The 13 words that can rewrite what ChatGPT says about your brand

Our AI visibility monitoring over the past several months surfaced a consistent pattern. That observation is now confirmed, supported both by our internal data and by independent peer research. A single Reddit comment, 13 words long, can change what an AI assistant recommends to your customers. Not a viral thread. Not a coordinated campaign. One comment, written in two minutes, by anyone with a free account.

It's the finding of research from Cornell University into how AI research agents can be poisoned through user-generated content. And it sits at the centre of a story every founder and CMO needs to understand, because Reddit has quietly become one of the most powerful inputs into what ChatGPT and other AI assistants say about brands.

In this piece we'll unpack three things. First, how Reddit earned that influence. Second, how bad actors are already exploiting it, both to attack brands and to inflate them. Third, why the brands doing the inflating are setting fire to their own houses, slowly, and what to do instead.

How Reddit became the loudest voice in AI answers

When ChatGPT answers a question like which CRM should a 10-person agency buy, it doesn't conjure the answer from nowhere. It retrieves and weighs sources, and it has clear favourites.

In February 2024, Reddit signed a licensing deal with Google reported at around USD 60 million a year, giving Google real-time access to Reddit content for its AI models. A partnership with OpenAI followed a few months later, estimated at roughly USD 70 million a year. Reddit's two decades of human conversation became licensed fuel for the world's most-used AI assistants.

The results show up in the data. An analysis of 150,000 AI citations found Reddit appearing in roughly 40% of AI answers, ahead of Wikipedia at about 26%. Separate tracking found Google's AI Overviews citing Reddit in around 21% of responses over a ten-month period.

Why do the models lean so hard on one forum? Because Reddit looks like the thing AI systems are desperate for. Unpolished, first-hand human experience. Real people comparing products, complaining, troubleshooting, and recommending. When a model wants to know what users actually think, Reddit reads like ground truth.

And that's exactly the problem. The models treat it like ground truth. The people writing it can be anyone.

The attack surface nobody planned for

Once you understand that AI assistants treat Reddit threads as evidence, the next question is obvious. What happens when someone plants the evidence?

Thirteen words is all it takes

The Cornell team behind the research we opened with gave their technique a name, Web Agent Retrieval Poisoning. They showed that a comment as short as 13 words can steer the output of AI agents that research products on a user's behalf. Something as plain as a commenter saying they returned a product and bought a rival brand instead reads as an ordinary comment to a human. To a model, it's a strong signal against one product and for another.

The capability required to run this attack is the ability to post a comment. That's the entire barrier to entry.

Manipulation at scale has already been tested

If you're wondering whether AI-written personas can actually move human communities, that experiment has been run. Researchers at the University of Zurich secretly deployed AI bots into a major Reddit debate community to test whether they could change people's views. The bots proved persuasive enough that the unauthorised study triggered outrage, formal complaints, and condemnation from Reddit itself. The uncomfortable takeaway stands. Fabricated voices work, on humans and on the models reading over their shoulders.

Malicious attacks on brands are real, and cheap

The clearest documented case of Reddit-based brand sabotage didn't even need AI. As reported in industry analysis of the incident, a moderator of a coding bootcamp community, who was also the co-founder of a competing bootcamp, posted negative content about a rival roughly once a day for 500 days. The targeted company reported losing around 80% of its revenue, with dozens of jobs gone.

Now put that playbook in today's context. Those 500 posts aren't just influencing the humans who read them. They're being retrieved, weighed, and repeated by AI assistants answering questions like is this company legit. A sustained smear campaign no longer just poisons a subreddit. It poisons the answer layer that a growing share of your buyers consult first.

The same applies to lower-effort attacks. A disgruntled ex-employee, a competitor's agency, or a bored troll can seed negative comments across the threads AI models cite. Most brands would never know it happened. They'd just watch recommendations quietly dry up.

And an industry has formed around the grey version

Alongside the attackers sit the self-inflators. Reporting by 404 Media uncovered companies flooding communities such as r/Biohackers with coordinated posts written to look like genuine user experiences, designed specifically to be scraped and surfaced in AI answers. The accounts follow a pattern. New profiles, thin history, activity clustered around one product category, praise threaded into conversations that engagement-farm first and sell second.

There's now a cottage industry selling exactly this, sometimes politely branded as answer engine optimisation. The pitch is simple. AI assistants trust Reddit, so buy yourself some trust.

Which brings us to the third part of the story, because that pitch has a flaw at its core.

Why gaming Reddit is shooting yourself in the foot

The brands buying fake Reddit presence today are optimising for a snapshot. They're forgetting that the system takes another photo tomorrow. Here are five ways the tactic destroys the thing it's meant to build.

The platform deletes your asset

Reddit's business now depends on its data being worth licensing. Two deals worth a reported USD 130 million a year combined exist precisely because Reddit content is presumed authentic. That gives Reddit a direct commercial incentive to hunt inauthentic content, and it does. Accounts that exist mainly to promote a product get banned, and spam accounts for around two-thirds of admin bans. When the accounts go, the posts go. When the posts go, they drop out of future retrieval. Every dirham spent on planted content is spent on an asset the landlord can vaporise without notice.

The community turns your campaign into the story

Reddit users are arguably the internet's most aggressive astroturf detectors. Communities routinely spot suspicious accounts, and when they do, the call-out thread often earns far more engagement than the plants ever did. Here's the vicious twist. That call-out thread is now the authentic, highly upvoted content about your brand. It's exactly what AI models prefer to cite. Get caught, and the durable record retrieved by ChatGPT isn't your planted praise. It's a thread titled something like this brand is astroturfing us.

Regulators have stopped treating this as a grey area

In the UK, the Digital Markets, Competition and Consumers Act banned fake and undisclosed incentivised reviews, with the provisions in force since 6 April 2025. The CMA can impose fines of up to 10% of annual global turnover and has already opened investigations into five businesses. In the US, the FTC's Consumer Review Rule carries civil penalties of up to USD 53,088 per violation, and the agency issued its first warning letters to ten companies in December 2025. A campaign of fabricated user posts isn't clever marketing. Increasingly, it's evidence.

The gains are fragile by design

AI answers aren't carved in stone. They're regenerated constantly, from sources that get re-crawled, re-weighed, and re-ranked. We see this in our own tracking data every week. Brand visibility in AI answers is volatile, and positions built on a handful of planted threads are the most volatile of all. One moderator sweep, one model update, one shift in citation patterns, and the position evaporates. Compare that with a brand whose presence rests on hundreds of genuine mentions accumulated over years. One of these assets compounds. The other one leaks.

Trust doesn't average out, it gates

Perhaps the deepest problem is how trust works at the answer layer. A human reading mixed reviews weighs them up. An AI assistant asked whether a brand is trustworthy does something closer to gating. Credible evidence of manipulation doesn't get averaged against your good press. It becomes the headline. And because journalists now actively report on this behaviour, getting caught generates precisely the kind of high-authority coverage that models cite for years. The short-term lift buys a long-term liability that sits in the training data.

How to tell if it's already happening to you

Most victims of answer-layer manipulation find out late, because the symptoms show up in places nobody connects to Reddit. Here are the warning signs worth checking this week.

Your AI answers changed but your reality didn't

Ask ChatGPT, Gemini, and Perplexity the questions your buyers ask. Best tools in your category, is your brand trustworthy, your brand versus your main competitor. If the answers have turned cooler or a rival has appeared where it didn't belong, and nothing in your actual product, pricing, or press explains it, something upstream shifted. Check what the assistants are citing.

A new voice keeps appearing in your category threads

Look at the Reddit threads that rank for your category terms. Patterns to treat as red flags include accounts created recently that only ever discuss your product category, the same criticism phrased slightly differently across multiple threads, and praise for one competitor that always arrives paired with a dig at you. One comment is an opinion. The same comment five times from three young accounts is a campaign.

Old threads are doing new damage

Because models retrieve rather than remember, a hostile thread from 2023 can suddenly start steering answers in 2026 if citation patterns shift. If you find an old complaint thread being cited, treat it as live. Age doesn't neutralise content at the answer layer. Only removal or displacement does.

Your branded search and referral mix drifts

A slow bleed in branded queries, demo requests, or comparison-page traffic, with no matching change in spend or seasonality, is consistent with buyers being steered away one AI answer at a time. It's not proof on its own. Combined with the signals above, it's a pattern.

Found something? Here's the response playbook

If you do uncover manipulation, resist the urge to wade in swinging. There's a sequence that works.

First, document everything before you act. Screenshots, links, account names, timestamps. Removed content is good for your brand but bad for your evidence, so capture first.

Second, report through the platform. Coordinated inauthentic behaviour and vote manipulation break Reddit's rules, and Reddit's licensing business gives it every reason to act on credible reports. Persistent, documented reporting works better than one angry ticket.

Third, don't astroturf back. Responding to fake negativity with fake positivity doubles your legal exposure and hands the attacker a story. If you engage in the thread at all, do it once, disclosed, factual, and calm. Community members tend to respect a brand that shows up openly and rate-limits itself.

Fourth, displace rather than argue. The most effective long-term counter to a hostile thread isn't winning the thread. It's making sure the surrounding evidence, reviews, documentation, genuine community discussion, and third-party coverage, outweighs it at retrieval time.

And fifth, if the campaign is sustained and traceable to a competitor, take the file to a lawyer. As the regulatory picture above shows, this conduct is no longer a grey area, and that cuts both ways.

What smart brands do instead

None of this means ignoring Reddit. Quite the opposite. If AI assistants treat Reddit as evidence of what people think of you, then what people actually say about you there has become a board-level asset. The playbook is less exciting than buying fake posts, and considerably more durable.

Earn a real presence

Show up as yourselves. Answer technical questions in your niche with disclosed, useful, non-promotional participation. Genuine helpfulness in the communities your buyers frequent produces exactly the organic mentions that models reward, and nobody can delete it as spam because it isn't.

Give people something worth citing

The most reliable way to be recommended in threads is to be the brand people actually recommend. Distinctive products, sharp documentation, generous free tools, and honest pricing generate unprompted advocacy. It's slower than astroturfing. It's also the only version that survives contact with a moderator.

Watch the answer layer like you watch your P&L

Here's the part most brands still miss. You can't respond to an attack you can't see. A poisoned thread can sit quietly reshaping AI recommendations for months before anyone notices the pipeline softening. The brands that come through this well are the ones monitoring what AI assistants actually say about them, week in and week out, so a sudden sentiment shift or a new hostile citation shows up as an alert rather than a quarterly surprise.

That's precisely what we built Cleotic to do, and the features map directly onto the threats in this article.

Answer attribution shows you every page and thread cited when AI assistants mention your brand. Remember, everything in this story comes down to sources. When a recommendation turns against you, attribution hands you the exact thread responsible, so you can tell a real complaint from a planted one in minutes and know precisely what to report, fix, or displace.

Answer gaps flip the lens. They show you the buying questions where you don't appear at all, and where a competitor, or an astroturfer, currently owns the answer. That's your content roadmap. Filling a gap with something worth citing is the legitimate version of everything the fake-post industry sells, and unlike their version, it compounds.

Sentiment analysis catches the quiet attacks. Visibility alone can look healthy while the tone underneath it sours. A steady negative drift traced to one source is often the first measurable sign of a campaign like the ones above, months before it shows up in pipeline.

And because there's no single AI opinion of your brand, Cleotic tracks how each model perceives you separately. ChatGPT, Gemini, and Perplexity cite different sources and can disagree about you completely. Knowing that the problem lives in one model, fed by one thread, turns a vague reputation worry into a fixable task.

One more thing, size doesn't protect you

It's tempting to file this under problems for big brands. The maths runs the other way. A brand with thousands of organic mentions dilutes any single poisoned thread. A brand with 40 mentions can have its entire AI reputation steered by one. If you're a challenger, the answer layer is simultaneously your biggest opportunity, because a few strong authentic threads visibly move your numbers, and your softest flank, because the same is true for whoever wants you gone. Either way, the case for watching it is stronger the smaller you are.

The bottom line

Reddit's influence over AI answers is real, measurable, and already being weaponised, in both directions. Attackers can damage you with a handful of comments. Cheaters can inflate themselves for a quarter or two. But the evidence points one way. Platforms are purging, communities are hunting, regulators are fining, and the models themselves redraw the map constantly.

You can't control what Reddit says about you. You can make sure you're worth talking about, and you can make sure you see it coming.

Want to know what AI assistants are saying about your brand right now, and be the first to know when it changes? Start monitoring with Cleotic.