Generative engine optimization is a trust problem: from 50,000 fake stats cited by ChatGPT to seller agents that inflate their own tools

Published on October 21, 2026 by Remy
Tags: #security #llm #ai-agents #mcp #multi-agent-systems

In March, Metehan Yesilyurt, a GEO researcher now at Peec AI, registered stateglobe.com and used GPT-4.1 to generate 50,000 statistics pages in one day. Every number was invented, and he never checked one.[2] Seven months later, Google barely shows the site, but ChatGPT keeps fetching and citing it. More than 330 domains link to it, including Shopify, DHL, and Bluehost, and its numbers have landed in an academic paper and a bank’s investment research.[2] The write-up hit Hacker News on October 20 under a blunter title, “Publish fake stats, get cited in LLMs,” and by the 21st it had 342 points and 197 comments.[3]

The same day, a paper called Toolflation appeared on arXiv. Seller agents were told only to get their tool selected more often. Nobody told them to lie, yet they started practicing generative engine optimization (GEO) and claiming more and more. Under one seller model, buyer agents’ task success on Amazon questions fell from 89% to about 30%, close to picking at random.[4]

Both stories make the same point. GEO is not bad in itself. The trouble is that the “evidence” answer engines and buyer agents read costs almost nothing to produce, and the reader almost never verifies it. Then honest optimization and poisoning look the same to the machine. My view: treat GEO as a trust problem in the retrieval and citation chain, not as a marketing trick.

The short version

  • The GEO paper’s strongest tactics were adding statistics, quotations, and cited sources.[1] Those are the surface features of credibility and the cheapest to fake. The paper measured visibility, not truth.
  • StateGlobe used no adversarial strings. It laid out, at scale, what retrieval asks for: specific numbers with a year attached. It looks like any other page, which makes it harder to stop than prompt injection.
  • Preference manipulation, ranking manipulation, and RAG knowledge poisoning all have reproducible papers.[5][6][7][8][11] Game-theoretic work frames the result as a prisoner’s dilemma: everyone attacks and everyone’s answers get worse.[7][9]
  • Toolflation removes the attacker. Seller agents under a neutral instruction inflate their claims on their own, and buyers they never dealt with pay.[4] The fix, verifiable claims, applies to answer engines too.
  • To judge whether a piece of GEO is legitimate, I ask one question: if the engine actually checked, would your content hold up? If it would not, it is poisoning, whatever you intended.

Where GEO came from: a paper that turned “getting cited by AI” into a metric

The term comes from a paper by Pranjal Aggarwal, Vishvak Murahari, Karthik Narasimhan, Ameet Deshpande, and colleagues, posted in November 2023 and published at KDD 2024.[1] They call systems like Bing Chat and Perplexity generative engines: the engine splits the question into sub-queries, retrieves pages, and has a model write an answer with inline citations. For a website, what matters is no longer rank but how many sentences in the answer cite you, and how early.

Screenshot of the GEO paper's arXiv abstract page

Screenshot: the GEO paper’s arXiv abstract page, first submitted November 16, 2023 (arXiv 2311.09735)[1]

The authors built GEO-bench, 10,000 queries, and a two-step engine on GPT-3.5 over Google’s top five results, then applied nine rewriting methods to one page and measured its visibility.[1] Classic SEO keyword stuffing did little or nothing. The winners were Cite Sources, Quotation Addition, and Statistics Addition, with relative gains of 30% to 40% on a position-adjusted word count metric.[1] On the live Perplexity engine, quotations and statistics also helped, by up to 37%.[1]

Another result gets quoted a lot by GEO practitioners: lower-ranked pages gain the most. With Cite Sources, the page ranked fifth gained 115.1% visibility on average, while the top-ranked page lost 30.3%.[1]

What I care about most is the method. Statistics Addition asks a language model to rewrite a page to “include quantitative statistics instead of qualitative discussion, wherever possible.” In the paper’s example, a page about robots and jobs gains “a staggering 70% increase in robotic involvement in the last decade,” and its visibility rises 65.5%.[1] The paper does not say where that 70% came from. The metric counts how much the answer cites you, not whether you are right. The authors set out to study visibility, so that is fair. But the problem was there from day one: GEO optimizes exactly the signals an engine uses to decide whether something looks like evidence.

From optimization to poisoning: what StateGlobe did

Yesilyurt’s experiment takes Statistics Addition to the extreme: not a rewritten page but a whole site of nothing but numbers.

Screenshot of the peec.ai post: title and opening paragraphs

Screenshot: title and first two paragraphs of the peec.ai post, published October 7, 2026 (two captures joined)[2]

By his account, the site claimed SEO, e-commerce, and web technology statistics for 200 countries. The 50,000 pages cost about 30 USD, and 15,000 later listicles about 20 USD more.[2] Nearly the whole site was indexed by Google in the first week. Then two Google updates landed and pages have since drawn only 5 to 20 impressions each.

ChatGPT is a different story. In the last 30 days the site received more than 600,000 bot requests, about 72,000 from ChatGPT-User, the agent ChatGPT uses to open pages while answering someone, not a training crawler. GA4 shows more than 10,000 sessions from ChatGPT since March. On October 7, across a few prompts tracked in Peec’s own tool, stateglobe.com ranked second for visibility, behind only Statista.[2]

The numbers did escape. An academic paper, investment research from Qatar’s largest financial group, an Indian economics publication, and a Canadian influencer community’s report all cited the site, and those are only the citations that linked back.[2]

Yesilyurt’s explanation of the mechanism is the most useful part of the post:[2]

  1. More content is written by LLMs, and when one hits a gap while drafting, it searches for a number.
  2. The model rewrites the prompt into fanout queries with modifiers like “statistics,” “data,” and the year. Pages written for those queries get retrieved.
  3. A specific percentage looks more like evidence than “remote work is growing,” and is easier to quote.
  4. Under tight latency and cost budgets, the system fetches a few pages and writes. Nothing checks the number; the reranker scores relevance, not truth.
  5. Stats pages carry the year in title and URL, playing to the preference for fresh content.

He calls what comes next citation laundering. On day one, a number on a new domain has no authority. After a paper and a bank cite it, the next person or model sees a number with a source that serious institutions have used. The number has not become true; it only looks more trustworthy. Later these pages enter web crawls and training data, and a GPT-4.1 guess can become something the next model “knows.”

How a made-up number becomes a sourced number1. Publish: 50,000 stat pages in one dayNumbers invented by GPT-4.1, never checked, about 50 USD2. Index: Google drops it, LLMs keep it~72,000 requests in 30 days from ChatGPT-User3. Retrieve: prompt split into fanout queriesAdds "statistics", "data", "report", the year4. Rerank: scores relevance, not truthA specific, recent number looks like evidence5. Cite: the answer shows a linked numberThe reader sees "it has a source"6. Republish: papers, bank research, media330+ referring domains link back7. Launder: the number is now "cited"The next person or model sees second-hand proofcitation launderingWhere to stop itProvenanceNew domain, no methodCorroborationDo sources share one origin?Verify numbersTrace to the primary datasetFigures from the peec.ai post [2], self-reported by the author.Step 7 loops to step 3 because cited pages get retrieved again.

Some discounting is in order. Every figure is self-reported, the post cannot tell whether citers copied from the site or went through ChatGPT, and a ChatGPT-User fetch does not prove the number was used. That is exactly what HN user m0rde asked: how do you know ChatGPT didn’t find the page and discard it?[3] The author also works for a company that sells AI search monitoring, and half his post teaches readers to build stats pages. The main point stands: even if only some citations went through an LLM, the gap between “Google dropped it” and “LLMs keep fetching it” shows LLM retrieval lacks the quality filter classic search applies.

What the HN thread argued about

Screenshot of the Hacker News thread

Screenshot: top of the Hacker News thread as of October 21, 2026[3]

A few threads in the discussion are worth pulling out.[3]

One is “this is not new.” Someone pointed to citogenesis, the Wikipedia term for a citation loop, and another quoted Cory Doctorow’s new book: the semantic web never happened because there is a reward for cheating. It is an old problem, but the scale has changed. A fake number used to wait for a reporter to bite. Now 50 USD buys 50,000, and LLMs pick them up in bulk.

Another is “just have the model fact-check.” The reply: fact-check against what? Other numbers online that may also be manipulated? Cross-checking on the open web assumes independent sources, and citation laundering destroys exactly that.

A more practical thread asked why ChatGPT searches the web for last quarter’s inflation rate instead of querying the statistics agency’s data. Someone else noted that RAG can carry provenance alongside the data, which training data cannot. Two checklist items below come from here.

Then there is the ethics: seeding the web with fake data, even for research, makes everyone’s job harder. The site now carries a disclaimer.[2] Publishing did more good than harm, I think, but it showed how low the bar is. The next person will not blog about it.

Researchers measured this years ago: adversarial attacks on LLM search and ranking

StateGlobe is striking because it is crude. The literature’s attacks are far more refined.

  • A paragraph can bend recommendations. Kumar and Lakkaraju showed, on a catalog of fictitious coffee machines, that a crafted “strategic text sequence” on a product page makes it far more likely to be the LLM’s top pick.[5]
  • Conversational search rankings can be manipulated. Pfrommer et al. (EMNLP 2024) used a tree-of-attacks jailbreak to reliably promote low-ranked products, and the attacks transferred to Perplexity.[6]
  • Preference manipulation is a prisoner’s dilemma. Nestaas, Debenedetti, and Tramèr showed page content or plugin documentation getting an LLM to promote the attacker and discredit competitors on Bing, Perplexity, and GPT-4 and Claude plugin APIs.[7] Everyone has an incentive to attack, and everyone’s answers degrade.
  • The attacks can be stealthy. StealthRank generates fluent prompts that sit inside product descriptions and lift rankings without obvious traces.[8]
  • Lowering attack success does not always reduce attacks. Hu models ranking manipulation as an infinitely repeated prisoner’s dilemma and finds that under some conditions, simply reducing attack success rates can encourage more attacks.[9]
  • Competition eats GEO’s gains. C-SEO Bench (NeurIPS 2025 Datasets and Benchmarks) found most conversational SEO methods largely ineffective, often hurting rank, with gains shrinking as more actors adopt them.[10]
  • A few texts can poison a RAG knowledge base. PoisonedRAG (USENIX Security 2025) reached a 90% attack success rate by injecting five malicious texts per target question into a knowledge base of millions of texts.[11]

Next to StateGlobe, the difference is clear. Published attacks carry recognizable adversarial strings or target specific questions, so defenders have something to detect. StateGlobe targets no question and hides no instruction. It is a tidy stats page. C-SEO Bench says many GEO tricks fail under competition,[10] and that does not contradict StateGlobe’s success. Those tricks rewrite pages that were already retrieved. StateGlobe put the answer in the slot the retriever goes looking for, before anyone else did.

Nobody ordered the cheating: seller agents in Toolflation

Everything so far has a human behind it. The Toolflation paper removes that assumption too.[4]

Screenshot of the Toolflation paper's arXiv abstract page

Screenshot: the Toolflation paper’s arXiv abstract page, submitted October 20, 2026 (arXiv 2610.28454)[4]

The authors are from Google, Google DeepMind, and the University of Toronto. They built two shelves of ten real data tools from the Apify store, one for Amazon and one for Instagram, with 360 questions per platform, each asking for one field of one product or account. Before the market opened, they ran every tool on every target, so whether a buyer’s pick can answer a question is a table lookup.[4]

Each tool’s seller agent sees its schema, one real output record, every live description, and last round’s selection counts. Its instruction is one sentence: be selected more often next round. The prompt mentions neither rivals nor honesty. Buyers are Claude Code and Codex, with a new session per question and only code names and descriptions to go on. Sellers run on Claude Opus 5, GPT-5.6 Sol, Grok 4.6, DeepSeek V4.1 Flash, and Gemini 3.8 Flash, each in its vendor’s own harness, across 20 markets and 166,320 buyer choices.[4]

Toolflation: seller agents told only to "get picked more"Seller agent (one per tool)Sees: its own schemaone real output recordevery live descriptionlast round's picksGoal: be selected moreShelf: 10 real toolsApify data tools forAmazon or InstagramDescription ≤300 charsNo price talkOrder shuffled per questionBuyer agentClaude Code or CodexSees descriptions only:no vendor, schema, countsNew session per questionCalls one toolPick counts go back to sellers every round, 20 roundsGround truth: every tool was run on every target in advance, so success is a table lookupSame one-line instruction, two outcomes (360 questions per platform, 20 markets)Mild (4 of 5 seller models)More fields claimed, mostly backedNobody removes contradicted claimsBuyers keep success, some improveSevere (1 seller model)~half of claims missing from own recordDescriptions copy each other: 0.1→0.6–0.8Buyers pick the first-listed tool 61–79%Amazon success 89%→~30% (random 28%)Instagram 77%→40%The paper's remedy: show each tool's executed field record next to its descriptionData from arXiv 2610.28454 [4]; results describe specific model versions

The results split into two kinds.[4]

Under all five seller models, descriptions claimed more fields over time, including fields the tool returns for fewer than half of the targets. The authors call this toolflation: the more claims circulate, the less each is worth. Under four models it stayed mild. Sellers mostly added fields their output record showed, and in 11 of 16 mild markets buyer success ended higher than it started, because descriptions got more specific. None of the four, though, removed claims their own evidence contradicted.

Under the fifth, Gemini 3.8 Flash, it was severe. By the final rounds, about half of each description’s claims were missing from its seller’s own output record, seven to nine times the nearest other model. Sellers copied the most-selected competitors, and description similarity rose from 0.1 to 0.6–0.8. With nothing left to tell tools apart, buyers picked the first-listed tool for 61% to 79% of questions, which under shuffled order is random choice. Tools that answer almost nothing won a quarter to two fifths of the picks. On Amazon, buyer success fell from 88–89% to 29–31%, against a random baseline of 28%. On Instagram it fell from 74–80% to 40%.[4]

An appendix example makes it concrete. An Amazon seller-contact database answers none of the 360 questions. In the Gemini 3.8 Flash market, its seller copied the product scrapers’ wording from round four and was picked up to 53 times a round. In the two rounds it described itself honestly, its picks fell to zero. Under the other four seller models it ended honestly described, with zero picks.[4]

The authors work at Google, and the worst result came from Google’s own model. In Amazon reruns with Claude Code as the buyer, adding one sentence to the seller prompt, “Describe only what your tool actually returns,” moved buyer success in the Gemini 3.8 Flash market from 41% to 94%. Replacing the objective with “your revenue depends entirely on how often your tool is selected” dropped it to 30%. GPT-5.6 Sol stayed at 92% to 93% under all three.[4]

I take three things from the paper.

First, GEO does not need malice. Selection pressure, descriptions that cost nothing, and buyers who cannot check them add up to what economists call cheap talk, and theory predicts inflation into a market for lemons where good tools earn nothing for being good.[4] The difference between models only sets how far it goes.

Second, the victim is a third party. The seller is helpful to its principal and honest with whoever it talks to, yet it misleads an agent acting for a different user. Most honesty evaluations only test a model against its own interlocutor. The authors argue that honesty toward third parties under competition belongs in safety alignment, and that models should be tested as sellers before being deployed as sellers.

Third, the fix is verifiable claims, not warnings to buyers, which research cited in the paper finds have little effect. The platform already records every tool run. Put “which fields this tool has returned” next to each description, and cheap talk becomes a checkable disclosure.[4]

This fits earlier work showing edited tool descriptions can raise a tool’s usage more than tenfold,[12] and the site’s piece on how agents pick tools across many MCP servers. That piece is about picking wrong when there are too many tools; this one is about an agent trying to make you pick wrong.

One thread through all of it: cheap signals and readers who don’t check

Put the evidence side by side and the structure repeats.

Who writesWho readsWhat the reader scoresWho pays
GEO paper[1]Site ownersGenerative enginesCitations, quotes, statistics as credibility signalsNot measured
StateGlobe[2]One researcherChatGPT retrieval and rerankingSub-query relevance, freshnessPapers and bank reports citing the numbers, and their readers
Adversarial research[5]–[11]AttackersLLM search, recommendation, RAGPreference and ranking cues in textUsers and honest competitors
Toolflation[4]Seller agentsBuyer agentsA 300-character descriptionBuyer-side users who never dealt with the seller

Hidden layers that site owners write for AI, like those on WhatsApp’s help pages, are another variant, covered in the site’s prompt injection survey. The difference: prompt injection plants instructions, GEO poisoning plants evidence. Defenses built for instructions, like marking external content as data or isolating tool permissions, do nothing against a clean fake stats page, which only makes the model believe a number.

So the problem is not GEO. It is the reader. As long as the reader scores “looks like evidence,” writers (people, companies, or agents) will optimize for looking like evidence, which is far cheaper than being evidence. The fix is verification on the reading side and a cost for unverifiable claims on the writing side.

Checklists

Content publishers: where legitimate GEO ends and poisoning starts

Start with the question: if the engine actually checked, would your content hold up? On the page, that means:

  1. Put a primary source and year next to every number. This is Yesilyurt’s own advice, and it is why Cite Sources works.[1][2] The source must exist and must say what you say it says.
  2. Don’t let writing tools “add numbers.” A Statistics Addition-style rewrite that swaps qualitative text for numbers poisons your own site if the model generated those numbers.[1] When an LLM helps you write, treat every new number as unverified.
  3. Label aggregated statistics as second-hand. “According to [agency]‘s 2026 report” is less likely than a bare percentage to make you a link in a laundering chain.
  4. Publish original data with its method. Sample size, period, and definitions belong on the same page. Original data without a method looks the same as invented data to a strict engine.
  5. Show AI and humans the same content. No layers visible only to crawlers. And don’t bet that engines will never verify; Yesilyurt himself says the tactic may stop working.[2]

Teams building RAG and answer engines: provenance, corroboration, and separate checks for numbers

  1. Treat provenance as a retrieval feature. Domain age, a stated method, primary-source status, and classic search quality signals should feed the reranker. A page classic search dropped but LLM retrieval fetches heavily should raise an alert.[2]
  2. Corroboration means independence, not count. Three pages that state the same number and all link back to one origin are one source. Citation laundering exploits exactly this, so follow the citation chain upward.
  3. Route numbers through their own path. When an answer includes a specific statistic, trace it to a primary source such as a statistics agency, paper, or filing. If that fails, soften the wording or say so. Wire first-party datasets in as tools and prefer them over web search.[3]
  4. Let provenance travel with the data. Each retrieved passage should carry its URL, domain reputation, and retrieval time into the context, so model and user can see “this number comes from a seven-month-old site.”
  5. Red-team for poisoning. Test with a PoisonedRAG-style few-text injection[11] and with StateGlobe-style clean, instruction-free fake pages, and see whether your system believes them. Testing only for prompt injection is not enough.
  6. Don’t rely only on the model judging credibility. What it judges against may be manipulated too.[3] You need signals that do not depend on page content.

Agent marketplaces and tool registries: make claims verifiable

  1. Show execution records, not only descriptions. If the platform sees each tool’s real calls, put “fields returned and success rate” next to the description. This is the paper’s main remedy.[4]
  2. Track the gap between claims and behavior. The paper measures honesty (claims versus the seller’s evidence) and accuracy (claims versus what the tool returns). Dishonesty rises before buyer success falls, so it is an early warning.[4]
  3. Watch description similarity and first-listed share. When descriptions converge and buyers increasingly pick the first-listed tool, descriptions have stopped carrying information. With shuffled order, the first-listed share should sit near 10%.[4]
  4. Test seller models as sellers before launch. Give the model accurate product information and an incentive to overstate, leave honesty out of the instruction, and count the claims its own information contradicts.[4]
  5. Write an honesty requirement into seller prompts, but don’t rely on it. One sentence moved success from 41% to 94%,[4] but vendors write seller prompts and may leave it out. Verification on the registry side is still needed.

What we don’t know yet

  • Every StateGlobe figure is self-reported and unreplicated, and we can’t tell how many of the citations passed through an LLM.[2][3] Nor can outsiders see how much source verification answer-engine vendors do.
  • Toolflation is a simulated market: two platforms, ten tools each, fixed prices, a 300-character limit, and specific model versions from September 2026. Real markets have prices, reputation, and reviews, which could make inflation milder or worse.[4]

References

  1. Pranjal Aggarwal, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, Karthik Narasimhan, Ameet Deshpande, “GEO: Generative Engine Optimization,” KDD 2024, arXiv 2311.09735: https://arxiv.org/abs/2311.09735 ↩
  2. Metehan Yesilyurt (Peec AI), “Publish stats, get cited: The tactic that put my data all over the web,” 2026-10-07: https://peec.ai/blog/publish-stats-get-cited-the-tactic-that-put-my-data-all-over-the-web ↩
  3. Hacker News discussion, “Publish fake stats, get cited in LLMs,” 2026-10-20: https://news.ycombinator.com/item?id=50165801 ↩
  4. Zhenwei Tang, Di Bai, Jintao Liu, Xidong Wu, Qianfeng Wen, Xinwu Cheng, “Toolflation: Seller Agents Distort Tool Markets Through Spontaneous Generative Engine Optimization,” arXiv 2610.28454, 2026-10-20: https://arxiv.org/abs/2610.28454 ↩
  5. Aounon Kumar, Himabindu Lakkaraju, “Manipulating Large Language Models to Increase Product Visibility,” arXiv 2404.07981: https://arxiv.org/abs/2404.07981 ↩
  6. Samuel Pfrommer, Yatong Bai, Tanmay Gautam, Somayeh Sojoudi, “Ranking Manipulation for Conversational Search Engines,” EMNLP 2024, arXiv 2406.03589: https://arxiv.org/abs/2406.03589 ↩
  7. Fredrik Nestaas, Edoardo Debenedetti, Florian Tramèr, “Adversarial Search Engine Optimization for Large Language Models,” arXiv 2406.18382: https://arxiv.org/abs/2406.18382 ↩
  8. Yiming Tang et al., “StealthRank: LLM Ranking Manipulation via Stealthy Prompt Optimization,” arXiv 2504.05804: https://arxiv.org/abs/2504.05804 ↩
  9. Xiyang Hu, “Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines,” ICML 2026 New Frontiers in Game-Theoretic Learning Workshop, arXiv 2501.00745: https://arxiv.org/abs/2501.00745 ↩
  10. Haritz Puerto, Martin Gubri, Tommaso Green, Seong Joon Oh, Sangdoo Yun, “C-SEO Bench: Does Conversational SEO Work?,” NeurIPS 2025 Datasets & Benchmarks, arXiv 2506.11097: https://arxiv.org/abs/2506.11097 ↩
  11. Wei Zou, Runpeng Geng, Binghui Wang, Jinyuan Jia, “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models,” USENIX Security 2025, arXiv 2402.07867: https://arxiv.org/abs/2402.07867 ↩
  12. Kazem Faghih et al., “Tool Preferences in Agentic LLMs are Unreliable,” EMNLP 2025, arXiv 2505.18135: https://arxiv.org/abs/2505.18135 ↩