One natural-looking sentence could bias an AI answer toward an inserted brand

The attacker changed content that an assistant might reasonably cite, rather than issuing an explicit command to the assistant. A planted brand name became part of the article’s apparent factual context and later appeared in the generated product answer. This is a data-authenticity problem that can evade command-centric prompt filters.

The experiment used invented brands and controlled articles. A mention does not prove endorsement, sales or real merchant manipulation. The sample does not establish how a multi-source rebuttal would perform.

This experiment targets answer evidence rather than a model's instruction hierarchy. A natural-looking brand reference was placed inside an otherwise plausible article, then surfaced by retrieval under category or product queries. The reported best article-conditioned setting reached 82.2% retrieval Hit@10 and as much as 62.7% generated brand mentions. These conditional rates do not generalize to arbitrary web searches, and mentioning a fictitious brand is not proof of an endorsement or sale.