Do AI Search Engines Fact-Check What They Read About Your Brand?
A new 72,000-page benchmark fed fabricated brand claims to ten search agents: they endorsed the fake brands in 40–50% of exposed runs and verified suspicious evidence in about 2%. Corroboration, not truth, is what the agents check.
Updated · Published
Frequently asked questions
Do AI search engines verify claims before repeating them?
Rarely. In the HAE-GEO benchmark, ten search agents given a multi-turn search-and-scrape interface issued a strict verification of suspicious evidence in roughly 2% of standard runs. Real-engine audits agree: a September 2026 audit of Perplexity found 34.7% of citations attached to numeric claims pointed at pages that didn't contain the number, with no sign the engine checks whether a cited page supports the sentence it decorates.
How often do AI agents fall for fabricated brand claims?
In HAE-GEO, agents that encountered a poisoned page endorsed the fabricated brand in about 40% of runs when the page made a direct assertion, rising to about 50% when the fabrication came with manufactured corroboration — ratings, certifications, reports, and user feedback. A caution-oriented system prompt lowered those rates to roughly 28% and 38% but did not change the shape: more corroboration, more endorsement.
How do you tell a manufactured source from a real one?
Check registration date, publication volume, template reuse, whether the site covers categories that do not exist, and whether ownership is disclosed. The three-site network cited by Perplexity for software recommendations failed all five — shared DNS and templates, 215,128 generated guides, guides for impossible categories, and no named owner — while passing the only test the agent ran, which was looking like several sources agreeing.
Can a competitor plant false claims about my brand in AI answers?
The benchmark tested fabricated brands rather than attacks on real ones, so the rate is unmeasured. The mechanism transfers: an agent that verifies by counting agreeing sources will adopt a claim that arrives with manufactured agreement. Real corroboration of your own facts is the only defense the research supports, and manufacturing your own is the signature that platform-side detectors are being trained on.
What is the corroboration trap in AI search?
Agents treat agreement between sources as verification. When HAE-GEO upgraded direct false assertions to fabrications supported by fake ratings, certifications, and user feedback, agents' poison-recognition scores fell from 1.02 to 0.33 on a 0–2 scale — the corroborated lie was endorsed more and recognized less. Manufacturing that agreement is already practiced on the live web: one audited network published 215,128 templated buying guides across three cross-linked sites.
Can a system prompt make AI agents resistant to poisoned evidence?
Partially, at a price. A defense prompt in HAE-GEO cut fake-brand endorsement by 12–13 points at every attack level and raised verification behavior from about 2% to about 17% of runs — while adding 1.82 tool calls per query and 24.5% more tokens on average. But verifying didn't reliably mean recovering: among defended runs that adopted a false claim and later verified it, only 66.7–81.8% actually walked the claim back.
How do I protect my brand from fabricated claims in AI answers?
Two moves. First, make your true facts better-corroborated than a fabrication can be: state each key fact on a canonical, crawlable page and earn independent restatements on surfaces engines already cite, because agreement across sources is the only check agents reliably run. Second, monitor the answers themselves — full text, not mention counts — and treat any new claim or unfamiliar cited domain as something a human opens and verifies within days.
Is evidence poisoning happening on the real web or just in benchmarks?
Both mechanisms are documented separately. The benchmark results are sandboxed — HAE-GEO's 770 poisoned pages per level compete inside a fixed 72,039-page corpus. But manipulation of production engines was demonstrated on Bing and Perplexity as early as 2024, a 2026 benchmark found GEO-injected false claims landing in answers 55.7% of the time with safety guardrails cutting that by at most 5.7% relative, and a three-site network had published over 215,000 machine-targeted buying guides that Perplexity retrieved and cited. The pieces of the attack all exist in production; the benchmark measures how the agent behaves once they connect.
Mostly, no — and a new benchmark now puts numbers on exactly how the checking fails.HAE-GEO, a September 2026 preprint from Zhongan Bi and colleagues, planted 770 fabricated-brand pages per attack level inside a 72,039-page web corpus and let ten search agents research product questions across 8 categories and 154 brands. Agents that encountered a poisoned page endorsed the fake brand in roughly 40% of runs — rising, not falling, to about 50% when the fabrication came dressed in fake ratings, certifications, and user feedback. Strict verification of suspicious evidence happened in about 2% of standard runs.
Corroboration beats truth. Agents' ability to recognize planted evidence collapsed from 1.02 to 0.33 (on a 0–2 scale) as direct assertions were upgraded to fabrications with manufactured supporting material. Agreement between sources is what agents treat as verification.
Verification is close to absent by default — about 2% of runs — and a caution-oriented system prompt raised it only to about 17%, at a cost of 1.82 extra tool calls and 24.5% more tokens per query.
Checking is not correcting. Even among defended runs that adopted a false claim and then verified it, only 66.7–81.8% walked the claim back. The paper calls this the verification-to-recovery gap.
This reconciles with what real-engine audits keep finding: 34.7% of Perplexity's numeric-claim citations didn't support the sentence they decorated, and GEO-injected false claims passed off-the-shelf guardrails with at most a 5.7% relative reduction.
The attack's raw material already exists in production: a three-site network with 215,128 templated buying guides was retrieved and cited by Perplexity in September 2026. HAE-GEO's contribution is measuring what the agent does when that material reaches it.
The defense you control follows from the mechanism: make your true facts more corroborated than a fabrication can afford to be, and run the verification step yourself by monitoring what answers actually say.
Search-augmented agents — the systems behind AI answers and, increasingly, AI-mediated buying research — read the web and act on it. HAE-GEO asks the question every prior manipulation study stopped short of: not can fabricated content reach the agent, but what the agent does across the full trajectory once it has — notice, adopt, verify, recover.
The setup is a controlled sandbox. Ten agents (among them Claude, GPT, Kimi, GLM, Qwen, MiniMax, and DeepSeek models) research product questions through a multi-turn search-and-scrape interface over 72,039 real pages, into which the authors inject 770 poisoned pages per attack level promoting fabricated entities. The three levels escalate the craft. Endorsement rate of fabricated brands by attack sophistication, ten search agents, HAE-GEO benchmark, September 2026:
Level
Technique
Endorsement rate (base prompt)
Endorsement rate (defense prompt)
L1 — direct assertion
The false claim, stated plainly
~40%
~28%
L2 — contextual camouflage
The claim embedded in plausible surrounding content
~48%
~35%
L3 — apparent corroboration
The claim plus fake ratings, certifications, reports, user feedback
~50%
~38%
Endorsement here means the agent's final answer positively framed the fabricated brand, among runs where the poisoned material actually reached the agent. Two readings of that table matter. First, half of exposed runs ending in endorsement is a poor ceiling for systems buyers treat as research assistants. Second — and this is the paper's finding — the gradient runs the wrong way. Better-crafted lies do better, and the defense prompt shifts the whole curve down without flattening it.
The mechanism behind that gradient is the benchmark's most useful export. The authors score whether the agent's reasoning shows any recognition that evidence is planted, on a 0–2 scale. Under standard prompting, recognition falls from 1.02 at L1 to 0.33 at L3 — a two-thirds collapse triggered precisely by the fabrication looking supported. The agent's implicit verification procedure is to check whether sources agree. Manufacture the agreement and you have passed the check.
That should sound familiar, because manufacturing agreement is already an industrial practice on the live web. The Trellner audit we covered in Can You Trust AI Citations? found three cross-linked sites — shared registration window, shared DNS, shared templates — that had published 215,128 generated buying guides, retrieved and cited by Perplexity for software-recommendation queries. One site dressed as a market research firm, one as a statistics portal, one as a review outlet: three "independent" voices, one operator. That is HAE-GEO's L3 attack running in production, aimed at winning recommendations rather than at any single brand's facts — so far.
The trap generalizes beyond attacks, which is why it belongs in a marketer's model of AI search rather than only a security researcher's. An engine that verifies by counting agreeing sources will also misdescribe a brand confidently whenever the web's copies of a fact agree with each other and not with reality — the stale-pricing problem, the old-CEO problem. In the Haus Research audit of Perplexity, answers about who a company's CEO is passed verification only 44.3% of the time, sourced heavily from directories echoing each other. Nobody poisoned anything; the corroboration was just wrong together.
The second finding is quieter and, for anyone hoping the platforms will prompt their way out of this, more damning. HAE-GEO measures verification — the agent actually re-searching or cross-checking a suspicious claim — and finds it at roughly 2% of runs under standard prompting. A caution-oriented defense prompt raises that to roughly 17%, and cuts endorsement by 12–13 points at every level. Progress, bought with 1.82 additional tool calls per query and a 24.5% macro-average increase in token consumption — the kind of latency-and-cost bill that explains why production engines default to not checking.
But the sharper result is what happens after verification. Among defended runs where the agent had already adopted the false claim and subsequently obtained verifying evidence against it, the claim was actually walked back in 81.8% of cases at L1 — falling to 66.7% at L2 and L3. The agent looked, found the contradiction, and a third of the time kept the fabrication in its answer anyway. The authors also isolate agentic search itself (on two models, interactive search versus static retrieval) and find it reduces endorsement without reliably improving recognition: the agent ends up safer without ending up better-informed, which means the safety doesn't transfer to claims the roster of retrieved pages happens to favor.
For the platform side of this arms race — detectors, rerankers, verifiable-content rewards — see Citation Wars. The short version is that targeted defenses work in research settings and none are announced in production. HAE-GEO adds the demand-side half: the answering agents themselves are not running the check either.
The obvious objection is that this is a sandbox, and it is worth spelling out both directions of the gap rather than waving at it.
The benchmark is generous to the attacker in one way: its metrics are conditioned on exposure. Every endorsement rate above counts only runs where poisoned material reached the agent, and the paper does not report how often the 770 poisoned pages won retrieval against 72,039 competitors in the first place. On the live web, getting retrieved is the hard part — our own 42-day volatility study found the domains cited for a prompt churning 60–70% day to day, with the openings concentrated on prompts where no authoritative source exists. Thin-supply categories are where a fabricated source gets its exposure; well-supplied ones are defended by competition before the agent's judgment is ever tested.
But the live web is harsher than the sandbox in the other direction, and here the independent evidence stacks up:
Whether Perplexity's cited pages contain the numbers cited
34.7% of numeric-claim citations didn't
Four independent datasets, one picture: every stage of the pipeline that could catch a corroborated fabrication currently doesn't. The engine does not check whether its own citations support its own sentences, let alone whether the pages are honest.
If agents verify by counting agreement, then corroboration is the unit of both attack and defense — and that yields a decision rule you can apply this week.
For each fact a buyer would ask an engine to confirm — pricing, integrations, security posture, outcomes, comparisons — count the independent, crawlable, ungated sources currently stating it. A fact stated only on your own site is one manufactured "corroborating" page away from a coin flip in the agent's judgment; a fact restated across your site, two review platforms, documentation, and a third-party writeup is expensive to out-corroborate. Spend your AEO effort on the single-source facts first. This is the same direction the where-citations-come-from data points for visibility — most citations are third-party — but the reason here is defensive: those third-party restatements are your fact's alibi.
The 2% figure is the operative one: nobody in the pipeline is opening cited pages and checking claims, so the detection layer for a false claim about your brand is whoever reads your tracked answers. That means recording full answer text, not mention counts — a fabricated claim shows up as new wording, and sentiment and description tracking is where it surfaces first. It also means watching the citation set: a fabricated source must be retrieved before it can be believed, so an unfamiliar domain newly cited across your category's prompts is the attack's earliest observable stage, and worth five minutes of provenance checking (registration date, template reuse, publication volume no human produces).
What this doesn't license is manufacturing corroboration of your own. Fake independent restatements are the exact signature the emerging platform-side detectors are trained on, and the mechanism-design work all points the same way: agreement that traces to one operator is the thing being learned as an attack class.
A fabricated source has to be retrieved before it can be believed, so an unfamiliar domain newly cited across your category's prompts is the earliest stage of the attack you can actually observe. Five checks take about five minutes:
Registered recently, often in a cluster with its "independent" corroborators
Publication volume
Site's own index or sitemap count
Six figures of pages no editorial team could produce
Template reuse
Compare two pages in different categories
Identical structure with the nouns swapped
Impossible coverage
Search the site for a category that doesn't exist
A confident buying guide for it anyway
Ownership disclosure
About page, imprint, author bios
Named "researchers" with no traceable existence, no company behind them
The three-site network in the Trellner audit failed all five. What it passed was the only test the agent was running: it looked like several sources agreeing.
HAE-GEO is a preprint from a single group, not yet peer-reviewed. The corpus is fixed and the retrieval sandboxed, so nothing here measures how often fabricated pages win exposure on the live web — the endorsement rates are ceilings on the judgment stage, not estimates of end-to-end attack success. The poisoned pages promote fabricated entities; defaming or misdescribing a real brand may be easier (the priors are contested) or harder (real corroboration exists to contradict it), and the benchmark doesn't test it. Recognition and recovery are scored by an LLM judge on a 0–2 rubric. And the ten agents are harness-wrapped models, not the production engines with undisclosed guardrail stacks that answer your buyers' questions. Treat the direction as solid — corroboration substitutes for verification, and verification rarely triggers correction — and the decimals as this benchmark's.
Every layer that could fact-check a claim about your brand — retrieval, guardrails, the agent's own verification loop — currently defers to whether the web appears to agree with itself. Making sure it genuinely agrees about you, and noticing quickly when an answer says something new, is the whole defensive playbook available today.
Elmo is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces, storing the full answer text, every cited domain, and every competitor named beside you on every run. Because the raw answers are yours to query, a new claim or an unfamiliar source in your category is a diff, not a discovery in a lost deal.