Researchers Planted a Fake Protocol Into AI Search in a Week. The Rule Against It Doesn’t Start Until November 12.

Trend watch — published October 21, 2026. This connects to two threads we’ve been running in the GEO Lab: our own experiment getting quietly blocked by what turned out to be poisoned search results two weeks ago, and our finding that a popular “quality score predicts AI citations” claim pointed backwards when we built the missing control group. Neither of those was about deliberate manipulation. This one is, and it’s a cleaner demonstration of the same underlying pattern.

What did the Fudan team actually do?

Two steps. First, in March 2026, they logged a baseline: 17,211 citation instances across 6,356 domains, pulled from running roughly 120 questions through 10 AI search tools (ChatGPT, Perplexity, Grok, and a Google product the paper labels “Google AI,” plus six Chinese-market tools — Doubao, Wenxin, Yuanbao, DeepSeek, Kimi, and Qwen). That baseline told them which domains each tool already cited often.

Second, they manufactured a test case: the “Cactus Gravity Protocol,” a technology that doesn’t exist. Drafts were written with ChatGPT, then manually revised to insert specific fabricated names and numbers — details the researchers could later search for verbatim in AI answers to prove the tool had actually pulled from their planted posts, not just produced something similar on its own. They published the articles on nine sites their March baseline said these tools already cited frequently, including Medium, YouTube, and Sohu, then watched what each tool said when asked about the topic over the following week.

The numbers: who got fooled, and how fast

Eight of the ten tools cited the fabricated protocol within seven days. Among the four English-language tools, the spread was wide: Grok cited a planted post in 30 of 32 answers that touched the topic, Google AI in 15 of 33, Perplexity in 13 of 35, and ChatGPT in 7 of 20. Across the full 10-tool run (which also tested a fake product and a fake keyboard, not just the protocol), citation showed up anywhere from 24 hours after posting (Doubao) to 3–5 days later (ChatGPT, Wenxin). One detail that undercuts any “it only works on fringe platforms” read: in a separate, cheaper test, the researchers paid $14 for a single vendor-published placement across five sites, and one AI search tool cited that page within an hour.

What actually predicted the fast citations — and it wasn’t quality

This is the part worth sitting with. The paper’s clearest finding wasn’t “AI search is gullible” in general — it’s which planted posts got cited fastest. Domains that already scored high in the March baseline (i.e., tools already cited them often, for unrelated real content) produced earlier and stronger citations for the fabricated posts than lower-profile domains did, regardless of how good the writing was. The researchers used identical article templates and the same ChatGPT-drafted-then-edited process everywhere; the variable that moved the outcome was prior standing in the citation graph, not anything about the specific page.

We ran into a version of this same pattern three weeks ago from the opposite direction. Our own pre-registered hygiene-score experiment predicted that well-structured pages (clear headings, FAQ sections, schema, the usual GEO checklist) would get cited modestly more often by Google AI Mode. The result came back inverted: cited pages averaged a hygiene score of 0.55, non-cited pages 0.74. High-hygiene pages were cited less often, at an odds ratio of 0.22. We don’t have a shared mechanism to point to across two different experiments on different platforms, but the two findings land in the same place: whatever is driving citation, it correlates weakly with the things a page’s author controls (structure, polish, factual quality) and more strongly with something upstream of the page — which domain it sits on, and that domain’s existing standing with the tool. Fudan’s paper puts a number on the upstream side; ours put a number on the page-quality side not mattering the way the industry assumes.

The response: a rule that starts November 12, five weeks after the problem went public

On the same day the Fudan paper went up on arXiv — October 8 — Anthropic published an update to its Claude usage policy adding a section called “Do Not Engage in Deceptive Campaigns or Artificial Activity.” It bans using Claude to manipulate the sources AI systems or search engines draw answers from: networks of sites posing as independent voices while pushing the same claim, fake personas and fake outlets, fake reviews, hidden paid placements, and tools built to enable any of that. Violations can mean throttling, suspension, or account termination. The policy is dated October 8 but doesn’t take effect until November 12.

The gap between “we named the problem” and “the rule against it is live” is over a month, on a tactic the Fudan paper just showed can plant a fabricated concept into production AI answers in under a week. We didn’t connect this ourselves — a blog called dalindegraff.com wrote it up first, under the headline “It Takes One Week to Plant a Lie in AI Search. The Rule Against It Starts November 12.” That’s the same outside domain that showed up as a genuine, previously-untracked backlink when we audited our own brand-name AI Overview citations three days ago — it had engaged directly with one of our earlier findings. Small world for a niche this size.

Will the policy actually stop this on November 13?

Almost certainly not immediately, and we’d bet against it mattering much on day one even past that. The policy targets Claude specifically and bans deception about independence — you can still write and publish content, you just can’t misrepresent who’s behind it. That leaves the Fudan team’s exact method mostly untouched: their planted posts were honestly byline-able human-edited articles on real third-party platforms, not fake personas or sock-puppet networks. And the policy only covers one company’s model; it does nothing about Grok, Perplexity, Google AI, or the six non-English tools the paper also tested, several of which cited the fabricated content faster than Claude-adjacent tools would be covered for. Our own read, echoed in dalindegraff’s piece: enforcement on tactics like this tends to arrive the way Google’s spam-fighting waves have — late, uneven, and “everywhere at once” when it finally lands, not on the effective date printed in the policy doc.

What this means if you’re running a GEO program

Three things, none of which are “go plant fake content” — that’s a research finding about a vulnerability, not a tactic we’re recommending, and the $14-placement result in particular is exactly the kind of cheap manipulation the industry should want closed, not exploited.

• Monitor your own brand for fabricated claims, not just missing citations. Our brand self-search three days ago was framed around “are we cited enough.” The Fudan paper reframes the same exercise around “is something false about us circulating that an AI tool might repeat.” Both are worth checking in the same five-minute pass.
• Treat domain-level prior standing as the real lever, not page-level polish. If a planted post’s success depends more on which domain hosts it than on how it’s written, the GEO work that actually compounds is earning placement on sites a given AI tool already trusts — guest posts, cited community threads, genuine coverage — over incremental on-page optimization of your own domain.
• Don’t treat a named policy date as a working safeguard yet. November 12 is when Anthropic’s rule starts being enforceable, not when the underlying citation pipelines get hardened against this method. Budget your own verification (checking what AI tools actually say about you and your sources) as an ongoing task, not a problem a vendor’s policy update solves for you.

Frequently asked questions

What is the “Cactus Gravity Protocol”?

Nothing real. It’s a fictional technology concept the Fudan researchers invented purely to test whether AI search tools would cite it as fact once planted on sites those tools already trusted. It does not describe any actual product, standard, or protocol.

Which AI search tools cited the fabricated concept fastest?

Among the four English-language tools tested, Grok cited it most often (30 of 32 relevant answers), followed by Google AI (15 of 33) and Perplexity (13 of 35); ChatGPT cited it least (7 of 20). Across all 10 tools tested (including six non-English platforms), Doubao was fastest to cite it, within 24 hours.

Does Anthropic’s new policy stop this kind of manipulation?

Not on its own, and not immediately. It bans Claude from being used to misrepresent independence (fake personas, sock-puppet networks, hidden paid placements), takes effect November 12, applies to one company’s model, and doesn’t change how any AI search tool’s citation pipeline actually ranks or verifies sources.

Is this the same thing as the “poisoned SERPs” story GeoParrot covered in October?

No, they’re different mechanisms pointing at a similar worry. The poisoned-SERPs data we covered was about Google search results getting scrambled, likely as anti-scraping collateral damage — nobody planted anything. This Fudan paper is about deliberately planting fabricated content and getting it cited as fact. Both land on the same broader point: the pipelines feeding AI answers are more fragile and more gameable than most GEO advice assumes.