Do AI Search Engines Fact-Check What They Read About Your Brand?

Mostly, no — and a new benchmark now puts numbers on exactly how the checking fails. HAE-GEO, a September 2026 preprint from Zhongan Bi and colleagues, planted 770 fabricated-brand pages per attack level inside a 72,039-page web corpus and let ten search agents research product questions across 8 categories and 154 brands. Agents that encountered a poisoned page endorsed the fake brand in roughly 40% of runs — rising, not falling, to about 50% when the fabrication came dressed in fake ratings, certifications, and user feedback. Strict verification of suspicious evidence happened in about 2% of standard runs.

Key takeaways

Search-augmented agents — the systems behind AI answers and, increasingly, AI-mediated buying research — read the web and act on it. HAE-GEO asks the question every prior manipulation study stopped short of: not can fabricated content reach the agent, but what the agent does across the full trajectory once it has — notice, adopt, verify, recover.

The setup is a controlled sandbox. Ten agents (among them Claude, GPT, Kimi, GLM, Qwen, MiniMax, and DeepSeek models) research product questions through a multi-turn search-and-scrape interface over 72,039 real pages, into which the authors inject 770 poisoned pages per attack level promoting fabricated entities. The three levels escalate the craft:

Endorsement here means the agent's final answer positively framed the fabricated brand, among runs where the poisoned material actually reached the agent. Two readings of that table matter. First, half of exposed runs ending in endorsement is a poor ceiling for systems buyers treat as research assistants. Second — and this is the paper's finding — the gradient runs the wrong way. Better-crafted lies do better, and the defense prompt shifts the whole curve down without flattening it.

The mechanism behind that gradient is the benchmark's most useful export. The authors score whether the agent's reasoning shows any recognition that evidence is planted, on a 0–2 scale. Under standard prompting, recognition falls from 1.02 at L1 to 0.33 at L3 — a two-thirds collapse triggered precisely by the fabrication looking supported. The agent's implicit verification procedure is to check whether sources agree. Manufacture the agreement and you have passed the check.

That should sound familiar, because manufacturing agreement is already an industrial practice on the live web. The Trellner audit we covered in Can You Trust AI Citations? found three cross-linked sites — shared registration window, shared DNS, shared templates — that had published 215,128 generated buying guides, retrieved and cited by Perplexity for software-recommendation queries. One site dressed as a market research firm, one as a statistics portal, one as a review outlet: three "independent" voices, one operator. That is HAE-GEO's L3 attack running in production, aimed at winning recommendations rather than at any single brand's facts — so far.

The trap generalizes beyond attacks, which is why it belongs in a marketer's model of AI search rather than only a security researcher's. An engine that verifies by counting agreeing sources will also misdescribe a brand confidently whenever the web's copies of a fact agree with each other and not with reality — the stale-pricing problem, the old-CEO problem. In the Haus Research audit of Perplexity, answers about who a company's CEO is passed verification only 44.3% of the time, sourced heavily from directories echoing each other. Nobody poisoned anything; the corroboration was just wrong together.

The second finding is quieter and, for anyone hoping the platforms will prompt their way out of this, more damning. HAE-GEO measures verification — the agent actually re-searching or cross-checking a suspicious claim — and finds it at roughly 2% of runs under standard prompting. A caution-oriented defense prompt raises that to roughly 17%, and cuts endorsement by 12–13 points at every level. Progress, bought with 1.82 additional tool calls per query and a 24.5% macro-average increase in token consumption — the kind of latency-and-cost bill that explains why production engines default to not checking.

But the sharper result is what happens after verification. Among defended runs where the agent had already adopted the false claim and subsequently obtained verifying evidence against it, the claim was actually walked back in 81.8% of cases at L1 — falling to 66.7% at L2 and L3. The agent looked, found the contradiction, and a third of the time kept the fabrication in its answer anyway. The authors also isolate agentic search itself (on two models, interactive search versus static retrieval) and find it reduces endorsement without reliably improving recognition: the agent ends up safer without ending up better-informed, which means the safety doesn't transfer to claims the roster of retrieved pages happens to favor.

For the platform side of this arms race — detectors, rerankers, verifiable-content rewards — see Citation Wars. The short version is that targeted defenses work in research settings and none are announced in production. HAE-GEO adds the demand-side half: the answering agents themselves are not running the check either.

The obvious objection is that this is a sandbox, and it is worth spelling out both directions of the gap rather than waving at it.

The benchmark is generous to the attacker in one way: its metrics are conditioned on exposure. Every endorsement rate above counts only runs where poisoned material reached the agent, and the paper does not report how often the 770 poisoned pages won retrieval against 72,039 competitors in the first place. On the live web, getting retrieved is the hard part — our own 42-day volatility study found the domains cited for a prompt churning 60–70% day to day, with the openings concentrated on prompts where no authoritative source exists. Thin-supply categories are where a fabricated source gets its exposure; well-supplied ones are defended by competition before the agent's judgment is ever tested.

But the live web is harsher than the sandbox in the other direction, and here the independent evidence stacks up. Manipulation of production engines is not hypothetical: preference manipulation attacks steered Bing and Perplexity toward attacker products in 2024, and a Harvard study showed a crafted text sequence on a product page reliably promoting it into an LLM's top recommendation. Counter-GEO-Bench measured GEO-injected false claims landing in answers 55.7% of the time, with deployed safety guardrails reducing that by at most 5.7% relative. And the Haus audit found 34.7% of Perplexity's numeric-claim citations pointing at pages that didn't contain the number — the engine does not check whether its own citations support its own sentences, let alone whether the pages are honest. Four independent datasets, one picture: every stage of the pipeline that could catch a corroborated fabrication currently doesn't.

If agents verify by counting agreement, then corroboration is the unit of both attack and defense — and that yields a decision rule you can apply this week.

Inventory your facts by corroboration count, not by page. For each fact a buyer would ask an engine to confirm — pricing, integrations, security posture, outcomes, comparisons — count the independent, crawlable, ungated sources currently stating it. A fact stated only on your own site is one manufactured "corroborating" page away from a coin flip in the agent's judgment; a fact restated across your site, two review platforms, documentation, and a third-party writeup is expensive to out-corroborate. Spend your AEO effort on the single-source facts first. This is the same direction the where-citations-come-from data points for visibility — most citations are third-party — but the reason here is defensive: those third-party restatements are your fact's alibi.

Run the verification step the agents skip. The 2% figure is the operative one: nobody in the pipeline is opening cited pages and checking claims, so the detection layer for a false claim about your brand is whoever reads your tracked answers. That means recording full answer text, not mention counts — a fabricated claim shows up as new wording, and sentiment and description tracking is where it surfaces first. It also means watching the citation set: a fabricated source must be retrieved before it can be believed, so an unfamiliar domain newly cited across your category's prompts is the attack's earliest observable stage, and worth five minutes of provenance checking (registration date, template reuse, publication volume no human produces).

What this doesn't license is manufacturing corroboration of your own. Fake independent restatements are the exact signature the emerging platform-side detectors are trained on, and the mechanism-design work all points the same way: agreement that traces to one operator is the thing being learned as an attack class.

HAE-GEO is a preprint from a single group, not yet peer-reviewed. The corpus is fixed and the retrieval sandboxed, so nothing here measures how often fabricated pages win exposure on the live web — the endorsement rates are ceilings on the judgment stage, not estimates of end-to-end attack success. The poisoned pages promote fabricated entities; defaming or misdescribing a real brand may be easier (the priors are contested) or harder (real corroboration exists to contradict it), and the benchmark doesn't test it. Recognition and recovery are scored by an LLM judge on a 0–2 rubric. And the ten agents are harness-wrapped models, not the production engines with undisclosed guardrail stacks that answer your buyers' questions. Treat the direction as solid — corroboration substitutes for verification, and verification rarely triggers correction — and the decimals as this benchmark's.

Every layer that could fact-check a claim about your brand — retrieval, guardrails, the agent's own verification loop — currently defers to whether the web appears to agree with itself. Making sure it genuinely agrees about you, and noticing quickly when an answer says something new, is the whole defensive playbook available today.

Elmo is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces, storing the full answer text, every cited domain, and every competitor named beside you on every run. Because the raw answers are yours to query, a new claim or an unfamiliar source in your category is a diff, not a discovery in a lost deal.

For the fundamentals, start with how to track your brand in AI search and AI citations. For the adjacent research, see Citation Wars, Can You Trust AI Citations?, and GEO detection. For the vocabulary, the AI search glossary.