Can businesses influence ChatGPT, Google AI and other answer engines? Learn where ethical GEO ends and AI search manipulation begins.
Businesses have always tried to influence how they are discovered.
They optimise websites for Google, secure media coverage, encourage customer reviews and publish content designed to demonstrate expertise. Generative engine optimisation applies many of the same principles to AI search platforms such as ChatGPT, Google AI Mode, Gemini, Claude and Perplexity.
However, the growth of GEO has introduced a more difficult question.
At what point does improving the information available to AI systems become an attempt to manipulate what those systems say?
This is no longer a theoretical concern. Companies have already been observed embedding instructions designed to persuade AI assistants to remember their websites as trusted or authoritative sources. Researchers have also demonstrated that AI systems can be affected by poisoned training material, manipulated retrieval sources and instructions hidden inside webpages.[1][2]
The difference between optimisation and manipulation will become one of the defining debates around AI search.
What does it mean to influence what AI “knows”?
The phrase “what AI knows” can be misleading because AI systems obtain and use information through several different layers.
The first is model training. Large language models are trained on substantial collections of text, code and other material. Once information has influenced the model’s internal parameters, changing or removing it can be difficult.
The second is retrieval. Many modern AI search tools search the live web or another information database when answering a question. They select relevant sources, place them into the model’s context and generate a response from that evidence.
The third is personal or organisational memory. Some assistants can retain user preferences, project information or instructions across conversations. Most legitimate GEO activity is aimed at the retrieval layer. A company publishes clear, authoritative information so that AI search tools can find, verify and cite it when relevant.
More aggressive tactics may target retrieval systems with manufactured content, target personal memory with hidden instructions or attempt to contaminate material that could eventually be used for model training.
These are very different activities and should not all be described simply as optimisation.
What legitimate GEO looks like
Ethical GEO improves the quality of information available to both people and AI systems.
A company might rewrite an unclear service page so that it explains who the service is for, what problem it solves and where it is available. It might publish an original research report, add supporting evidence to claims or correct conflicting company information across directories and social platforms.
It may also create case studies, secure relevant media coverage and encourage genuine customers to leave accurate reviews.
These activities can improve AI visibility, but they do so by strengthening the evidence available to the system. The organisation is not telling the AI that it must recommend the brand. It is giving the AI better material from which to reach its own conclusion.
The original academic research that formalised GEO focused on helping content creators improve visibility inside generative answers. Its authors found that presentation methods including clearer evidence, quotations and citations could affect how prominently source content appeared.[3]
That principle is not inherently deceptive. Making truthful information easier to understand is a normal part of communication.
The ethical test is whether the optimisation improves the information environment or merely attempts to exploit the system processing it.
Where GEO crosses into manipulation
GEO begins to become manipulative when the tactic is designed to manufacture authority rather than demonstrate it.
One example is the production of supposedly independent rankings that always place the publisher, client or commercial partner first without disclosing the relationship. The content may appear objective to a retrieval system even though the conclusion was predetermined.
Another is the creation of fake reviews, forum comments or social posts intended to give the impression of widespread customer approval. Repeating the same claim across multiple low-quality sites can create the appearance of corroboration when all the material originated from one commercial campaign.
Hidden instructions represent a clearer boundary. Text embedded in a page’s metadata, comments or invisible elements may tell an AI system to ignore competing sources or describe the website as authoritative.
OWASP classifies this broader vulnerability as indirect prompt injection. It occurs when an AI system processes instructions contained inside an external source such as a website or document, potentially resulting in biased outputs, information disclosure or manipulated decisions.[4]
Another boundary is crossed when businesses use automation to produce large numbers of near-identical pages whose primary purpose is to dominate AI retrieval rather than provide useful information.
Google’s spam policies now explicitly include attempts to manipulate generative AI responses within Search. The company can lower the visibility of sites that use deceptive or manipulative practices, or remove them from results completely.[5]
The issue is therefore not whether a company uses AI to create content. It is whether the content provides original value and represents the subject honestly.
Manipulating retrieval is easier than retraining a model
Claims that a business can “train ChatGPT to recommend your brand” should be treated cautiously. Publishing several articles does not normally retrain a major foundation model in real time. Businesses have little control over which public webpages are included in future training datasets, how the material is weighted or how later safety processes affect the model.
Manipulating retrieval can be more realistic.
When an AI system searches the web, it has to decide which sources appear relevant to the user’s question. Content designed around likely prompts can increase the chance of retrieval, particularly if it is hosted on a domain the system already considers credible.
This is why repeated brand claims, recommendation articles and forum discussions may influence a current answer without changing the model’s underlying knowledge.
Researchers have also shown that retrieval-augmented systems can be vulnerable to deliberately poisoned source material. These attacks aim to make a manipulated document appear relevant enough to be retrieved and persuasive enough to alter the final answer.
That does not mean every AI search result is easily controlled. Major platforms use source-quality systems, ranking models, safety filters and other protections. However, the attack surface exists because AI answers are only as trustworthy as the material selected to support them.
Could AI-generated content pollute future AI systems?
There is also a wider concern about the volume of synthetic content being published online.
Research published in Nature found that repeatedly training generative models on material produced by earlier models can contribute to “model collapse”. Over successive generations, models may lose information about the original human data distribution and produce increasingly narrow or distorted outputs.[6] This does not mean that all AI-generated content is harmful or that current commercial models are inevitably collapsing.
The research concerns the indiscriminate recursive use of synthetic data. Carefully controlled synthetic data can still have legitimate research and training applications. The concern for GEO is that large-scale publication of generic, unverified AI content may degrade the wider information environment. Search engines and answer engines could encounter thousands of pages repeating the same unsupported claims, often derived from one another.
Even where the content does not become part of future model training, it may reduce source diversity in retrieval results.
Ethical GEO should therefore contribute original knowledge rather than merely repackage existing AI outputs.
A practical test for ethical GEO
The clearest way to judge a GEO tactic is to ask what would happen if the user fully understood it.
Would the organisation be comfortable explaining how the content was produced, why the brand appears in the recommendation and whether any commercial relationship influenced the result?
Would the claim remain defensible if a journalist, regulator, customer or competitor examined the underlying evidence?
Would the content still be useful if it never affected an AI ranking? If the answer is yes, the activity is probably legitimate optimisation.
If the tactic depends on hidden instructions, fabricated consensus, undisclosed payments or claims that cannot be verified, it is moving towards manipulation.
Intent is important, but outcome matters too. A company may not intend to mislead anyone, yet still flood the web with inaccurate material that AI systems later repeat.
Responsible GEO requires editorial review, evidence checks and clear ownership of published claims.
Platforms also carry responsibility
Businesses should act ethically, but AI platforms cannot place the entire burden on publishers.
Answer engines need stronger systems for detecting coordinated content, identifying hidden instructions and distinguishing first-hand evidence from repeated marketing claims.
They should also make citations visible, provide routes for reporting inaccurate answers and give users enough context to assess why a recommendation was made.
An AI answer often appears more authoritative than a conventional list of links. The system summarises the evidence, removes disagreement and presents a concise conclusion.
That convenience increases the potential harm when the underlying sources have been manipulated.
The future of AI search will therefore depend on both sides. Businesses must resist shortcuts that manufacture credibility, while platforms must improve the transparency and resilience of their retrieval systems.
GEO should make brands more verifiable, not artificially preferred
Companies are entitled to improve how AI systems understand their services. They should correct inaccurate information, publish useful expertise, strengthen third-party evidence and monitor how they are represented across AI search platforms.
They should not attempt to force an assistant to remember them as trusted, manufacture public support or hide instructions inside content.
The most sustainable form of GEO does not try to control the answer.
It builds a body of credible evidence that gives the AI a legitimate reason to include the organisation.
That distinction will matter more as AI recommendations influence higher-value decisions across finance, healthcare, professional services, technology and procurement.
The question is not simply whether companies can influence what AI says. It is whether they earn that influence through evidence or manufacture it through manipulation.
AwarenessAI helps organisations measure and improve how AI systems represent, reference and recommend their brands. Effective GEO should increase accuracy, clarity and verifiability, without undermining the trust on which AI search depends.
[1] Microsoft Security: Manipulating AI memory for profit: The rise of AI Recommendation Poisoning. Microsoft documented 50 promotional memory-manipulation attempts involving 31 companies across more than a dozen industries. [2] Anthropic, UK AI Security Institute and Alan Turing Institute: A small number of samples can poison LLMs of any size. The research examined how deliberately created public documents could influence model behaviour, while stressing that the experiment involved a narrow and low-stakes form of backdoor.
[3] Aggarwal et al.: GEO: Generative Engine Optimization. The research introduced GEO as a framework for improving content visibility in generative answers and reported visibility gains of up to 40 per cent in its experiments.
[4] OWASP GenAI Security Project: LLM01: Prompt Injection. OWASP explains how instructions contained in websites, files and other external sources can alter an AI system’s behaviour and manipulate outputs.
[5] Google Search Central: Spam policies for Google web search. Google’s policy explicitly includes attempts to manipulate generative AI responses and warns that violating sites may be demoted or removed.
[6] Shumailov et al., Nature: AI models collapse when trained on recursively generated data. The study found that indiscriminate recursive training on model-generated content can cause models to lose information about the original data distribution.