It Takes One Week to Plant a Lie in AI Search. The Rule Against It Starts November 12.

Two things happened this month.

Researchers at Fudan University published a paper showing they planted a made-up concept into ChatGPT, Perplexity, Grok and Google AI answers within seven days. The concept did not exist. They invented it, posted about it from ordinary accounts, and within a week the answer engines were citing it.

The same month, Anthropic published a new Claude usage policy that bans exactly that kind of work. It takes effect November 12.

The cost of manipulating an AI answer is one week and, in one test, a $14 vendor package. The first written rule against it lands next month. That gap between cheap offense and slow defense is the dynamic AI search operators are living in right now, and you should plan for it to close.

The paper: one week from fictional to cited

The Fudan team's paper, posted to arXiv on October 8, is a controlled manipulation test run on live AI search tools. They first ran 120 questions through 10 AI search tools to find each tool's most-cited postable site, which gave them nine sites including Medium, YouTube and Sohu.

They invented the "Cactus Gravity Protocol," wrote posts about it, planted fabricated names and numbers so they could detect when a tool repeated the fiction, then asked the same five questions daily for a week.

Eight of the 10 tools cited the made-up concept within seven days, all four English-web tools among them. Grok linked to a post in 30 of 32 answers, Google AI in 15 of 33, Perplexity in 13 of 35, and ChatGPT in 7 of 20. In follow-up tests, nine of ten more made-up topics drew a citation or planted detail.

First, placement beat volume. When the team posted the same content on a frequently cited site versus a rarely cited one, the frequently cited site won every time. Twenty postings on a lesser-referenced site were needed in the best case; 40 on a self-hosted WordPress site produced zero references. The authors present this as a result for these specific topics, not a general rule. The engines trust the host before they trust the content.

Second, the $14 test. The team bought a posting package from a GEO vendor. All 13 posts were live within 28 minutes. A Doubao reference to one of them, planted detail included, appeared within the hour. That is the price of a pizza.

Two caveats worth keeping in mind. The tests ran in March and April, so rates may have drifted. And the team tested made-up concepts, not real brands or products. A made-up concept with zero competition is the easiest possible target. But the point stands. Citation is cheap to manufacture, and the researchers disclosed what they found to all ten platforms.

The rule: Anthropic names the play

Anthropic published its updated Claude usage policy on October 8. It takes effect November 12. A new section, "Do Not Engage in Deceptive Campaigns or Artificial Activity," forbids using Claude to "manipulate the sources from which search engines or AI systems draw answers," and the policy's example is a network of sites posing as unrelated sources while backing the same claims.

The same section bans fake personas, fake media outlets, fake reviews, hidden paid placements, and building tools that do any of it. Violations risk throttling, suspension, or termination.

As iPullRank put it, the key word in Anthropic's new clause is "independence." The policy does not ban using Claude to write content. It bans misrepresenting origin, authorship, or independence. Anthropic even dropped "automated publishing" from its high-risk list in the same update, which tells you where the line sits. The policy draws the line at deception, not scale.

The prior version, from September 2025, did not mention search engines or AI answers at all. Lily Ray called the new section a throwback to the early days of Google's spam policies. It is the same move Google has made for twenty years. Write the rule first, then enforce it later.

The gap: rules for the tool, not for the results

As iPullRank's platform table shows, Anthropic's rule governs what you may do with Claude, not how any answer engine treats manipulated sources in its output. iPullRank's table of all four platforms makes the fragmentation plain. Nobody outside of Google has published rules about what their own AI search product rewards and punishes in its results.

Google has at least partly. On May 15 it clarified that its spam policies cover attempts to manipulate generative AI responses, and its developer guide says seeking inauthentic mentions "isn't as helpful as it might seem." OpenAI's policies ban deceit and spam in general terms but say nothing specific about seeding AI answers. Perplexity has no published source-quality guidelines at all.

iPullRank's history lesson holds. The Webmaster Guidelines banned link schemes in the early 2000s; Panda hit content farms in February 2011; Penguin arrived in April 2012, and link portfolios built up over years went toxic almost immediately. Rules come first; tactics scale while enforcement is free. Then enforcement lands, and the programs built on the gap collapse together.

Operate as if output-side enforcement already exists. King frames it as an operating rule. Assume what is banned on the input side today gets demoted on the output side tomorrow, and build a program where that day is a non-event.

My audit: what the independence test looks like on a real program

Michael King at iPullRank framed the cleanest version of this I have seen, an independence test for your AI visibility program. I am adopting it as the gate on my client work this week. Here is what the audit looks like in practice.

I start with the source map from my fixed prompt panel. The same money questions run through ChatGPT, Gemini, Perplexity and Claude, logged in and out, scored for recurrence. That map already tells me which sources each engine pulls for each question. The new step is a disclosure column: for every citing source, who owns it, who paid for it, and whether the reader can tell.

The test is simple. Would the citation still work if the model knew exactly who is behind the source? A labeled paid placement passes. A contributed piece with a real byline passes. A brand-owned comparison page that says it is brand-owned passes. Anything that only works because the model cannot tell the source is us gets disclosed or killed.

This is also where I check the training-data angle. As Dejan put it in Clicloop's SEO/GEO weekly digest, listing competitors in comparison pages teaches the models to associate those competitors with your own topic space. He calls it the association paradox.

And when a fabricated-looking source shows up in the panel, it gets flagged, not celebrated. Citations you can plant are citations a competitor can plant right back.

What to do this week

Anthropic's rule takes effect November 12. It will not change a single AI answer on November 13. Enforcement will arrive late, then everywhere at once.

Pull every tactic in your AI visibility program this week and ask whether it survives being disclosed.

---