The researchers mapped 17,211 citations across ten AI-search systems and tested whether ordinary publishers could supply material later treated as cited evidence. Fifteen of 22 tested publishing surfaces tied to cited domains had low or medium account and posting barriers. The preference for certain domains mattered as much as raw posting volume: one…
Inspect the ClaimsCase · DiggingBeagle record
Fabricated public posts entered AI-search citations in a ten-platform study
A 2026 research study found that low-barrier public posts could become cited evidence in AI answers, including a deliberately fabricated concept and a low-cost paid posting test.
Scope
Controlled citation-measurement and marker-based publishing experiment on ten AI-search platforms reported in arXiv:2610.11932, submitted October 8, 2026. This is source and answer contamination, not a demonstrated credential-stealing prompt injection or an incident rate for real users.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- AI role
- AGAINST AI
Basis and provenance
Authors conducted marker-controlled public-post experiments and citation measurements. Observed citations demonstrate source-selection susceptibility in the measured platforms, not criminal exploitation, user deception rates or persistence after the study. No independently tested fix is established.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-AISEARCH-BARRIER-AND-PREFERENCE · CLM-AISEARCH-FABRICATED-CONCEPT · CLM-AISEARCH-EXPERIMENT-LIMIT · From Public Posts to AI-Search Citations: Measuring the Fragility of AI Search
At a glance
Trust in a generated citation depends on the publisher, publication process and independent support for the proposition, not the number of links. The 15-of-22 access measure and high-preference versus low-preference comparison suggest that safeguards should prioritize user-postable domains that already receive disproportionate citation weight. Review a…
Read the implicationsThe study does not measure the prevalence of malicious real-world answer contamination or deception of actual users. Ranking and ingestion behavior after the October 8, 2026 study may differ across deployed model versions. The persistence of planted citations, their survival after takedown and the effectiveness of proposed provenance checks were not…
Limits and uncertaintyFull account
The researchers mapped 17,211 citations across ten AI-search systems and tested whether ordinary publishers could supply material later treated as cited evidence. Fifteen of 22 tested publishing surfaces tied to cited domains had low or medium account and posting barriers. The preference for certain domains mattered as much as raw posting volume: one article on a favored site had greater citation effect than more than 20 matched articles on less-favored sites. In a controlled marker experiment, eight of ten systems cited a fabricated concept within seven days, and a separate $14 purchase of 13 posts yielded one measured marked citation within an hour. These are experiments, not an incidence rate for malicious production answers.
Mechanism and trust boundary
- 01
Attacker publishes fabricated content
A low-barrier site accepts a newly authored post.
Boundary: untrusted public publisher to indexed web content
- 02
AI search favors certain domains
The system selects source material using domain-specific citation preferences.
Boundary: retrieval ranking to supposedly credible evidence
- 03
Generated answer cites planted statement
The citation makes the new invented concept appear to have a documented public source.
Boundary: selected source to user-visible answer and citation
Claims & evidence
CLM-AISEARCH-PAID-POSTSIn a separate author-run test, a $14 content-promotion service produced 13 public posts, and one measured AI-search platform cited text carrying the researchers' markers within an hour.supported
Basis: reported finding
- supportsFrom Public Posts to AI-Search Citations: Measuring the Fragility of AI Searchprimary disclosure
Abstract, finding (3), $14 GEO test and citation markers
CLM-AISEARCH-EXPERIMENT-LIMITThese measurements document platform behavior under controlled prompts and publications; the paper does not measure how often ordinary real-world AI-search responses are successfully manipulated by malicious actors.supported
Basis: inference
- supportsFrom Public Posts to AI-Search Citations: Measuring the Fragility of AI Searchprimary disclosure
Abstract, framework and experimental setup statements
CLM-AISEARCH-FABRICATED-CONCEPTIn controlled posting experiments, eight of the ten tested AI-search platforms cited a researcher-invented concept within seven days of its publication.supported
Basis: reported finding
- supportsFrom Public Posts to AI-Search Citations: Measuring the Fragility of AI Searchprimary disclosure
Abstract, finding (2), fabricated concept and seven-day period
CLM-AISEARCH-CITATION-POPULATIONThe authors measured 17,211 AI-search citation instances spanning 6,356 source domains across ten platforms, finding that each platform's top 20 cited domains accounted for 20.5% to 70.8% of citations.supported
Basis: reported finding
- supportsFrom Public Posts to AI-Search Citations: Measuring the Fragility of AI Searchprimary disclosure
Abstract, sentence beginning Across 10 AI-search platforms, finding (1)
CLM-AISEARCH-BARRIER-AND-PREFERENCEOf 22 publication platforms examined in the citation-source study, 15 had low or medium barriers to both opening an account and posting. In a separate controlled comparison, one article on a highly preferred domain had greater citation impact than more than 20 matched posts on less-preferred domains.supported
Basis: reported finding
- supportsFrom Public Posts to AI-Search Citations: Measuring the Fragility of AI Searchprimary disclosure
Abstract, finding (1), 15 of 22 publication platforms; finding (2), one high-preference article versus more than 20 matched posts
Implications
Trust in a generated citation depends on the publisher, publication process and independent support for the proposition, not the number of links. The 15-of-22 access measure and high-preference versus low-preference comparison suggest that safeguards should prioritize user-postable domains that already receive disproportionate citation weight. Review a cited statement against independent primary material, and do not assume a citation or an indexed domain authenticates a newly introduced concept.
Controls and mitigations
- Audit high-leverage domains that permit unreviewed user posts, especially when claims are unusual or newly published.
- Use provenance, independent corroboration and publication age rather than citation count alone when answering consequential questions.
- Separate retrieval-source confidence from the fluency and presence of citations in the final answer.
Unknowns and contradictions
- The study does not measure the prevalence of malicious real-world answer contamination or deception of actual users.
- Ranking and ingestion behavior after the October 8, 2026 study may differ across deployed model versions.
- The persistence of planted citations, their survival after takedown and the effectiveness of proposed provenance checks were not independently measured here.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 132