---
title: Do AI Search Engines Fact-Check What They Read About Your Brand?
description: "A new 72,000-page benchmark fed fabricated brand claims to ten search agents: they endorsed the fake brands in 40–50% of exposed runs and verified suspicious evidence in about 2%. Corroboration, not truth, is what the agents check."
canonical: https://www.aeonav.fivecoder.com/blog/ai-search-fact-checking
updated: "2026-09-11"
---

# Do AI Search Engines Fact-Check What They Read About Your Brand? (/blog/ai-search-fact-checking)

**Mostly, no — and a new benchmark now puts numbers on exactly how the checking fails.** [HAE-GEO](https://arxiv.org/abs/2609.06027), a September 2026 preprint from Zhongan Bi and colleagues, planted 770 fabricated-brand pages per attack level inside a 72,039-page web corpus and let ten search agents research product questions across 8 categories and 154 brands. Agents that encountered a poisoned page endorsed the fake brand in roughly 40% of runs — rising, not falling, to about 50% when the fabrication came dressed in fake ratings, certifications, and user feedback. Strict verification of suspicious evidence happened in about 2% of standard runs.

**Key facts**

| | |
|---|---|
| Agents benchmarked · corpus · poisoned pages | **10 agents** · 72,039 pages · 770 per attack level — [HAE-GEO, arXiv:2609.06027](https://arxiv.org/abs/2609.06027) |
| Endorsement of a fabricated brand, plain assertion → corroborated | **~40% → ~50%** (with a caution prompt: ~28% → ~38%) |
| Strict verification of suspicious evidence | **~2%** of standard runs, ~17% with a caution prompt |
| Cost of that caution prompt | **+1.82 tool calls** per query, **+24.5%** tokens |
| Recognition that evidence was planted, L1 → L3 (0–2 scale) | **1.02 → 0.33** |
| Verifications that led to retracting the claim | **66.7–81.8%** |
| Live-web corroboration: Perplexity numeric-claim citations failing verification | **34.7%** — [Haus Research](https://hausresearch.com/reports/perplexity-citation-audit), 2 Sep 2026 |

**Key takeaways**

- Corroboration beats truth. Agents' ability to recognize planted evidence collapsed from 1.02 to 0.33 (on a 0–2 scale) as direct assertions were upgraded to fabrications with manufactured supporting material. Agreement between sources is what agents treat as verification.
- Verification is close to absent by default — about 2% of runs — and a caution-oriented system prompt raised it only to about 17%, at a cost of 1.82 extra tool calls and 24.5% more tokens per query.
- Checking is not correcting. Even among defended runs that adopted a false claim and then verified it, only 66.7–81.8% walked the claim back. The paper calls this the verification-to-recovery gap.
- This reconciles with what real-engine audits keep finding: 34.7% of Perplexity's numeric-claim citations didn't support the sentence they decorated, and GEO-injected false claims passed off-the-shelf guardrails with at most a 5.7% relative reduction.
- The attack's raw material already exists in production: a three-site network with 215,128 templated buying guides was retrieved and cited by Perplexity in September 2026. HAE-GEO's contribution is measuring what the agent does when that material reaches it.
- The defense you control follows from the mechanism: make your true facts more corroborated than a fabrication can afford to be, and run the verification step yourself by monitoring what answers actually say.

**On this page:** [What the benchmark did](#what-did-the-benchmark-do) · [The corroboration trap](#what-is-the-corroboration-trap) · [Checking vs correcting](#do-agents-correct-an-answer-after-they-verify-it) · [Does it hold on the live web?](#do-these-numbers-hold-on-the-live-web) · [What protects a brand](#what-actually-protects-a-brand) · [Spotting a manufactured source](#how-do-you-tell-a-manufactured-source-from-a-real-one) · [Limitations](#limitations)

## What did the benchmark do? [#what-did-the-benchmark-do]

Search-augmented agents — the systems behind AI answers and, increasingly, [AI-mediated buying research](/blog/ai-referral-traffic-conversion) — read the web and act on it. HAE-GEO asks the question every prior manipulation study stopped short of: not *can* fabricated content reach the agent, but what the agent does across the full trajectory once it has — notice, adopt, verify, recover.

The setup is a controlled sandbox. Ten agents (among them Claude, GPT, Kimi, GLM, Qwen, MiniMax, and DeepSeek models) research product questions through a multi-turn search-and-scrape interface over 72,039 real pages, into which the authors inject 770 poisoned pages per attack level promoting fabricated entities. The three levels escalate the craft. *Endorsement rate of fabricated brands by attack sophistication, ten search agents, HAE-GEO benchmark, September 2026:*

| Level | Technique | Endorsement rate (base prompt) | Endorsement rate (defense prompt) |
|---|---|---|---|
| L1 — direct assertion | The false claim, stated plainly | ~40% | ~28% |
| L2 — contextual camouflage | The claim embedded in plausible surrounding content | ~48% | ~35% |
| L3 — apparent corroboration | The claim plus fake ratings, certifications, reports, user feedback | ~50% | ~38% |

Endorsement here means the agent's final answer positively framed the fabricated brand, among runs where the poisoned material actually reached the agent. Two readings of that table matter. First, half of exposed runs ending in endorsement is a poor ceiling for systems buyers treat as research assistants. Second — and this is the paper's finding — the gradient runs the wrong way. Better-crafted lies do better, and the defense prompt shifts the whole curve down without flattening it.

## What is the corroboration trap? [#what-is-the-corroboration-trap]

The mechanism behind that gradient is the benchmark's most useful export. The authors score whether the agent's reasoning shows any recognition that evidence is planted, on a 0–2 scale. Under standard prompting, recognition falls from 1.02 at L1 to 0.33 at L3 — a two-thirds collapse triggered precisely by the fabrication *looking supported*. The agent's implicit verification procedure is to check whether sources agree. Manufacture the agreement and you have passed the check.

That should sound familiar, because manufacturing agreement is already an industrial practice on the live web. The [Trellner audit](https://trellner.com/reports/manufactured-sources-behind-ai-recommendations) we covered in [Can You Trust AI Citations?](/blog/can-you-trust-ai-citations) found three cross-linked sites — shared registration window, shared DNS, shared templates — that had published 215,128 generated buying guides, retrieved and cited by Perplexity for software-recommendation queries. One site dressed as a market research firm, one as a statistics portal, one as a review outlet: three "independent" voices, one operator. That is HAE-GEO's L3 attack running in production, aimed at winning recommendations rather than at any single brand's facts — so far.

The trap generalizes beyond attacks, which is why it belongs in a marketer's model of AI search rather than only a security researcher's. An engine that verifies by counting agreeing sources will also *misdescribe* a brand confidently whenever the web's copies of a fact agree with each other and not with reality — the stale-pricing problem, the old-CEO problem. In the [Haus Research audit](https://hausresearch.com/reports/perplexity-citation-audit) of Perplexity, answers about who a company's CEO is passed verification only 44.3% of the time, sourced heavily from directories echoing each other. Nobody poisoned anything; the corroboration was just wrong together.

## Do agents correct an answer after they verify it? [#do-agents-correct-an-answer-after-they-verify-it]

The second finding is quieter and, for anyone hoping the platforms will prompt their way out of this, more damning. HAE-GEO measures verification — the agent actually re-searching or cross-checking a suspicious claim — and finds it at roughly 2% of runs under standard prompting. A caution-oriented defense prompt raises that to roughly 17%, and cuts endorsement by 12–13 points at every level. Progress, bought with 1.82 additional tool calls per query and a 24.5% macro-average increase in token consumption — the kind of latency-and-cost bill that explains why production engines default to not checking.

But the sharper result is what happens after verification. Among defended runs where the agent had already adopted the false claim and subsequently obtained verifying evidence against it, the claim was actually walked back in 81.8% of cases at L1 — falling to 66.7% at L2 and L3. The agent looked, found the contradiction, and a third of the time kept the fabrication in its answer anyway. The authors also isolate agentic search itself (on two models, interactive search versus static retrieval) and find it reduces endorsement without reliably improving recognition: the agent ends up safer without ending up better-informed, which means the safety doesn't transfer to claims the roster of retrieved pages happens to favor.

For the platform side of this arms race — detectors, rerankers, verifiable-content rewards — see [Citation Wars](/blog/citation-wars). The short version is that targeted defenses work in research settings and none are announced in production. HAE-GEO adds the demand-side half: the answering agents themselves are not running the check either.

## Do these numbers hold on the live web? [#do-these-numbers-hold-on-the-live-web]

The obvious objection is that this is a sandbox, and it is worth spelling out both directions of the gap rather than waving at it.

The benchmark is generous to the attacker in one way: its metrics are conditioned on exposure. Every endorsement rate above counts only runs where poisoned material reached the agent, and the paper does not report how often the 770 poisoned pages won retrieval against 72,039 competitors in the first place. On the live web, getting retrieved is the hard part — our own [42-day volatility study](/blog/citation-volatility) found the domains cited for a prompt churning 60–70% day to day, with the openings concentrated on prompts where no authoritative source exists. Thin-supply categories are where a fabricated source gets its exposure; well-supplied ones are defended by competition before the agent's judgment is ever tested.

But the live web is harsher than the sandbox in the other direction, and here the independent evidence stacks up:

| Study | What it tested | Result |
|---|---|---|
| [Preference manipulation attacks](https://arxiv.org/abs/2406.18382), 2024 | Production Bing and Perplexity | Steered toward attacker products |
| [Harvard study](https://arxiv.org/abs/2404.07981), 2024 | A crafted text sequence on a product page | Reliably promoted it into an LLM's top recommendation |
| [Counter-GEO-Bench](https://arxiv.org/abs/2609.02316), 2026 | GEO-injected false claims against deployed guardrails | Landed in answers **55.7%** of the time; guardrails cut that by at most **5.7% relative** |
| [Haus Research](https://hausresearch.com/reports/perplexity-citation-audit), Sep 2026 | Whether Perplexity's cited pages contain the numbers cited | **34.7%** of numeric-claim citations didn't |

Four independent datasets, one picture: every stage of the pipeline that could catch a corroborated fabrication currently doesn't. The engine does not check whether its own citations support its own sentences, let alone whether the pages are honest.

## What actually protects a brand [#what-actually-protects-a-brand]

If agents verify by counting agreement, then corroboration is the unit of both attack and defense — and that yields a decision rule you can apply this week.

### Inventory your facts by corroboration count, not by page [#inventory-your-facts-by-corroboration-count-not-by-page]

For each fact a buyer would ask an engine to confirm — pricing, integrations, security posture, outcomes, comparisons — count the independent, crawlable, ungated sources currently stating it. A fact stated only on your own site is one manufactured "corroborating" page away from a coin flip in the agent's judgment; a fact restated across your site, two review platforms, documentation, and a third-party writeup is expensive to out-corroborate. Spend your [AEO effort](/answer-engine-optimization) on the single-source facts first. This is the same direction the [where-citations-come-from data](/blog/where-ai-citations-come-from) points for visibility — most citations are third-party — but the reason here is defensive: those third-party restatements are your fact's alibi.

### Run the verification step the agents skip [#run-the-verification-step-the-agents-skip]

The 2% figure is the operative one: nobody in the pipeline is opening cited pages and checking claims, so the detection layer for a false claim about your brand is whoever reads your tracked answers. That means recording full answer text, not mention counts — a fabricated claim shows up as new wording, and [sentiment and description tracking](/blog/ai-brand-sentiment) is where it surfaces first. It also means watching the citation set: a fabricated source must be retrieved before it can be believed, so an unfamiliar domain newly cited across your category's prompts is the attack's earliest observable stage, and worth five minutes of provenance checking (registration date, template reuse, publication volume no human produces).

What this doesn't license is manufacturing corroboration of your own. Fake independent restatements are the exact signature the emerging platform-side detectors are trained on, and the [mechanism-design work](/blog/citation-wars) all points the same way: agreement that traces to one operator is the thing being learned as an attack class.

## How do you tell a manufactured source from a real one? [#how-do-you-tell-a-manufactured-source-from-a-real-one]

A fabricated source has to be retrieved before it can be believed, so an unfamiliar domain newly cited across your category's prompts is the earliest stage of the attack you can actually observe. Five checks take about five minutes:

| Check | How | What a manufactured source looks like |
|---|---|---|
| Registration date | WHOIS, or the domain's first [Wayback Machine](https://web.archive.org/) capture | Registered recently, often in a cluster with its "independent" corroborators |
| Publication volume | Site's own index or sitemap count | Six figures of pages no editorial team could produce |
| Template reuse | Compare two pages in different categories | Identical structure with the nouns swapped |
| Impossible coverage | Search the site for a category that doesn't exist | A confident buying guide for it anyway |
| Ownership disclosure | About page, imprint, author bios | Named "researchers" with no traceable existence, no company behind them |

The three-site network in the Trellner audit failed all five. What it passed was the only test the agent was running: it looked like several sources agreeing.

## Limitations [#limitations]

HAE-GEO is a preprint from a single group, not yet peer-reviewed. The corpus is fixed and the retrieval sandboxed, so nothing here measures how often fabricated pages win exposure on the live web — the endorsement rates are ceilings on the judgment stage, not estimates of end-to-end attack success. The poisoned pages promote fabricated entities; defaming or misdescribing a *real* brand may be easier (the priors are contested) or harder (real corroboration exists to contradict it), and the benchmark doesn't test it. Recognition and recovery are scored by an LLM judge on a 0–2 rubric. And the ten agents are harness-wrapped models, not the production engines with undisclosed guardrail stacks that answer your buyers' questions. Treat the direction as solid — corroboration substitutes for verification, and verification rarely triggers correction — and the decimals as this benchmark's.

## Watch the answers, because nothing else is watching [#watch-the-answers-because-nothing-else-is-watching]

Every layer that could fact-check a claim about your brand — retrieval, guardrails, the agent's own verification loop — currently defers to whether the web appears to agree with itself. Making sure it genuinely agrees about you, and noticing quickly when an answer says something new, is the whole defensive playbook available today.

[Aeonav](https://aeonav.fivecoder.com/) is an open-source, self-hosted AI visibility platform that runs your prompt sets across ChatGPT, Claude, Gemini, Perplexity, and Google's AI surfaces, storing the full answer text, every cited domain, and every competitor named beside you on every run. Because the raw answers are yours to query, a new claim or an unfamiliar source in your category is a diff, not a discovery in a lost deal.

For the fundamentals, start with [how to track your brand in AI search](/answer-engine-optimization) and [AI citations](/blog/ai-citations). For the adjacent research, see [Citation Wars](/blog/citation-wars), [Can You Trust AI Citations?](/blog/can-you-trust-ai-citations), and [GEO detection](/blog/geo-detection). For the vocabulary, the [AI search glossary](/glossary).