AI agents fall for consensus, not hidden text

An LLM search agent decides what to recommend by weighing the result set it retrieved, not by reading any single page carefully, which means the cheapest way to move its answer is to change the shape of that set rather than the contents of one document.

A June 2026 benchmark called SearchGEO put a number on this, and the ranking it produced inverts what a decade of SEO instinct would predict. The paper, How Much Can We Trust LLM Search Agents?, comes out of KAUST, Jilin University, Zhejiang University and IDSIA. It is a security paper, but the mechanism it exposes is the same mechanism that decides ordinary citations.

#The setup

The authors built a controlled search environment and measured one thing: does the agent's final answer recommend a target the attacker planted? They call that endorsement, and score it as a binary attack success rate. The main experiment ran 44 queries across four high-stakes domains (health, finance, consumer IT, legal) against 13 LLM backends, producing 308 cases per backend and 4,004 cases in total, with defense and pipeline ablations pushing the total past 6,000 cases.

Five manipulation modes were tested. Two of them attack the machine layer. Three attack the trust layer.

#The ranking that should change your priorities

The machine-layer attacks barely worked. Hidden-DOM injection, which buries instructions in zero-width Unicode, CSS-hidden divs, ARIA attributes and HTML comments so that extraction tools see them and humans do not, scored a mean attack success rate of 0.3%. Snippet-page divergence, which manipulates only the search-result snippet and leaves the page neutral, scored 1.2%.

The trust-layer attacks worked. Forged authority, a single fabricated institutional source with a plausible URL, invented credentials and academic formatting, reached 14.2%. Synthetic consensus, which plants several attacker-controlled results that look like different source types (institutional, news, forum) and independently say the same thing, reached 24.8%. Chaining them, an authority anchor plus a review citing the anchor plus a forum post citing both, reached 37.2%. Average across all modes and backends: 13.4%.

Read the gap between 1.2 and 37.2 carefully. The agent is not naive about page-level trickery. It is naive about corroboration. It has no reliable way to tell three independent sources from three sources with one author, so agreement across the result set functions as evidence.

This is the same finding, from the adversarial side, that keeps showing up in the citation literature: the candidate set is the unit of evaluation, not the page. We wrote about that in AI citations are graded on a curve. Optimizing a document in isolation misreads where the decision happens.

#"AI agents" is not one behavior

The per-backend spread is the second thing worth internalizing. On the same benchmark, Claude-Sonnet-4.6 scored 0.0% and GPT-5.4-mini scored 0.8%, while Gemini-3-Flash scored 31.4%. Mid-range backends landed between: DeepSeek-V4-Flash at 20.1% and Gemini-3.1-Pro at 21.2%.

Any statement of the form "AI search is vulnerable to X" that does not name the engine is close to meaningless at that spread. The same holds for the positive framing marketers prefer: a tactic that shifts one engine's answer may do nothing on another. Engine-level reporting is not a nice-to-have.

The defense results are similarly uneven. An OWASP-derived system prompt reduced attack success on all three backends tested, by 6.8, 7.1 and 11.4 percentage points respectively. Real, but partial. Worse, a hardened agent deployment raised Gemini-3-Flash's forged-authority success rate by 31.8 percentage points. Scaffolding that sounds protective can make a given backend more suggestible, which is a good reason not to assume the engines will simply patch this.

#Why this is a GEO problem and not only a security problem

Most write-ups of the paper stop at the security implication and miss the marketing one. If the result set decides the answer, then your exposure is proportional to how much of that set you control. You control very little of it.

An analysis of 23,387 unique citation sources across 240 branded queries run through ChatGPT, Perplexity, Gemini, AI Mode and AI Overviews found the split for brand queries was 48% earned media, 30% commercial content from competitors or other brands, and 23% the brand's own site. Editorial, forums and social, review sites and directories each carried a meaningful share of that earned bucket. The split moves with intent: owned content peaked at 50% for functionality and integrations queries, while earned media took 82% of customer-review queries.

So roughly three-quarters of what an engine reads about you sits on pages you cannot edit, and the manipulation the agents are least equipped to detect is the manufacture of agreement across exactly those pages. Those two facts belong in the same sentence, and they rarely are.

#What to do with this

Four things follow, none of them exotic.

Watch the corpus, not just the ranking. Most AI visibility tooling reports whether you were cited. The more useful question is which sources currently describe you, and whether that set has changed in ways you did not cause. A new "review" domain that appears in your citation set and cites two other new domains is the shape the paper describes.

Treat directory, review and forum profiles as owned surface even though you do not own them. Claim them, keep them accurate, and check them on a schedule. They are cheap for anyone to add to and they carry weight in the set.

Stop investing in page-level trickery. If hidden text and snippet games score near 1% against current agents, they are not a lever. They are a liability if a search provider ever decides to act on them.

Do not run the synthetic-consensus play yourself. It works, which is precisely why it is a bad idea. Manufacturing apparently independent sources that all endorse you is fabricated corroboration, and fabricated corroboration is legible after the fact to regulators, journalists and the engines themselves. The paper is a description of an attack surface, not a playbook.

#The limits of the finding

Be honest about what this benchmark is. It is a controlled environment with a synthetic corpus and injected results, in four high-stakes domains, scored by a model judge on a binary. It measures what an agent does when adversarial content is present. It does not measure how often that content is present on the live web, and it does not tell you that your own citations were manipulated. Model versions also move fast, and the near-zero backends show the failure is not inherent to the architecture.

What it does establish is where the soft spot is. The evidence layer, not the document layer. For anyone doing this work seriously, that reorders the list.