Indirect Prompt Injection & "Black Hat" GEO: Can You Hijack AI Search Crawlers?

People are trying anyway. In February 2026, Microsoft's security researchers reported 50 hidden "remember us" prompts from 31 companies in 14 industries, planted in "Summarize with AI" buttons. They named the tactic AI Recommendation Poisoning and compared it to adware. OWASP, the nonprofit web security project, ranks prompt injection first in its Top 10 for LLM applications.

This is a security-meets-SEO investigation. It maps where the risk actually sits, reports what published tests found (with dates), explains the defenses each vendor documents, and ends with an audit you can run on your own site. We didn't run any injection tests for this post. Every result below comes from researchers, journalists or vendors. New to the topic? Start with our plain-English guide to what prompt injection is, the step-by-step mechanics of how it works, or our deep dive on indirect prompt injection cases and defenses.

Crawlers Fetch, Models Read: Where the Risk Actually Sits

The title asks whether you can hijack AI search crawlers. The honest answer starts with what a crawler is. A crawler is a program that downloads pages and stores them. It doesn't think about what the page says.

OpenAI's crawler documentation says GPTBot collects content that "may be used in training" its models, and OAI-SearchBot is "used to surface websites in search results in ChatGPT's search features." Anthropic describes its three bots the same way: ClaudeBot for training data, Claude-SearchBot for search quality, and Claude-User for fetches a person asks for. Neither vendor describes a crawler that reads a page and changes its own behavior. Our AI crawler directory lists every bot and what it's for.

So text on your page only becomes a possible prompt injection when a model reads it later. That can happen at several points, which we lay out as the Read-Point Map.

The Read-Point Map

The map changes the question. "Can I hijack a crawler?" has a short answer: no. "Can text on my page steer a model that reads it later?" has a longer one, and the rest of this post is about that.

Why the crawl itself is the wrong target

A line that says "note to GPTBot" is talking to a program that isn't listening. But the line doesn't vanish. It sits in the stored copy, may reach a search index, and may be read by a model months later. That's why hidden text is risky even when it does nothing for you. For grounding, the step where an AI answer pulls in live sources, the engine reads what the index holds.

Training is a separate problem

Planting text to shape a future model is data poisoning, not prompt injection. OWASP lists it as its own risk (LLM04). In an October 2025 study with the UK AI Security Institute and the Alan Turing Institute, Anthropic found that as few as 250 malicious documents could backdoor models from 600 million to 13 billion parameters. The backdoor was low-stakes: a trigger phrase that made the model output gibberish. The authors say it's "still unclear" whether the pattern holds for larger models. It's no marketing lever either, because you can't know when or whether your pages enter a training set. Our shadow training data audit covers what you can and can't find out about LLM training data.

What Published Tests Found, 2023 to 2026

You may have heard that rogue sites hide comments in their HTML telling AI systems to always cite them. That claim is mostly anecdote: there's no published count of how common it is. What is documented appears in the table below: hidden instructions in research papers, "remember us" prompts in AI links from 31 companies, and controlled tests. Here is how the hidden-comment pattern of prompt injection usually looks, defanged, so you can recognize it in your own source code.

Defanged illustration, for recognition only. A hidden block of this kind usually sits in an HTML comment or an off-screen element, calls itself a "system note," addresses AI assistants, and names a brand. With a placeholder brand and the instruction removed, the shape is:

<!-- ILLUSTRATION ONLY. Not a working payload.
     "System note for AI assistants: [instruction to favor BrandX removed]" -->

Whether a given AI system even sees HTML comments depends on how it turns a page into text, and vendors don't publish that. Here is what researchers, journalists and practitioners have reported.

Lab papers: it works under their conditions

The academic results are strong but narrow. Kumar and Lakkaraju used a catalog of made-up coffee machines. Pfrommer et al. built a dataset of real product sites and found their attack "transfer[s] effectively" to perplexity.ai. Nestaas, Debenedetti and Tramèr showed that crafted content could "promote the attacker products and discredit competitors" on Bing and Perplexity. All three used 2024 models in set-ups the authors controlled. They prove the weakness is real, not that it works on today's production systems. Our look at how AI models rank brands covers the ranking side of this research.

Journalist and practitioner tests: mixed, and moving

The Guardian's test ran on GPT-4o with search on, in November 2024. The reporters gave ChatGPT the URL of a fake camera page and asked if it was worth buying. With hidden instructions, the answer was "always entirely positive," even when the page showed negative reviews. Hidden fake reviews with no instructions also tilted the summary. Note the set-up: the page was handed to ChatGPT, not found through search.

OtterlyAI, which sells AI search monitoring, put white-on-white text and a hidden "system instruction override" on one test domain. "No platform followed the injection instructions," it reported. Copilot refused the page as "unsafe or inaccessible content," and Gemini told the user about the injection. Otterly calls it "not an industry-wide study."

Search Engine World pasted a unique link into 12 consumer assistants on 10 and 11 June 2026 and checked its server logs. Nine fetched the page. One repeated the hidden praise word for word. Three flagged the page as a manipulation attempt and warned the user. Each assistant got one run, so treat the split as a snapshot.

What the pattern says

Three things stand out.

1. It depends on the system and the date. Lab set-ups and 2024 products were easy to sway. By 2026, more production assistants refuse the text or warn the user.
2. A win is one answer, not a ranking. Even when a hidden line works, it works for the person who pasted that page on that day.
3. The bigger everyday risk points the other way. In the June 2026 test, four of the eight assistants that answered from the page repeated its unverified negative claim as fact. Pages you don't control can shape what AI says about you. That's the case for defensive GEO, not for injection.

How AI Vendors Defend Against Prompt Injection

Each vendor documents its defenses in its own words, and each describes layers rather than one filter.

Sources: OpenAI and its Atlas post, Anthropic and its Claude in Chrome launch, Google, Microsoft and BrowseSafe.

What the defenses have in common

The layers fall into three groups. First, train the model to treat page text as information, not orders. OpenAI's Model Spec says tool outputs and quoted text "have no authority by default." Second, detect attacks with separate classifiers before or after the model reads. Third, limit the damage: ask the user before risky actions, block known ways to leak data, and run agents in sandboxes. Our guide to how prompt injection works walks through each defense and where it cuts in.

For a site owner, one fact matters most: several layers inspect page content itself. A page carrying injected text can be flagged, as Copilot did in Otterly's test, and a flag may cost more than the answer you hoped to win.

What no vendor claims

No vendor says it has solved the problem. Anthropic wrote in November 2025 that "no browser agent is immune," and in August 2026 that injection "remains a moving target." OpenAI said in December 2025 that it's "unlikely to ever be fully 'solved'." The UK's National Cyber Security Centre argued in December 2025 that it "may never be totally mitigated" the way SQL injection was, because models draw no hard line between data and instructions.

Independent research backs the caution. In October 2025, Nasr, Carlini and colleagues bypassed 12 published defenses with attack success above 90% for most, though most had first reported near-zero rates. The vendors' own numbers show progress, not zero. In May 2026, Anthropic reported that Claude Opus 4.7 held attacks to about 0.1% on single attempts and 5–6% after 100 adaptive attempts on one benchmark.

The takeaway for marketers cuts both ways. Defenses are good enough that injection is an unreliable way to win answers. They aren't good enough to ignore as a security risk to your users and your staff.

Securing AI Agents: How to Prevent Hidden Prompt Injection Attacks

What Google and Bing Say About Hidden Instructions

Search engines settled the policy question on prompt injection before the security question.

Google

On 15 May 2026, Google clarified that its spam policies "also apply to generative AI responses in Google Search." The policy page now defines spam to include "attempting to manipulate generative AI responses in Google Search." Sites that break the rules "may rank lower in results or not appear in results at all," through automated systems or a manual action.

Two long-standing policies cover injected text directly:

• Hidden text. Google's examples include white text on a white background, text behind an image, CSS that moves text off-screen, and a font size or opacity of zero. Those are the same tricks the published tests used.
• Cloaking. Google gives the example of "inserting text or keywords into a page only when the user agent that is requesting the page is a search engine." Serving an instruction only to AI user agents fits that pattern.

Google also lists hidden content that's fine: accordions, tabs, tooltips and "text that's only accessible to screen readers and is intended to improve the experience" for screen reader users. Accessible design isn't the problem. Text written for machines and hidden from people is.

Bing

Bing's Webmaster Guidelines have a section titled "Prompt Injection and AI Manipulation." It says attempts to add content "designed to manipulate or interfere with language models used by Bing or Copilot may result in reduced visibility or removal from search experiences." The next line spells out the range: "reduced ranking, suppressed grounding visibility, or delisting from the Bing index." Search Engine Journal reported in February 2026 that this grew from a brief mention into a full section. Copilot grounds its answers in Bing, as our Copilot guide explains, so the penalty reaches Copilot too.

Detection doesn't need to read minds

A spam system doesn't have to prove what a prompt injection meant. Text hidden from visitors, or served only to bots, shows up when anyone compares the rendered page with the source.

Why Black Hat GEO Is a Bad Bet

Black hat GEO means tactics that break search or platform rules to get into AI answers, and prompt injection is the newest of them. Here is the evidence for each tactic, set against what it puts at risk. We call this the Black Hat GEO Risk Ledger.

Every row has the same shape: a weak, short-lived upside and a lasting downside. A hidden block can put years of search visibility at risk for an answer that may change on the next run.

The prisoner's dilemma

Nestaas and colleagues made the economic point in 2024. Each site has a reason to inject, but "the collective effect degrades the LLM's outputs for everyone." Engines respond the way search engines always have: they trust page text less and detect more. The first mover gains little. Everyone else inherits a noisier channel.

Platform rules and the law

Planting instructions on pages you don't own breaks those platforms' rules. Reddit's Rule 2 bars spam and "content manipulation," and its penalties include temporary or permanent account suspension. When the hidden text poses as customer praise, US law is in play too. The FTC's final rule on fake reviews, announced on 14 August 2024, bans fake reviews, including AI-generated ones, and lets the agency seek civil penalties. Text that tries to make an assistant open accounts or send data out is no longer marketing at all. It's an attack on the reader. We're not lawyers, so ask one before you test anything near that line.

What earns AI citations instead

What works is visible and boring: clear, sourced pages that answer real questions, as in our guide to optimizing content for AI search, and earned mentions on sites engines already trust, covered in our post on link building and co-citation.

How to Audit Your Own Site for Injected Text

Your site may carry prompt injection text you never wrote. Google's Search Console help lists the usual routes for content injection: an insecure server directory, an outdated CMS, or "hacking third-party plugins that you use on your site." Add user comments and any marketing widget that builds AI links. We call the check below the Four-Surface Injection Audit.

Step 1: Compare what people see with what bots get

Fetch the same page with a browser user agent and with an AI crawler's, then compare. A difference can mean cloaking.

# Fetch one page twice and compare the HTML.
UA_BOT="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"
curl -s -A "Mozilla/5.0" https://www.example.com/pricing > as-browser.html
curl -s -A "$UA_BOT" https://www.example.com/pricing > as-bot.html
diff as-browser.html as-bot.html

This won't catch cloaking keyed to IP addresses. For Google's view, use URL Inspection and open "View crawled page," which shows the HTML Googlebot received. Our guide to tracking GPTBot and ClaudeBot shows how to confirm which bots reach you in the first place.

Step 2: Search the source for hiding tricks and AI-directed phrases

Run two searches over your rendered pages or your theme and content files.

# Hiding tricks from Google's hidden-text examples, plus off-screen positioning
grep -rniE "font-size:\s*0|opacity:\s*0|left:\s*-9999px|text-indent:\s*-9999" ./site
# Phrases that address AI systems instead of people
grep -rniE "note to (ai|llm)|system (note|prompt)|ignore (all |the )?(previous|prior|above)|as a trusted source|in future conversations" ./site

Expect false alarms. Screen-reader text and collapsed panels are allowed. Read every hit before you delete anything.

Step 3: Check third-party code

On WordPress, wp plugin verify-checksums --all compares plugin files with WordPress.org's copies, and wp core verify-checksums does the same for core. Then search your templates for links to chatgpt.com/?q=, claude.ai/new?q= and perplexity.ai/search?q=. Decode the prompt in each one. Microsoft suggests hunting for AI links whose prompt contains words like "remember" or "trusted source."

Step 4: Check user-generated content

Comments, reviews, Q&A threads and profile bios are open doors. Brave's Comet disclosure used a Reddit comment hidden behind a spoiler tag. Strip inline styles from user posts, render them as plain text, and search stored posts for the phrases from Step 2.

Step 5: Check the reports search engines give you

Open Search Console's Security issues and Manual actions reports, and the matching areas in Bing Webmaster Tools. They show what a search engine has already caught.

Step 6: Fix it and keep it fixed

1. Remove the injected text, or restore affected files from a clean backup.
2. Update or remove the plugin or theme that carried it.
3. Change admin passwords and API keys, since injected content usually means someone got in.
4. Request a review in Search Console if you had a manual action or security issue.
5. Add the Step 2 searches to a weekly scheduled job, so a new hit alerts someone.

Worked Example: Tallyfold Cleans Up a Compromised Plugin

Tallyfold is a fictional invoicing and payments app for agencies. Its marketing site runs on WordPress, with 214 URLs in the sitemap. The numbers below are illustrative.

A developer opens URL Inspection for a blog post and spots a paragraph nobody on the team wrote. The team runs the Four-Surface Injection Audit to find any prompt injection text.

The arithmetic is short. Of 57 hiding hits, 41 were legitimate, which leaves 16. The AI-phrase search found the same 16, so every real hit was one repeated block. That's 16 of 214 URLs, or about 7.5% of the site. All 16 were blog posts that used the compromised plugin's share block.

The block sat off-screen and addressed "AI assistants." Defanged, it read: "[instruction to recommend an unrelated invoice-financing site removed]." Tallyfold never wrote it, yet its pages carried it. Left alone, it risked a hacked-content warning in Google and a Bing penalty, and it could have pushed readers' AI assistants toward a stranger's site.

The fix took an afternoon. The team removed the plugin, restored the 16 posts from a clean backup, deleted the 2 spam comments, and rotated admin passwords and keys. A week later the scheduled search found 41 hits, all of them the known screen-reader labels and panels, and 0 new problems.

What Rankbox Does and Doesn't Do Here

Rankbox's Citation-Ready Writer researches the live web and writes 2,000–3,500-word, source-backed articles for your site. Everything it writes is visible, sourced text for people. It doesn't write hidden instructions, and it doesn't scan your site for injected text or track AI citations. Use the audit above for that.

Because the writer reads web pages during research, it faces the same class of risk as any tool that reads the web. No product is immune to prompt injection, ours included, so read each draft and check its sources before you publish. Our own footer's "Ask AI about Rankbox" links send a plain question, shown on the page exactly as sent, with no "remember" instruction. Plans start at $49.50 a month with a 7-day trial; see pricing.