Black-hat GEO: the manufactured credibility behind AI recommendations
TL;DR: Black-hat GEO manufactures misleading evidence for AI systems to read: fake discussions, bought votes, undisclosed paid placement and invented statistics. Controlled studies demonstrate several manipulation mechanisms. They do not establish how widespread commercial manipulation is. Commissioning deceptive reviews can expose both a business and its agency to liability.
What counts as black-hat GEO
Black-hat GEO is the use of deceptive methods to influence what AI search engines say about a business. It manufactures the evidence the engines read: forum threads written by invented customers, bought upvotes, paid placements presented as independent coverage and statistics nobody measured.
The term borrows from black-hat SEO. Many tactics are familiar, but they can now influence the material an AI system uses to generate an answer. The distinction between legitimate and deceptive work is whether readers are misled about who is speaking, whether they are independent or whether their claims are true.
In June 2026, 404 Media reported that the moderators of r/biohackers had banned new posts about peptides and hormone replacement therapy after alleging covert promotion intended to influence AI search. Their complaint was about companies planting material for chatbots to read, not simply advertising to the community.
Practice | Legitimate version | Deceptive version |
|---|---|---|
Reddit participation | Useful contributions with affiliation disclosed | Posing as independent customers or staging invented conversations |
Reviews | Real experiences collected without prohibited incentives | Invented experiences, concealed incentives or misleading suppression of negative reviews |
Comparison articles | Ownership, criteria and commercial relationships made clear | A controlled ranking presented as independent research |
Research and statistics | Traceable methods, data and limitations | Invented numbers presented as measured findings |
Publications and placements | Accountable authorship and labelled paid placement | Fabricated experts or endorsements, or paid coverage presented as independent |
AI-summary links | A request for an ordinary summary | Concealed instructions to remember or recommend the publisher |
Black-hat GEO tactics being sold
Posts, accounts and engagement. UpvoteShop advertises posting through aged accounts, with optional comments and upvotes, as a route to Reddit and AI-search visibility. Its order page displayed $15 per post when checked on 11 October 2026. This is evidence of an offer, not evidence that the promised AI effect occurs.
Content at scale. RedRover advertises agents that publish blogs, forum posts and comments for search rankings and AI citations, with pricing tied to publishing volume and velocity. Automated publishing alone does not establish deception; invented identities, concealed sponsorship and false claims are the relevant questions.
Invented statistics. Metehan Yeşilyurt reported creating 50,000 fabricated statistics pages on StateGlobe for about $30. The case is examined below.
Hidden instructions. Microsoft documented promotional commands concealed in links presented as ordinary AI-summary tools. The commands attempted to make an assistant remember a publisher as a trusted source.
Manufactured consensus. Repeating a claim through apparently independent accounts can create the appearance of agreement. Whether that repetition separately changes AI recommendations is a different question from whether a service can publish it.
Why Reddit features in AI search manipulation
In Cornell Tech's study, Reddit accounted for 54–71% of the user-generated URLs retrieved by three open-source research agents. Some pages recurred across queries on a topic. That creates a potential point of influence, but the figures do not describe all AI search.
The same study found different citation patterns in OpenAI and Gemini Deep Research. Engine, mode and query choice matter. I have written about how user-generated content shapes AI visibility.
What the evidence shows
Each entry below identifies the source, the finding and what the evidence supports. Controlled mechanisms, live-web demonstrations and observed attempts answer different questions.
Preference manipulation against live search engines
Source: Nestaas, Debenedetti and Tramèr, ETH Zurich. Adversarial Search Engine Optimization for Large Language Models, first published June 2024.
Finding: crafted content influenced production Bing and Perplexity to favour attacker-controlled products over alternatives. The researchers also tested plugin selection through GPT-4 and Claude APIs.
Evidence assessment: controlled evidence involving live systems. It demonstrates influence under the tested conditions, not the prevalence of commercial campaigns or whether the same attacks work on today's versions.
Retrieval poisoning through user-generated content
Source: Zhang, Triedman and Shmatikov, Cornell Tech. Deep-Research Agents Can Be Poisoned via User-Generated Content, May 2026. Figures here refer to the first version.
Finding: in single-URL snippet tests, approximately 13 words of inserted text produced target-entity mentions in 30.7% of Co-STORM runs, 37.1% of STORM runs and 21.7% of OmniThink runs.
Evidence assessment: controlled evidence of retrieval poisoning. Researchers substituted retrieved text and used invented entities in open-source agents. They did not publish the attacks to Reddit or attack ChatGPT; OpenAI and Gemini Deep Research were examined for citation patterns. These tests also distinguish retrieval, citation and a target being mentioned. Getting retrieved is not the same as getting cited.
A fabricated brand against competing narratives
Source: Mateusz Makosiewicz, Ahrefs. I Ran an AI Misinformation Experiment, 10 December 2025.
Finding: he invented the paperweight brand Xarumei, published an official FAQ and planted contradictory stories on a separate site, Reddit and Medium. He tested 56 questions across eight AI products before and after. Several adopted false details; ChatGPT variants resisted better, while Claude failed to retrieve the brand's content.
Evidence assessment: a live-web demonstration with a before-and-after comparison. One invented brand, leading questions, mixed API and interface testing and simultaneous interventions limit the conclusions. It does not isolate Reddit's contribution or predict ordinary buyer queries.
Strategic text on a product page
Source: Kumar and Lakkaraju, Harvard. Manipulating Large Language Models to Increase Product Visibility, April 2024.
Finding: adding a crafted text sequence to product information increased the likelihood of an LLM recommending that product.
Evidence assessment: a controlled demonstration using fictitious coffee machines. It establishes a mechanism within the tested catalogue, not an observed commercial campaign.
Hidden promotional prompts (AI recommendation poisoning)
Source: Microsoft Security. Manipulating AI memory for profit: The rise of AI Recommendation Poisoning, 10 February 2026.
Finding: Microsoft reported more than 50 promotional prompt examples from 31 companies across 14 industries over 60 days. Its demonstration showed a hidden instruction being stored as an assistant memory.
Evidence assessment: documented attempts, with a demonstration of memory alteration. Effectiveness and persistence varied. This targets individual assistants' memory or context; it does not establish a change to the underlying model or recommendations across all users.
StateGlobe: 50,000 fabricated statistics
Source: Metehan Yeşilyurt, writing for Peec AI on 7 October 2026 about a site launched in March. Publish stats, get cited is the author's retrospective, not an independent audit.
Finding: he reported creating 50,000 fabricated statistics pages for about $30, later adding listicles. Seven months after launch, he reported more than 10,000 ChatGPT sessions and 330 referring domains despite a collapse in Google visibility. He also reported reuse in academic and investment publications.
Evidence assessment: an uncontrolled, self-reported case. It documents reported retrieval and reuse, not the causal benefit of fabrication. A later Peec page containing checked, sourced statistics also attracted links. That suggests fabrication was unnecessary, but it was not a matched comparison and does not establish equal performance. The case shows that false data can propagate; it does not prove that every model fails to check every claim.
Manufactured consensus: not isolated in this research
Several planted sources can make a claim appear independently corroborated. That is a plausible mechanism. I found no study isolating the effect of repeated seeded discussions from other changes such as new pages, wording or prompt choice. A plausible explanation should not be sold as a demonstrated result.
Training-data contamination: not demonstrated by these cases
Poisoned pages might eventually enter training data, but none of these cases establishes that path or its effect on a later model. Retrieval, assistant memory and model training are separate mechanisms.
The missing measurement: prevalence
These sources document mechanisms, attempts and individual cases. They do not establish what share of AI recommendations has been commercially manufactured. Evidence that manipulation can work is not a measurement of how often buyers encounter it.
What happens if your business participates
Legal. UK fake-review prohibitions took effect on 6 April 2025. CMA guidance covers writing and commissioning fake reviews and concealed incentivised reviews, and warns that both clients and agencies can break the law. Misleading practices can attract fines of up to 10% of global turnover. Other rules address hidden advertising and falsely posing as a consumer. The applicable rule depends on the conduct; not every paid post is a review.
Platform. Reddit's 6 July 2026 announcement reported catching about 25,000 additional spam posts and comments and revoking nearly 2 million inauthentic votes daily. These are platform-wide figures, not counts of GEO campaigns. Removal can disrupt a campaign, but an engine's cache or citations may not update immediately.
Reputational. A staged recommendation that becomes public leaves the business explaining why it commissioned it. An agency contract cannot make customers regard that as somebody else's problem.
What you can do about it
Start by mapping the questions your buyers ask. Record what the engines say about your business and open the cited pages. Check the claim, the source's relationship to the business and whether apparently separate sources repeat one origin.
Those checks can identify inaccuracies and disclosure gaps. They cannot reliably prove that a competitor commissioned manipulation. Similar wording, coordinated-looking activity and repeated citations are reasons to investigate, not verdicts.
My AI readiness and buyer journey audit examines how AI describes your business, what your own pages make clear, and whether a buyer can verify the recommendation and take the next step.
Part 2 examines what an AI citation guarantee actually commits an agency to deliver, and what you should ask before signing.
Frequently asked questions
What is black-hat GEO?
Black-hat GEO is the use of deceptive methods to influence what AI search engines say about a business. It manufactures the evidence the engines read, such as forum threads written by invented customers, bought upvotes, paid placements presented as independent coverage and statistics nobody measured.
How does black-hat GEO differ from legitimate GEO?
The difference is whether readers are misled about who is speaking, whether the source is independent and whether the claims are true. Disclosed participation on Reddit, labelled paid placement and statistics with traceable methods are legitimate. Posing as independent customers or publishing invented numbers as measured findings is deceptive.
Does black-hat GEO work?
Controlled studies show that manipulation can influence AI systems under the tested conditions, including live Bing and Perplexity. No study measures how widespread commercial manipulation is, and the tactic agencies most often sell, manufactured consensus, has not been tested on its own.
Is black-hat GEO illegal in the UK?
Parts of it can be. UK fake-review prohibitions took effect on 6 April 2025, and CMA guidance covers writing and commissioning fake reviews and concealed incentivised reviews. The guidance warns that both clients and agencies can break the law. Which rule applies depends on the conduct, because not every paid post is a review. This is a summary, not legal advice.
What is AI recommendation poisoning?
Microsoft uses the term for promotional instructions hidden in links presented as ordinary AI-summary tools, which try to make an assistant remember a publisher as a trusted source. Microsoft reported more than 50 examples from 31 companies across 14 industries over 60 days. The effect targets an individual assistant's memory or context and has not been shown to change the underlying model.
Can I tell whether a competitor is manipulating AI answers?
Not reliably. Recording what the engines say, opening the cited pages and checking whether apparently separate sources repeat one origin can reveal inaccuracies and disclosure gaps. Similar wording, coordinated-looking activity and repeated citations are reasons to investigate, not verdicts.
The AI Visibility Scan shows what AI search says about your business and which pages it cites.
Comments