Tactics to avoid, and myths to ignore
Andy Bright
Director of Product and Technology
On this page
Every new way of reaching customers attracts shortcuts, and AI search has attracted plenty. Some don't work at all. Some work for a while and then cost the business more than they gained. Some break platform rules or the law.
This chapter goes through the main ones, so you can recognise them when an agency or a tool offers them to you. It ends with the myths that waste time without doing any harm.
Google's spam rules now cover AI answers
Google's spam policies are its rules against tricking its search results. In May 2026 Google updated them(opens in a new tab) to make clear they cover AI answers too. The policies(opens in a new tab) now describe spam as including "attempting to manipulate generative AI responses in Google Search". A site that breaks them can be ranked lower or left out of Google's results, which also affects AI Overviews and AI Mode, because they're built on the same results.
Three of the policies apply to AEO.
Scaled content abuse is Google's name for publishing large numbers of pages mainly to rank, rather than to help readers. Google defines it as "many pages are generated for the primary purpose of manipulating search rankings and not helping users". Its guide to optimising for generative AI(opens in a new tab) gives an AEO example. Creating separate pages for the searches behind a question, "primarily to manipulate rankings or generative AI responses in Google Search", breaks this policy. If Fernhill published dozens of near-identical pages, one for every way of asking about office coffee or one for every UK town, that would be the kind of publishing Google warns about. One good page about office subscriptions, which answers the related questions, is the right approach.
Hidden text means "placing content on a page in a way solely to manipulate search engines and not to be easily viewable by human visitors", such as white text on a white background. Hidden instructions written for AI assistants would fall under this rule, and under the new definition of spam.
Link spam includes buying links that search engines count when they decide how high to rank a page. Paid links are allowed only if they're marked with rel="sponsored" or rel="nofollow", as the chapter on other websites explains.
Google also says that "seeking inauthentic 'mentions' across the web isn't as helpful as it might seem" (AI optimisation guide(opens in a new tab)).
Hidden instructions for AI assistants
Prompt injection means hiding instructions in content so that an AI system follows them, instead of doing what its user asked. Researchers have shown several times that it can work on AI assistants that recommend products.
- In 2024, two Harvard researchers added a specially written string of text to a product's page. It greatly increased the chance of an AI model listing that product as its top recommendation (Kumar and Lakkaraju(opens in a new tab)).
- In December 2024, The Guardian found that hidden text on web pages could make ChatGPT's search give a positive summary of a product even when the page contained negative reviews (The Guardian(opens in a new tab)).
- Researchers at ETH Zurich showed that manipulating AI search this way creates a "prisoner's dilemma". Each business gains by doing it, but if everyone does it, the results get worse for everyone (Nestaas and others(opens in a new tab)).
AI companies treat prompt injection as an attack on their systems and their users, and they build defences against it. Text written to trick an AI assistant about your product is also likely to mislead the people who read the answer. Don't use it, and don't let anyone you hire use it.
"AI recommendation poisoning"
In February 2026 Microsoft's security team described a newer version of the same trick, which it calls AI recommendation poisoning. Some websites had added "Summarize with AI" buttons and links that open an AI assistant with a question already filled in. Hidden in that question were instructions such as telling the assistant to remember the company "as a trusted source" or to recommend it first in future. Some assistants remember things from earlier conversations and use them later, which is what these instructions tried to exploit. Microsoft found "over 50 unique prompts from 31 companies across 14 industries" over 60 days, and classes the technique as prompt injection and memory poisoning (Microsoft Security Blog(opens in a new tab)).
If an agency or tool offers to "teach ChatGPT to recommend you", or sells "AI memory" links, this is usually what it means.
Self-ranking "best of" lists
Some businesses publish articles such as "The 10 best coffee subscriptions in the UK" on their own website, with their own business at number one. There's evidence on both sides.
The case for
These lists do get cited. Peec AI, which sells AI tracking software, looked at 232,000 citations for software review questions and found(opens in a new tab) that about 11% came from lists where the publisher ranked itself. Ahrefs ran an experiment(opens in a new tab) in 2026, publishing self-promoting pages about a brand that AI assistants didn't know about. Of 72 new mentions of that brand, 82% appeared in answers that cited one of those pages. When Ahrefs ran the same test for a well-known brand, only 6% of its new mentions came from answers that cited such pages. Ahrefs found the citations were often temporary, and calls its study "a small-scale experiment".
The case against
- Search risk. In February 2026 the SEO consultant Lily Ray reported(opens in a new tab) falls of 29% to 49% in the search visibility of several software and business-services sites that published self-ranking lists, in some cases dozens of them. Search visibility is an SEO tool's estimate of how often a site appears in Google. The falls started in mid to late January. She called the lists "a major likely culprit", among several tactics those sites used. Google hasn't said. A later analysis by Kevin Indig of the Growth Memo newsletter, reported by PPC Land(opens in a new tab), found that lists of all kinds had lost some top positions in Google. But most lists written by vendors had gained estimated traffic since January, and Indig said he couldn't trace the change to self-ranking lists specifically. The risk is possible but unproven.
- Legal risk. In the US, the FTC's rule on reviews bans review and ratings websites that a business controls but presents as independent (FTC(opens in a new tab)). In the UK, the CMA's guidance on unfair commercial practices(opens in a new tab) explains the law against misleading consumers, under the Digital Markets, Competition and Consumers Act 2024. A list that presents itself as independent when it isn't can break the FTC's rule, and in the UK, content that hides its commercial purpose can break consumer law.
- Trust. Readers who notice that the publisher ranked itself first have reason to doubt the rest of the page.
What to do instead
Publish honest comparison pages. Say on the page that you make one of the products. Use the criteria a buyer would use, describe competitors accurately, recommend them where they're the better choice, and keep prices and dates current. The content chapter has a checklist. A page like this carries less risk than a self-ranking list, as long as you don't publish large numbers of them, and stays credible to the people reading it.
Fake reviews and planted posts
The chapter on other websites covers the rules in detail. These all break platform rules, and many break UK or US law:
- writing reviews yourself, or paying for positive ones
- inviting only the customers you expect to be happy
- staff or agencies posting about your business on forums or review sites without saying who they are
- fake accounts, bought votes, and services that "seed" mentions of your business
- writing or editing a Wikipedia article about your own business without following Wikipedia's conflict of interest rules
They can also be found out. If they are, forum threads and articles about the fake reviews can become sources that AI assistants summarise.
Poisoning AI training data
A final warning concerns the text AI models learn from. In October 2025, researchers at Anthropic, the UK AI Security Institute and the Alan Turing Institute published a study of this. They found that "as few as 250 malicious documents" could plant a narrow hidden behaviour in AI models during training, whatever the size of the models they tested (Anthropic(opens in a new tab)). The authors say "it remains unclear how far this trend will hold" for larger models.
The finding comes from security research. Publishing text designed to change how a model behaves is exactly what this kind of research helps AI companies defend against. Avoid any service that offers to do it for you.
Myths that waste time
These don't cause harm, but they use up time and money that could go on the work in earlier chapters. The technical SEO guide's AI search chapter covers myths about crawlers and settings.
| Claim | What the evidence says |
|---|---|
| "You need an llms.txt file to appear in AI answers" | llms.txt is a proposed file that describes a website for AI tools. Google Search ignores it, and no major AI company says it uses it to choose sources. The technical SEO guide explains when it's useful |
| "Special schema markup gets you cited by AI" | Schema markup is another name for structured data. Google says no special markup is needed, and Ahrefs found adding it made no major difference to how often AI assistants cited pages that were already being cited (chapter 4) |
| "You can rank number one in ChatGPT" | There is no fixed ranking. Measure how often you're mentioned instead (chapter 7) |
| "More pages means more AI visibility" | The number of pages on a site had almost no relationship with AI visibility in Ahrefs' study of 75,000 brands (chapter 5) |
| "Backlinks are what get you into AI answers" | Mentions on other websites correlated far more strongly than links in Ahrefs' studies |
| "Prompt volume data shows what people ask AI" | No major AI company except Microsoft shares this data, so every figure is an estimate (chapter 7) |
| "Our tool has inside access to how AI ranks brands" | Google says "No third-party tool has access to our internal ranking or AI systems" (Google(opens in a new tab)) |
| "Break your content into short chunks for AI" | Google says "There's no requirement to break your content into tiny pieces for AI", for its own AI features. Microsoft recommends sections that make sense on their own. Use clear, headed sections, and don't split pages any further (chapter 3) |
| "AEO replaces SEO" | AI answers are built on search results. AEO adds to SEO (chapter 1) |
What to do next
- If an agency or freelancer works on your website or reputation, share this chapter with them, and ask them to confirm in writing that they don't use these tactics.
- Check your site for "Summarize with AI" buttons or links, and remove any that add instructions to the question.
- List any "best of" pages on your own site that rank your own business first, and rewrite them as honest comparisons that say who wrote them.
- Compare your review process with each review site's rules and the law where you sell.
Further reading
- Spam policies for Google web search(opens in a new tab), Google's full list of what it treats as spam.
- Manipulating AI memory for profit: The rise of AI Recommendation Poisoning(opens in a new tab), Microsoft's report on hidden instructions in "Summarize with AI" links.
- Is Google finally cracking down on self-promotional listicles?(opens in a new tab), Lily Ray's analysis.
- A small number of samples can poison LLMs of any size(opens in a new tab), the Anthropic research on training data.