Poisoning the Answer Engine: AI Search Is Now a Marketing-Governance Surface
On June 3, 404 Media reported something that should change what marketing teams think they are defending. Moderators of r/biohackers started banning new posts about peptides and hormone therapy. The reason was not spam in the usual sense. It was that companies had figured out how to seed those threads specifically to manipulate what ChatGPT and Google AI search would later say about their products. The subreddit was being used as an injection point into the answer engine.
That is the part most AEO conversations have skipped. We have spent a year arguing that off-site presence is where AI buyer answers get built. True. But if the model assembles its answer from sources you do not own, then those sources are not just an opportunity to be cited. They are an attack surface someone else can poison before you ever show up.
The visibility argument has a dark twin
The optimization case for off-site presence is well established, and we have made it ourselves. A Foundation study run with AirOps, published this month, puts hard numbers on it: across 5.1 million AI responses and 57.2 million citations gathered over 60 days, only 10.15% of citations for B2B SaaS pointed to brand-owned domains. Reddit accounted for 21%, YouTube and LinkedIn 13% each. In 68% of answers, no brand was cited at all. (These are first-party figures from a vendor that sells off-site visibility, so read them as a strong directional signal rather than independent consensus.)
The standard reading of those numbers is a growth reading. Go earn presence on the surfaces the model trusts. The 404 Media report forces the second reading. If 80 to 90% of what shapes a buyer answer lives on platforms you neither own nor moderate, then your competitor, or a bad actor, can shape it too. The same property that makes off-site presence a moat makes it a contaminated commons. A spring everyone drinks from, and anyone can spike upstream.
Why poisoning works on an answer engine
Search engines were adversarial from day one. Spam, link farms, and black-hat SEO trained Google to be suspicious. The answer engine inherits a different posture. It treats convergence across independent surfaces as evidence of consensus, and consensus as a proxy for truth. Forty-seven Reddit replies saying the same thing read as forty-seven witnesses.
That assumption is exactly what astroturfing exploits. You do not need to fool a ranking algorithm. You need to manufacture the appearance of agreement on the surfaces the model already trusts, and let the synthesis step do the rest. The peptide sellers were not gaming a SERP. They were staging a fake consensus for a system that mistakes volume of agreement for reliability of agreement.
The stakes are not academic. G2’s Answer Economy report finds 71% of buyers now use AI chatbots for software research, up from roughly 60% in seven months. Sixty-nine percent say AI led them to a vendor they had not considered. One in three bought from a vendor they had never heard of before the AI surfaced it. The answer is not a stop on the buying journey anymore. For a third of buyers, the answer is the shortlist. Poison it, and you have rewritten the consideration set before the buyer types a second prompt.
This is a governance problem, not a content problem
Here is where the org chart breaks. Content marketing knows how to make more content. Demand gen knows how to buy more reach. Neither function is built to ask a different question: is the third-party signal that feeds our category answer accurate, and who is corrupting it?
That question has no owner in most companies. It needs three capabilities that today live nowhere.
Monitoring. You cannot defend a surface you do not watch. The minimum viable practice is to run your top buyer queries through the major answer engines on a schedule, capture the cited sources, and diff them over time. A new wave of suspiciously aligned Reddit threads in your category is a signal, the way a spike in inbound links once was. Most teams check their rankings weekly and their answer-engine citations never.
Auditing the source graph. When the model cites a thread, a review, or a video, someone has to ask whether that source is organic or staged. This is closer to trust-and-safety work than to marketing. It means tracing claims back to their origin, noticing coordinated posting patterns, and flagging manipulation aimed at your category even when it targets a competitor, because a poisoned category answer drags everyone down with it.
Defense and correction. When a false claim takes root in a cited source, the response is not a press release. It is surface-level correction: factual replies in the threads that rank, documentation the model can parse, and counter-evidence placed where the synthesis step will actually read it. Slow, unglamorous, and nobody’s job today.
The line you cannot cross while defending
There is an obvious temptation here, and it is a trap. If competitors are astroturfing the answer engine, why not astroturf back? Because the model is getting better at detecting coordinated inauthentic behavior, and the brand cost of being caught compounds in exactly the surface you are trying to win. The defensive posture is not to manufacture your own fake consensus. It is to make the real consensus legible: get genuine users talking, correct the record with evidence, and keep your owned surfaces so coherent that the model has a clean source to fall back on when the off-site signal is contested.
Ethan Crump of Foundation framed the visibility stakes bluntly: your brand is either on it or it isn’t, there’s no page two. Integrity raises the bar. Being on it is not enough if what is on it has been poisoned against you, and you found out from a buyer who already chose someone else.
Do this now
This week, pick your five highest-intent buyer queries. Run each through ChatGPT and Google’s AI answers. Capture every cited source and tag it: owned, organic third-party, or suspicious. Look specifically for clusters of recent posts that all push the same framing in your category, especially ones that favor a competitor or disparage you with claims you can disprove. If you find even one, you have confirmed the surface is contestable, and you now need someone whose job is to watch it.
The off-site signal graph is no longer just where you earn visibility. It is infrastructure your category depends on and adversaries can contaminate. Governing it means treating the answer engine the way you would treat any shared system that others can attack: monitored, audited, and defended, not merely optimized.
This analysis synthesizes Nearly 90% of AI Citations for B2B SaaS Come from Off-Site Sources (Foundation (Foundation x AirOps study), June 2026), Companies Are Using Reddit to Manipulate ChatGPT and Google AI Search (404 Media, Jason Koebler, June 2026).
Victorino Group helps marketing leaders stand up the monitoring and defense function that off-site answer integrity now requires. Let’s talk.
All articles on The Thinking Wire are written with the assistance of Anthropic's Opus LLM. Each piece goes through multi-agent research to verify facts and surface contradictions, followed by human review and approval before publication. If you find any inaccurate information or wish to contact our editorial team, please reach out at editorial@victorinollc.com . About The Thinking Wire →
If this resonates, let's talk
We help companies implement AI without losing control.
Schedule a Conversation