals. They need not contain false statements or hidden instructions, which is why fact-checking offers little protection.

In the authors’ words, optimization and manipulation “differ in intent rather than mechanism.”

Manipulation, in other words, doesn’t necessarily require false information. A page can remain accurate while being engineered mainly to distort a system’s judgment about what deserves to be selected or cited.

That makes the gray area harder to read.

If wording changes only because a model appears to cite that phrasing more often, is that optimization or manipulation?

If a company publishes pages whose only purpose is to trigger particular AI answers, who are those pages for?

If third-party placements are arranged mainly to create the appearance of independent authority, what is being optimized: the evidence, or the appearance of it?

There is no settled industry definition, and pretending otherwise wouldn’t help anyone.

The research suggests the question is less whether each statement is true and more what the work is for. Helping a person or a system understand what is actually there is one thing. Steering a system’s judgment beyond what the underlying evidence would earn is another.

That boundary is becoming commercially important, and it applies to outside agencies and vendors as much as to in-house teams. A business should know what is being done in its name.

Providers Are Fighting Back, but Not in the Same Way

Google is the most useful comparison because it has a mature, public anti-spam regime. Over many years it has told publishers which practices it considers manipulative, including scaled content abuse, cloaking, link spam and site reputation abuse, and what may follow.

It now applies those policies to generative AI responses in Search. That is relative transparency about prohibited behavior, not a full account of how Google detects it.

OpenAI and Anthropic discuss manipulation mainly as a security problem for their models and agents.

OpenAI describes safety training to help models recognize prompt injections, automated monitoring, red-teaming and user controls. Anthropic describes training Claude to resist injected instructions and using classifiers to scan untrusted content.

As of October 2026, the public materials we reviewed from both focus primarily on that security work rather than a publisher-facing visibility framework comparable with Google’s.

Perplexity publicly explains how its search products use web sources and different underlying models, but in our October 2026 review we did not find a comparable publisher-facing anti-manipulation framework.

The providers are defending against manipulation, but they are not all defining or policing it in the same public way. That is a sign of how early this environment still is.

Why Real Evidence Still Matters

It would be convenient to say manipulation fails because AI can detect fake authority. We don’t know that, and the providers don’t claim it.

A tactic might affect whether content is retrieved, whether a source is cited, whether a business is mentioned or how an answer is framed. None of those outcomes creates expertise, completed work, customer results, professional experience or credible third-party validation.

Visibility can potentially be manipulated. Authority still has to exist. AI can make real authority more visible, but it can’t supply the authority itself.

There is also a practical reason to prefer real evidence. Completed projects, public records, recognized credentials, original research, credible coverage and professional associations exist independently of any one platform. They are less dependent on one system’s current behavior than an exploit designed around that behavior.

When a model, mode or retrieval method changes, the exploit may stop working. The evidence is still there. That doesn’t guarantee real evidence will outperform manipulation. It means the evidence doesn’t depend on today’s system behavior to remain true.

A Problem Spread Across More Systems

AI didn’t eliminate manipulation. It spread the problem across more systems, and across defenses that don’t all work the same way. That can make individual tactics less portable without making any individual system manipulation-proof.

The industry’s definition of where legitimate optimization ends and manipulation begins will continue to evolve as providers develop their policies and defenses.

For a business, the durable question is whether the evidence being made more visible is real enough to hold up when the system, model or retrieval method changes.