AI search optimization should make information accurate, useful, and accessible. Deceptive content can mislead both readers and automated systems. This chapter describes practices to avoid and a process for investigating false claims about a business.
Deceptive practices
Indirect prompt injection. Retrieved pages can contain instructions intended to alter an assistant’s behavior. The cited security research describes this attack class. Instructions embedded in source content should be treated as untrusted data by the consuming system.Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, the paper that named and systematized the attack class.
Manipulative text sequences. Research has tested specially constructed strings intended to change recommendations. A result in one experimental setup does not establish reliable behavior in another model or product.Manipulating Large Language Models to Increase Product Visibility, which demonstrates the effect on a catalog of fictitious coffee machines, moving a rarely recommended product into the top slot.
Deceptive cloaking. Serving materially different information to crawlers and users for manipulation can violate search policies. Verify that important claims and conditions are consistent across the page representations.Google's spam policies define cloaking, site reputation abuse, and scaled content abuse, with manual actions as the enforcement mechanism.
Fabricated reviews and participation. Do not invent customer accounts, reviews, or independent endorsements. Disclose relevant business relationships and follow the platform’s rules.
Abusive placements and link networks. Evaluate third-party publishing arrangements against the relevant search policies. A host’s reputation does not make misleading or low-value content useful.
Implementation changes and enforcement
A tactic that depends on a particular implementation can stop working when that implementation changes. The timing and enforcement cannot be predicted reliably. Do not promise durability for either manipulative tactics or legitimate visibility gains.
Search providers, publishers, and infrastructure services apply different policies. Read the policy relevant to the proposed action. Public disputes about access should not be treated as a universal account of every crawler.Cloudflare's August 2025 report, Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives. Cited here as evidence that infrastructure providers police crawling norms, whatever the merits of each side's account.
Reviewing a proposed tactic
Publish comparisons with verifiable claims and a clear commercial relationship. Explain customer requirements accurately. Improve structure where it helps readers and retrieval tools understand the page.
Reject tactics that require fabricated evidence or concealed instructions. A disclosure does not make an inaccurate claim acceptable.
Investigating false claims
False information can originate from a malicious source, an outdated page, or a model error. Investigate the source before attributing intent.
Save the exact incorrect answer, prompt, date, and citations. Verify the relevant source passages. Request corrections through appropriate channels and maintain accurate information on your own pages. Recheck the original prompts under comparable conditions.
A model can invent or distort claims that your organization never published. An approved-claims list helps control your own content; it cannot constrain every generated answer. Record material errors for the relevant internal review.