8 of 10 AI Search Tools Cited a Fake Concept in a Week, Just Not From a Blog
Fudan University researchers planted posts about a made-up "Cactus Gravity Protocol" on sites like Medium and YouTube, and 8 of 10 AI search tools, including ChatGPT, Perplexity, Grok and Google AI, cited it within a week. The more useful finding is about placement: 40 posts on a self-hosted WordPress site got zero AI citations in seven days.
That second number is the one I keep coming back to. Most GEO plans I see right now amount to "publish more on our own blog and wait for the AI to notice." This paper suggests the AI mostly isn't looking there, at least not on a one-week clock.
How the fake concept got in
The study, posted to arXiv on October 8 by Qi Liu, Geng Hong and colleagues, ran in two stages. In March the team pushed 120 questions through 10 AI search tools (four English-web tools and six Chinese-web tools such as Doubao and DeepSeek) and logged which sites each one cited. The citation pools turned out to be narrow and pretty predictable. Per Search Engine Journal's write-up, Reddit topped the list for Google AI and Grok, YouTube for Perplexity, and Wikipedia for ChatGPT. Six to 10 of each tool's top 10 cited sites accept posts from ordinary users.
In April they checked 22 posting platforms for how easy it was to sign up and publish. Medium, GitHub, LinkedIn and Facebook were easy. Reddit was harder, mostly because of karma requirements and aggressive deletions (anyone who has tried to seed a brand thread on Reddit already knows this part).
Then they picked each tool's most-cited site that a brand-new account could post on, wrote ChatGPT-drafted, human-edited posts about three topics with fabricated names and numbers baked in, and queried every tool five times a day for a week.
The results, from first citation through day 7:
- Grok: linked the planted posts in 30 of 32 answers and repeated a fabricated detail in 53% of them
- Google AI: 15 of 33 answers, planted detail repeated in 6%
- Perplexity: 13 of 35 answers, planted detail repeated in 0%
- ChatGPT: 7 of 20 answers, planted detail repeated in 10%
Across all 10 tools and all three topics, 176 of 1,004 answers linked to the posts. One caveat the authors flag themselves: the paper doesn't say which Google AI product it tested, so don't read the 15-of-33 number as an AI Overviews benchmark.
The WordPress result is the real story
The follow-up experiment is the part marketers should care about. The team took five obscure vacation destinations and posted about each one twice: once on a source the AI tools cite often, and once on a source they rarely cite. The frequently cited source produced the first citation every time. On the rarely cited side, the best case took 20 posts. A self-hosted WordPress site with 40 posts got nothing in seven days.
Think of it like a rumor in an office. Say it once in the kitchen where everyone gets coffee and it's around the building by lunch. Say it 40 times in your own office with the door shut and nobody hears it.
Now, a week is a short window. Owned content almost certainly gets indexed and cited eventually, and the paper doesn't claim otherwise. But if you're judging a GEO program on 30-day movement in an AI visibility dashboard, the channel you publish on seems to matter more than how much you publish.
Volume did show some association with citations. On Sohu, six fictional subjects with 1 to 20 posts each saw total citations climb from 24 to 128. The authors are careful to call that an association, not proof. And ChatGPT never cited those Sohu posts at all, which tells you each engine has its own taste.
Where I'd move the GEO budget
This lines up with what we covered last week, when ChatGPT's API turned out to miss 77% of the pages ChatGPT actually cites. Every engine has a different short list of trusted domains, and the short lists don't overlap much. So here's what I'd do this week, assuming you have a GEO line item at all:
- Pull your engine-by-engine citation list. Run 20 of your money queries through ChatGPT, Perplexity, Google AI Mode and Grok. Log every cited domain. It takes about an hour with a spreadsheet. If YouTube shows up in Perplexity's answers and you have no YouTube presence, that's your gap.
- Repurpose before you produce. Take your three best owned posts and republish condensed versions on whichever platform shows up most in step 1 (Medium and LinkedIn are the easy ones per the paper). Canonical back to the original where the platform allows it.
- Set a benchmark. Re-run the same 20 queries 14 days later. If the third-party versions haven't picked up at least one citation, I'd treat the platform as a weak fit for your category and try the next one.
Personally, I'd shift something like 30% of next quarter's owned-blog content budget toward third-party distribution and see what moves. Not all of it. Owned content still does SEO work and still converts. But the "40 posts, zero citations" result is hard to ignore.
Don't read this as a how-to for fake mentions
I want to be careful here, because the obvious bad takeaway is "great, flood Medium." The paper also bought a $14 package from a Chinese GEO vendor that delivered 13 posts in about 28 minutes, and Doubao cited one with a planted detail within an hour. That's the cheap end of the manipulation market, and it works for now.
It also violates Google's rules. Google clarified in May that its spam policies apply to AI Overviews and AI Mode, and the spam policies themselves now name attempts to manipulate generative AI responses. Google's AI optimization guide puts it more dryly: seeking inauthentic "mentions" across the web "isn't as helpful as it might seem."
Isn't as helpful as it might seem. Meanwhile Grok was citing a fictional protocol in 30 of 32 answers.
So the policy and the reality don't match yet. Real content on a platform engines already trust is fine. Sockpuppet posts at volume are scaled content abuse with an extra step, and we've already seen Anthropic name the same tactic in its usage policy. I'd expect at least two of the four major English-language engines to visibly tighten how they weight brand-new accounts on open platforms within 12 months, and anyone who built a program on fake mentions will lose it overnight.
The defensive half nobody budgets for
Flip the experiment around. If a stranger can get a fabricated detail about a fictional keyboard into an AI answer, someone can probably get one about your product in there too. A competitor, a disgruntled ex-customer, a vendor running $14 packages for someone else.
And to be fair, the evidence on real brands is thin. The paper only tested fictional topics, and none of the four English-web tools cited the fictional keyboard posts within the week, which might mean product categories with real competition are harder to poison. Or it might just mean the keyboard posts were worse. The authors admit topic, competition and question type all shifted together, so they can't separate them. This is similar to what an earlier Cornell Tech paper on poisoning research agents found in simulation, where about 13 words of planted text on a recurring page got an attacker's entity into 38% to 51% of reports.
The cheap defense is a weekly check. Ten branded queries ("is [brand] legit," "[brand] vs [competitor]," "[brand] pricing") across the four big engines, every Monday, logged in a sheet with the cited URLs. Fifteen minutes. If a domain you've never heard of starts showing up as a source for claims about your pricing, you want to know in week one, not month three.
The kitchen, not the office
None of this is entirely new, honestly. SEO has always rewarded being mentioned in places people already trust. What's different is the speed and how few posts it takes, and that the same mechanism works just as well against you. I don't think most teams need a new GEO tool for this. They probably need a spreadsheet, a Medium account and the discipline to check it every Monday.
