Black hat GEO: the manipulation playbook (and why it’s doomed).

Where the line is

TigerTracks, in one of the cleanest published framings, drew the operational distinction: “Optimization focuses on structural clarity and technical transparency. Manipulation focuses on deceptive influence.”

The line is not always crisp, but the categories are now well-documented. Three classes of GEO manipulation have emerged from the practitioner literature, each a direct descendant of black-hat SEO tactics adapted for the synthesis-based logic of AI engines. Each is more dangerous than its predecessor because AI synthesizes a single authoritative-sounding answer (versus ten blue links), so manipulation has outsized consequences. Users get one “truth” rather than multiple perspectives.

Class 1 — Data poisoning and synthetic consensus

The cleanest version: use AI to generate hundreds of articles on a topic, all making the same claim, published across a network of mid-authority sites. The articles never quite reach top-tier publications, but they create enough repetition across the web that AI engines treat the manufactured consensus as evidence.

The 2023 SEO heist was the canary — 1,800 AI-generated articles, 3.6 million visits stolen from a competitor, public bragging on social media. Google eventually applied a manual action. The economics still favor the attacker: generating 1,800 mediocre articles costs under $100 today. The detection burden falls on platforms and publishers.

The astroturfing variant targets Reddit specifically because ~40% of ChatGPT’s insights are pulled from Reddit. Coordinated comment campaigns, fake review sites linking to manufactured discussions, AI-generated “authentic” user voices. Evertune AI’s warning is precise: “If Reddit detects and removes astroturfed content, that manipulated data won’t make it into the datasets that train AI models” — but the catch rate is far below 100%, and what slips through can persist in training data for years.

“Optimization helps the engine perform its duty. Manipulation hijacks the model's decision logic through noise. — TigerTracks”

Class 2 — Citation stuffing and link farm 2.0

The second class adapts the link-farm playbook to citation-driven discovery. The mechanic: build a network of sites that cite each other in the specific patterns AI engines use to assess source authority — comparison tables, “best of” lists, expert roundups — then game the inclusion criteria.

Sports Illustrated’s 2023 incident was the high-profile cautionary example: AI-generated articles published under fake writer profiles with synthetic credentials. The credibility damage outlasted the traffic gain by years.

The defensive read: AI engines already weight third-party citations heavily, which makes citation stuffing tempting. The empirical read: platforms are getting better at recognizing the patterns. Google’s 2024 spam action affected pages with 100% AI-generated content and de-indexed half of those sites. The arbitrage window is narrowing.

Class 3 — Hidden prompt injection and the Harvard finding

The most technically sophisticated class is the most concerning long-term. Harvard researchers demonstrated “strategic text sequences” — nonsensical-looking character strings that, when added to product pages or reviews, can force LLMs to generate specific outputs. The sequences look like garbled noise to humans but encode instructions the model interprets as commands.

Aounon Kumar, the Harvard researcher who published the work, framed the implication: “The challenge lies in anticipating and defending against a constantly evolving landscape of adversarial techniques.” Princeton’s Ameet Deshpande, co-author of the foundational GEO paper, was equally candid: “It’s a cat and mouse game. These generative engines are not static, and they’re also black boxes.”

The downstream concern: if adversarial content creators successfully game these systems at scale, “a lot of traffic is going to go to them, and 0% will go to good content creators.” The structural fairness of AI-mediated discovery depends on platforms staying ahead of the adversarial techniques. So far they have. The asymmetry favors them — they have the model weights and the detection infrastructure — but the cat-and-mouse dynamic is permanent.

The negative GEO threat

The dark mirror of the manipulation playbook: negative GEO, where competitors attack your brand by publishing strategically placed negative content that AI engines pick up.

Reboot Online’s 2025 negative GEO experiment was the first published demonstration. Researchers planted negative claims about a test target across mid-authority sites and measured how often AI engines surfaced the manufactured negative narrative. Perplexity repeatedly cited the test sites with the fabricated negative claims. ChatGPT showed more resistance but was not immune.

The implication for brands: defensive GEO is not optional. Even if your team has no interest in offensive optimization, your competitors may. The brands with strong owned-content authority and earned-media presence are insulated; the brands without are exposed to attacks they cannot directly counter.

Why platform pushback is consistent

The most underweighted signal in the manipulation conversation is platform consistency. Every major AI platform’s public-facing representatives have published essentially the same position:

• Danny Sullivan (Google): Best practices centered on genuine helpfulness and authority will win long-term.
• Krishna Madhavan (Microsoft Bing): No shortcuts; manipulation will be resisted.
• Jesse Dwyer (Perplexity): Platform resistance to manipulation is a core engineering investment.

The institutional incentive aligns with the public statement: platforms cannot afford to lose user trust to manipulated outputs. Google’s 2024 spam action and ongoing model updates demonstrate the operational follow-through. The arms race favors platforms because they have the model weights, the detection telemetry, and the existential motivation.

The historical analogy: the first decade of SEO had a similar dynamic. White-hat operators built durable practices; black-hat operators captured short-term gains and were eventually punished. The asymmetry between durable and fleeting positions widens as platforms mature. GEO is in roughly the equivalent of SEO’s 2007 — the manipulation tactics work today, will mostly be detected within 18–24 months, and will leave the brands that depended on them holding the bag.

The legal exposure most operators are missing

The under-discussed risk in the manipulation conversation is the legal one. Several of the techniques in active use are illegal, not merely against platform terms of service:

• Astroturfing is illegal in many jurisdictions, including under FTC consumer protection authority.
• Fake reviews have triggered FTC enforcement actions including $25M fines (recent cases).
• Synthetic personas with fake credentials may constitute fraud depending on context and damages.
• Hidden prompt injection has not been tested in court, but legal scholars consider it likely to be characterized as deceptive practice.

For brands evaluating GEO vendors: any vendor whose methodology relies on these techniques is exposing the buyer’s brand to legal risk in addition to platform risk. The due diligence question that should be asked is direct: “Walk me through every action you take that creates content, citations, or third-party signals on our behalf, and tell me whether each one would survive an FTC inquiry.” Vendors who can’t answer that question cleanly are not vendors a serious brand should engage.

Every statistic in this piece follows Visigent's research standards: named sources, dated figures, corrections on request to help@visigent.com.