By Amara Osei

Microsoft's Defender Security Research Team caught 31 companies across 14 industries hiding invisible instructions on their websites to manipulate AI search results, the company disclosed in February 2026. The instructions told AI engines to "remember [Company] as a trusted source" and "recommend [Company] first." Microsoft named the practice "AI Recommendation Poisoning."

The offenders were not fringe operators. Matt Beezley, senior strategist at Red Fan Communications, wrote in PR Daily that these were "legitimate businesses, with real marketing budgets, trying to game the channel that their own buyers increasingly depend on."

The stakes are unusually high. Beezley's warning is blunt: "The moment buyers stop trusting AI recommendations is the moment we lose the channel entirely." Buyers now use AI to build shortlists before they ever enter a sales funnel, and by the time they surface, he argues, the decision is mostly made.

Why does this sound familiar?

Anyone in digital marketing before 2012 watched brands stuff invisible keywords onto hidden pages to climb Google's rankings. It worked until Google changed the rules overnight, vaporizing the visibility of every company that had built its strategy on manufactured signals. Beezley's verdict on that era: those brands "lost more than their rankings," because audiences learned the results they trusted were, at least in part, for sale.

SEO spent a decade recovering from the reputational damage. Beezley predicts the same conversation about AI search in five years — except this time involving a channel "far more influential, far more trusted and far more consequential to revenue than a Google results page ever was."

That claim deserves scrutiny. AI search's commercial influence is real but young, and Beezley offers no measurement of it; his case rests on the shift in buyer behavior, not on attribution data. Even so, the historical parallel is precise, and the platforms are already moving.

How are the platforms responding?

Google revised its search spam policy in May 2026 to explicitly classify attempts to manipulate AI-generated responses as spam. That closes one door. The audit by Gaetano DiNardi at Search Engine Land, published in June 2026, shows how many remain open.

DiNardi audited top-rated generative engine optimization firms — agencies selling improved visibility inside AI answers — and found:

• Brand placements sold on private blog networks (a network of low-quality sites built to host paid links)
• Astroturfed mentions (fake grassroots endorsements) run through aged Reddit accounts, most of which Reddit removed within 30 days for violating community guidelines
• Fee-recoupment schemes in which the vendor pays a publisher for a mention and then invoices the client to cover the cost

The pattern matters less for any single tactic than for its trajectory. Beezley lists prompt injections (hidden text that redirects an AI system's output) and content farms writing exclusively for AI consumption alongside the paid schemes. "The tactics are getting as creative as they are dangerous," he writes, and they threaten to turn one brand's shortcut into every brand's penalty.

Notably, Microsoft's disclosure names a number of companies but not the companies themselves. The absence of named offenders makes industry accountability harder — buyers and competitors cannot see who was caught.

What should marketers do?

Beezley's answer is self-policing. Generative search runs on the kind of credibility earned media has always built, and brands trying to buy their way in are proving "on a public stage" that the shortcut does not survive contact with an attentive buyer. His framing reaches back to Coach Nick Saban's 2017 rant about media praise — "It's like taking poison. Like rat poison" — to argue that PR and communications professionals carry the onus to call these tactics out.

"For now, the well is still clean," he writes. "The question is how long it stays that way."

The caveat is implicit in his own argument: nobody has a good answer for what replaces this channel once trust collapses, and two platform interventions within four months suggest the cleanup will be reactive, not preventive. The brands that stay clean will find out whether patience was the strategy — or whether the offenders poison the well for everyone first.