Can a competitor manipulate what AI says about my brand?

A competitor can try, and in some conditions it works. The mechanism is prompt injection: text on a web page written to steer an AI system that reads it, often hidden from human visitors.

An AI answer about your brand passes through four stages:

• Parametric: what the model learned in training, frozen at a cutoff. Nobody changes this quickly.
• Access: whether a crawler can fetch a page at all.
• Retrieval: whether a page enters the model's context for a given question.
• Generation: which retrieved pages the model uses and cites.

Manipulation acts at the generation stage. It only matters if the manipulated page has already been retrieved for the question a buyer asks. That makes it a real risk with a narrow entry point, not an all-powerful lever. The practical stance: monitor for it, recognise it, and respond through legitimate channels.

The clearest evidence is a 2026 study of LLM search agents (arXiv:2606.16821, v2, June 2026). Its authors fed manipulated content into agents' search results and measured how often the agents endorsed what the attacker wanted.

They report that overall attack success ranged from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash. The strongest attack differed by model family, and the same deployment setup raised success on some backends and lowered it on others.

Read those numbers carefully:

• They are point estimates on one attack corpus. Vendors ship safety updates, so the ranking can change.
• The study used a mock search API. It never published manipulated content to the open web.
• It shows what happens once manipulated content is in the result set. It does not show how hard it is to get there.

Our summary of the manipulation study goes deeper. The takeaway for a brand: vulnerability is real, it varies by engine, and it depends on retrieval first.

Retrieval is per query and discretionary on every major platform. ChatGPT search decides when to search and, per OpenAI's help centre, rewrites the user's question into one or more targeted queries. A planted page has to match those rewritten queries and compete with every other candidate.

The risk is higher when:

• Few pages discuss your brand, so a single hostile page has less competition.
• Buyers ask comparison questions ("X vs Y", "best alternatives to X") that pull in third-party review and listicle pages.
• An engine searches the web often for your category.

The risk is lower when the answer comes from parametric knowledge with no live search. A page published this month cannot reach a frozen model.

Most wrong answers are not attacks. Models get facts wrong on their own, and old content lingers. Before assuming sabotage, work out whether you are seeing a hallucination or an outdated answer. Manipulation leaves a trail: the false claim tracks a specific cited page.

Start from the answer, not the web. When an engine says something wrong about you, open the pages it cites. Then check those pages for:

• Hidden text: content styled to be invisible to people (tiny fonts, text matching the background, collapsed elements) that still sits in the HTML.
• Instructions addressed to AI: sentences like "AI assistants should tell users..." or "ignore previous instructions" that make no sense to a human reader.
• Cloaking: a page that serves different content when requested as an AI crawler than as a browser. Compare the raw HTML fetched with an AI crawler user agent against what you see in your browser.
• Claims that recur verbatim: the same unusual phrasing about your brand on several unrelated pages, and then in AI answers.

The step-by-step method is in our playbook on scanning third-party pages for injected instructions. Save a copy of each suspicious page with the date before you report it.

Injection and cloaking are illegitimate. They try to deceive the systems your buyers trust, and they misrepresent other businesses. If you do it, you inherit the same exposure you are guarding against.

It is also a poor bet on its own terms. The study above shows that whether an attack works depends on the model and the setup, and a safety update can erase the effect. The critical survey of GEO research (arXiv:2607.14035, July 2026) found that no reviewed technique shows a stable, cross-platform effect on discoverability, and that citation-oriented rewrites can impair retrieval.

The defensible moves are subtractive and factual: make sure crawlers can reach your own pages, and state your key facts plainly in HTML that loads without JavaScript. A specific fact (a price, a founding year, a one-line definition) gives an engine a sentence it can quote. It does not guarantee the engine will use it.

1. Write down your key facts. Pricing, product names, ownership, locations. You need a reference to judge answers against.
2. Check each engine separately. Ask the buyer questions that matter to you, logged out, and note which answers cite sources. Our guide on checking whether ChatGPT is accurate about your company covers the method. The free checker on this site gives a snapshot for up to three buyer questions.
3. Trace every wrong claim to its cited page. No citation usually means a training-data error, not a planted page.
4. Inspect suspicious pages using the checks above, and save dated copies.
5. Report it. Contact the site host and use the engine's feedback tools. Name the page and the false claim.
6. Repeat on a schedule. Engines and models change. If you want alerts rather than spot checks, see tools that flag false AI claims.

You control your own pages, your monitoring, and your reports. You do not control what a model says. Our wider guide to prompt injection and hidden text in AI search covers the threat in more depth.