The Brand Risk Almost Nobody Is Defending In AI Search.

A buyer asks ChatGPT whether your product is any good, and the answer comes back wrong. Maybe it invents a founding date, credits you with a service you have never sold, or repeats a complaint a competitor seeded six months ago. You never see the query, the buyer never reads your rebuttal, and the deal disappears before anyone on your team hears about it. With more than 40% of B2B software discovery now starting as a conversational query to an answer engine, according to Steakhouse, a confident wrong answer often becomes the first and only impression a buyer forms of you.

Almost everyone working in GEO right now is playing offense. The whole field is built around getting cited and getting recommended. Defensive GEO is the other half of the job, and it is a near-total blind spot. When an AI assistant surfaces a harmful or inaccurate story about your brand, somebody has to notice it, understand why it stuck, and push the correct version back into the model's sources. That work has almost no playbook, which is exactly why it pays to get ahead of it now.

Two different threats wear the same mask

The first threat is the model getting you wrong on its own. AI hallucination happens when a model fills a gap with something plausible and false, drawing on incomplete or outdated training data. In practice that looks like an invented pricing tier, a wrong headquarters city, or a product line you discontinued years ago presented as current. Nobody is attacking you. The model simply does not have a clean, consistent record of who you are, so it improvises, and it does so with the same fluent confidence it uses for facts it actually knows.

The second threat is deliberate. Competitors and bad actors now plant content specifically designed to answer negative questions about you. Similarweb documents articles written as "5 Reasons We Left TechFlow Solutions" or cautionary blog posts that become the AI's preferred source the moment a buyer asks whether you are worth trusting. The same playbook seeds "would not recommend" threads on Reddit and Quora, the platforms AI systems lean on most, and floods review sites like G2 and Trustpilot with coordinated negatives that feed straight into what the models read. Both threats produce the same symptom, a wrong answer in front of a buyer, but they need different responses, so the first defensive skill is telling them apart.

How a poisoned answer actually gets planted

The most efficient attacks do not try to outshout you across the whole web. They target the retrieval layer that AI search depends on. Researchers have shown that injecting as few as five malicious passages into a corpus of millions can drive roughly a 90% success rate on a targeted query, a finding Similarweb highlights when explaining why negative GEO is cheap to run and hard to spot. You do not need to dominate the internet to corrupt one answer, just place the right few sources where the model goes looking. In client audits we have watched a single seeded Reddit thread become the source ChatGPT cited for an "is this company legit" query, ranking ahead of the brand's own pages.

Microsoft has put a name to the worst version of this. Its security team calls it recommendation poisoning, where attackers manipulate the content and signals an assistant uses to decide what to suggest, steering it toward or away from specific brands. A related vector is indirect prompt injection, where hidden instructions are embedded in a page, its metadata, or its comments, so that an assistant crawling the page follows the buried command instead of treating the text as ordinary content. Palo Alto's Unit 42 has observed this in the wild against AI agents, and Microsoft now runs a dedicated effort to detect prompt abuse across its tools. For a brand on the receiving end, what makes it dangerous is that none of this shows up in your analytics. The damage lives in someone else's conversation with a chatbot.

Why one bad source sticks while your correction bounces off

To defend a narrative you have to understand how a model decides which version of a story to trust. ZipTie's analysis of how LLMs choose sources describes models building evidence graphs that weight sources by entity coherence, domain authority, and something they call confirmation frequency. Sources that agree with the majority on a factual claim get more weight, and a claim repeated across many independent places starts to read as settled truth to the model regardless of whether it is accurate. A single corrective page on your own site is one voice arguing against a chorus, which is why a lone rebuttal so often fails to move the answer.

That same mechanic explains where your durable advantage comes from. ZipTie's brand reputation research found that brands with distributed third-party content are 6.5x more likely to be cited than those relying on their own site, and that roughly 85% of brand mentions in AI answers come from third-party domains versus 15% from owned pages. Reddit alone accounts for 46.5% of Perplexity citations and 21% of Google AI Overview citations in their data. The practical reading is that you cannot out-publish a poisoning campaign from your own blog, because the model barely weights your blog. You beat a corrupted narrative by making the accurate one the most frequently confirmed version across the places the model actually reads.

The line Google and Bing just drew

There is a tempting shortcut here, which is to fight poison with poison and manufacture your own flood of favorable content and fake negatives about rivals. The platforms closed that door this year. On May 15, 2026, Google expanded its spam policy to state plainly that attempting to manipulate generative AI responses counts as spam, the first time AI manipulation was named directly. The June 2026 spam update then rolled that enforcement out globally, putting tactics like recommendation poisoning and biased listicles under the same demotion risk as classic ranking spam.

Bing drew the same line from the other direction. Its updated guidelines added GEO as a recognized concept and expanded the AI abuse definitions, promoting prompt injection from a footnote to a full section on prompt injection and AI manipulation, and renaming keyword stuffing to cover artificially engineered language built to trigger citations. The takeaway for a defender is that the boundary between legitimate GEO and manipulation is now written down. Correcting the record with accurate, verifiable, well-structured content is fine under both policies, while manufacturing volume, fake negatives, or planted listicles is the behavior that now triggers demotion. That matters more than it first looks, because Bing's index grounds a large share of what ChatGPT returns, so keeping a clean Bing Webmaster Tools profile and pages that stay eligible there is part of defending the AI answer, since the same index feeds Copilot and ChatGPT.

Building the defensive moat before you need it

A real defense starts with knowing your own baseline. When we run an AI visibility audit, we put the same buyer questions to ChatGPT, Gemini, Perplexity, and Copilot that a prospect would, then trace every wrong or hostile answer back to the page or thread that fed it. The source of the damage almost never sits on the brand's own site. It is usually a stale directory listing, an outdated review, or a forum thread the team forgot existed. Once you can see that baseline, the fix for hallucination is consistency. State your real facts plainly and identically everywhere a model can read them, give entities clear and unambiguous names, and back the important claims with schema so the data can be verified independently. Bing's own guidance favors single-topic pages with the essential facts near the top, because those are easier for an assistant to ground an answer in. This is the unglamorous groundwork that makes you a low-effort source for the model to get right.

Against deliberate attacks the moat is distribution. Because the model weights third-party confirmation far above your own pages, the accurate version of your story has to live in many credible places at once, which means real participation in the communities and review platforms the assistants cite rather than a single press release. When a hostile narrative does appear, you respond by raising the confirmation frequency of the truth across those same sources until the model re-weights toward it. Chasing the takedown of one bad link rarely moves the answer on its own. Keep monitoring running so you catch a shift in sentiment while it is small, document anything that looks like coordinated defamation or fake reviews since legal options under defamation and unfair-competition law are still developing, and treat your AI reputation as something with an owner and a review cadence rather than something you check after a deal goes cold.

Defensive GEO is not where every brand should spend first. If almost nobody is asking the assistants about your category yet, or they already describe you accurately, your effort goes further on the offensive side, earning citations at all. The defensive work earns its budget once you have real AI-driven demand and something at stake in how you get described. Running the queries for an afternoon tells you which camp you are in faster than any framework.

Treat an AI answer as part of your reputation while the record is still yours to shape, and build it out across the sources the models trust. Do that early enough and there is no opening for a competitor to write that record for you.