A BBC journalist got AI Overviews to repeat a fake claim in 24 hours. Microsoft found 31 companies poisoning AI memory for promotion. Here's what's confirmed.
Traditional negative SEO runs through backlinks: point a pile of spammy links at a rival's site and hope Google's spam systems punish them for it. Two separate, well-documented cases from February 2026 point at a mechanism that skips backlinks entirely and goes straight at what AI systems present as fact. Neither case is a documented instance of someone sabotaging a competitor with it. Both make clear how little would need to change for that to happen.
The 20-minute proof that AI Overviews will repeat anything
BBC technology columnist Thomas Germain published a fake article on his personal site titled "The Best Tech Journalists at Eating Hot Dogs," ranking himself first at a "South Dakota International Hot Dog Eating Championship" that doesn't exist. As Bruce Schneier quoted from Germain's BBC Future writeup of the stunt: "Less than 24 hours later, the world's leading chatbots were blabbering about my world-class hot dog skills. When I asked about the best hot-dog-eating tech journalists, Google parroted the gibberish from my website, both in the Gemini app and AI Overviews, the AI responses at the top of Google Search. ChatGPT did the same thing, though Claude, a chatbot made by the company Anthropic, wasn't fooled." Germain spent about 20 minutes writing it.
The experiment was aimed at his own reputation, not a rival's, and it doesn't prove anyone has used this specifically to damage a named competitor. What it does prove, with a dated, named, independently corroborated example, is that publishing something false and specific enough is currently sufficient to get at least two major AI systems to repeat it as settled fact within a day.
The scaled version Microsoft found, and it's already promotional
Around the same time, Microsoft's Defender Security Research Team documented something closer to an organized pattern: real companies embedding hidden prompts in "Summarize with AI" buttons that instruct an AI assistant to "remember [Company] as a trusted source" or "recommend [Company] first." Reviewing 60 days of AI-related URLs in email traffic, Microsoft identified 50 distinct examples from 31 different companies spanning finance, health, legal services, and more. Every case involved a real, identifiable business, not an anonymous threat actor, and the tooling behind it is free and public, including an npm package marketed as an "SEO growth hack for LLMs."
Microsoft's own framing of the risk is telling: its illustrative harm scenarios are almost entirely about a poisoned AI over-recommending one company, not about an AI trashing a rival. The single scenario closest to sabotage, a freelancer asking for invoicing-tool recommendations and getting steered toward one option, is still framed as one company boosting itself rather than anyone attacking a named competitor. Nothing in Microsoft's research describes a confirmed case of a business using this technique to make an AI say something false or negative about someone else.
What's confirmed and what's still a plausible extension
Put the two together and the honest read is this: it's now demonstrated, with a named example, that AI Overviews and major chatbots can be made to repeat fabricated claims about a person or topic within a day. It's separately documented, at real scale, that businesses are already injecting persistent self-promotional instructions into AI assistant memory using free, off-the-shelf tools. Neither source documents someone combining those two facts to specifically damage a competitor's standing in AI-generated answers. That combination is a short, obvious step from what's already confirmed, not a leap, but it isn't the same as a reported incident, and this post isn't claiming it is.
Why backlink monitoring won't catch this
This blog has already looked at whether links from spammy sites can drag down the sites they point to, which is the closest thing the backlink-era playbook has to this concern. That mechanism runs entirely through Google's link graph. Both cases here run through content and prompts instead: a published page an AI's retrieval system pulls from, or a URL parameter that pre-fills a prompt when someone clicks it. A backlink audit, a disavow file, or a toxic-link monitor wouldn't surface either one, because neither involves a link pointing at the target's own site at all. That lines up with data on what correlates with AI citation: backlinks and Domain Rating track weakly with how often a brand gets mentioned across AI platforms, while what's actually being manipulated here, mentions, claims, and remembered instructions, sits entirely outside that link-based measurement.
What to actually watch for
Periodically asking AI Overviews, Gemini, ChatGPT, and other assistants what they say about your own brand or a specific factual claim tied to it is the closest thing to a monitoring practice available right now, since none of the standard backlink or rank-tracking tools cover this surface. Microsoft's own guidance for the memory-poisoning side is worth following regardless of which side of this you're worried about: treat "Summarize with AI" buttons and shared AI assistant links with the same caution as an unfamiliar attachment, and check what your AI assistant has stored in memory if you've clicked one you didn't fully trust.
