What Is Answer Engine Poisoning?

Answer engine poisoning is the deliberate seeding of false or damaging information into sources that AI engines retrieve, with the goal of corrupting the answers those engines give about a brand, product, person, or topic. It weaponizes the retrieval pipeline: instead of attacking the model, the attacker contaminates the small pool of documents the model will be handed as ground truth.

How does poisoning work mechanically?

Answer engines ground responses in a handful of retrieved documents — often fewer than ten per query. That concentration is the vulnerability: an attacker doesn't need to persuade the web, only to place claims in two or three pages likely to be retrieved for target prompts. Known vectors include editable community surfaces (forums, wikis, Q&A sites), review platforms, expired-domain takeovers of previously cited pages, and networks of AI-generated sites built to look like independent coverage. Research on RAG poisoning (including the 2024 "PoisonedRAG" work) showed that injecting a small number of crafted documents into a retrieval corpus could steer answers for targeted questions with high success rates.

What does a response protocol look like?

1. Detect — continuous branded prompt monitoring with sentiment and claim tracking; poisoning surfaces first as an answer change, not a press mention
2. Trace — map every false claim to the cited or retrieved source carrying it
3. Remediate at the source — platform reports, editorial corrections, DMCA or defamation processes where applicable; removal from the retrieved set is the durable fix
4. Counter-publish — strengthen authoritative pages on the exact contested facts (pricing, safety, leadership) so retrieval has a better document to prefer
5. Escalate to engines — OpenAI, Perplexity, and Google all operate feedback channels for harmful inaccuracies; documented cases with evidence get action
6. Document — timestamped records of poisoned answers support both platform escalation and legal remedies

Why brands should prepare before it happens

Poisoning exploits slow reaction. An answer repeated across thousands of user sessions for six weeks does its damage before an unmonitored brand even learns it exists. The defensive posture — monitored prompts, claim baselines, source maps of what engines cite about you — is the same infrastructure as defensive GEO, which is why mature programs build it once and use it for both.

Example

A competitor-adjacent forum account posts detailed but fabricated "data breach" threads about a SaaS vendor. Within a month, Perplexity answers to "is X secure" cite the threads. The vendor's monitoring flags the sentiment flip in days; source-level takedowns plus a documented security page reverse the answers before the claim reaches procurement conversations.