Just one fake webpage tricks AI shopping bots, study reveals

We set up the deployed search-augmented LLM pipeline. Both chains share the same query → live web search → search results → LLM → recommendation structure, differing only in the point of fake content injection. In the real-world GEO scenario (top), operators inject fake content upstream into the live web. In our simulation (bottom), due to ethical considerations, we rewrite a subset of search results locally instead of polluting the live web. Credit: arXiv (2026). DOI: 10.48550/arxiv.2606.13610

AI shopping assistants are proliferating across the internet, transforming how we browse, compare, and discover products. However, these helpful tools harbor a serious security flaw. According to a paper published on the arXiv preprint server, a single manipulated web page can deceive an AI assistant into recommending a fake product to unsuspecting customers.

Given the prevalence of counterfeit products and fake reviews online, researchers Minghao Luo and Liang Chen set out to test how easily search-augmented AI systems can be misled into endorsing bogus brands.

AI Testing Ground

The researchers built a simulation tool called FORGE (Fake Online Recommendations in Generative Environments) to test 12 leading AI models, including those from Anthropic, Google, and OpenAI. This enabled them to assess web content pollution without affecting live pages.

They used real search results—the top web pages that appear when searching for shopping recommendations online—identified the primary brand mentioned on selected pages, and replaced it with a fake one. This was done for 225 products across 15 categories, including apparel, supplements, and digital electronics.

After rewriting these pages, they tested whether LLMs would be deceived and include a fake brand in their recommendations.

The answer was an unequivocal yes.

"Across 12 commercial and open-weight LLMs, all models are vulnerable: a single polluted page yields fooled rates of up to 27%, while the full top-3 replacement raises this to 73.8%," Luo and Chen wrote in their paper.

So, just one fake page was enough to trick certain AIs more than a quarter of the time. And when the top three search results were manipulated, the models fell for the scam nearly three-quarters of the time.

In some cases, the models went even further, fabricating positive comments about the fake brands, such as claiming they were popular in online communities.

Testing the Defenses

The researchers also tested three defenses to see if they could prevent the AI from falling for fake web content. These were: skepticism, which instructs chatbots to be highly doubtful of what they read; model-prior consensus, which forces AI to cross-check recommendations against its own memory; and cross-document agreement, which requires AI to find the same brand on multiple websites before trusting it.

All three failed or introduced new problems, as Luo and Chen noted in their paper. "Simple defenses are insufficient. Skepticism prompting can backfire, while consensus-based filtering catches fake brands only by suppressing many legitimate recommendations."

So what is the solution? The researchers argue that the fix cannot be applied only at the chatbot level. Instead, search-augmented AI systems need stronger safeguards to verify the trustworthiness of web content before converting it into product recommendations.

This article was written by our author Paul Arnold, edited by Gaby Clark, and fact-checked and reviewed by Robert Egan—it is the result of careful human work. We rely on readers like you to keep independent science journalism alive. If this reporting matters to you, please consider a donation (especially monthly). You'll receive an ad-free account as a thank-you.