The New Propaganda Play: Stop Buying Search Rankings, Start Training the Chatbot

Moving public opinion used to require buying the front page or owning the first page of Google. Now people ask chatbots instead of search engines. The target moved accordingly. It is no longer the reporter or the ranking algorithm — it is the model’s mouth.

One caveat up front. There is no single breaking incident anchoring this piece, and the English-speaking security community hasn’t converged on a specific campaign in the last month. So treat this as a structural analysis of why this class of operation works technically, not a report on a confirmed operation by a named actor. Writing unverified things as if they were verified is exactly the failure mode under discussion here.

SEO Didn’t Die. It Changed Targets

Search engine optimization was a twenty-year industry. Plant keywords, buy backlinks, spin up content farms, climb the rankings. Google rewrote its algorithm dozens of times trying to kill it.

Language models don’t rank. They produce one answer. The user isn’t picking among ten blue links — they read a single summarized paragraph and move on. That difference is everything. Third place in search results still gets clicks. There is no second place in an AI answer.

Hence the new acronyms: GEO (generative engine optimization), AEO (answer engine optimization). Marketer coinages, but the goal is unambiguous — make the model say your brand’s name when the topic comes up. So far, this is just marketing. The problem starts when a state-level actor picks up the same playbook.

LLM Grooming: Fooling the Model, Not the Person

Security researchers have a term for this: LLM grooming. Polluting the web specifically to shape what models learn and retrieve. The premise is simple.

Humans filter out sketchy sites. Weird domain, cheap design, empty author bio — you hit back. Crawlers mostly don’t make that call. They collect text, dedupe it, run a quality filter, and what survives becomes training data. Retrieval-augmented generation pipelines are looser still, because they scrape the live web and hand the result straight to the model as evidence.

That’s where the attacker’s math gets ugly. Convincing a million people is expensive. Fooling one ingestion pipeline is cheap. And if it works, the payload gets distributed automatically to every user of that model. The leverage isn’t comparable.

Why a Think Tank Is the Perfect Shell

Ten thousand fake accounts blasting tweets gets caught now. Platforms spent real money on bot detection. Impersonating a research institution sits in an entirely different detection bracket.

Build a website with a plausible institutional name. Post policy briefs as PDFs. Attach profiles and headshots for researchers who don’t exist. Generative tools compress all of that into a few days of work. Then seed regional outlets and commentary sites with stories citing the reports. Suddenly the claim isn’t a single-source assertion. It’s a cluster of sources citing one another.

To a model, that pattern reads as signal. Repeated across documents. Cross-referenced. Written in an academic register. Language models do not verify truth — they learn statistical frequency and contextual authority. Manufacture the citation network and you have manufactured the authority.

This is the clean break from classic disinformation. The old operations chased human clicks. The new ones chase machine trust.

The Uncomfortable Finding: It Doesn’t Take Much

The instinct is to say a handful of websites can’t matter against the whole internet. That was my instinct too. Data poisoning research points the other way.

The key result is that what matters is absolute count, not proportion. Experiments have found that the number of poisoned documents needed to implant a specific trigger does not scale up with dataset size. Make the model a hundred times bigger and you don’t need a hundred times the poison. A few hundred documents can shift behavior under the right conditions.

Niche topics are far more exposed. Ask who the US president is and hundreds of millions of documents hold the correct answer in place. Ask about a specific regional policy dispute where primary sources are genuinely scarce, and a few dozen fabricated documents can constitute a meaningful share of the available evidence. That gap is precisely the target.

In RAG, the timeline collapses entirely. Poisoning training data means waiting for the next training run. Poisoning retrieval means the page you publish this morning shows up in this afternoon’s answer.

What Actually Helps

Fairness demands the defense side too.

Model providers aren’t idle. They check source diversity, weight domains by reputation, and impose probationary periods on brand-new sites. But there’s a structural tension nobody has resolved: the demand to surface fresh information fast runs directly against the demand to exclude unvetted sources. No one has both.

The user-side advice is unglamorous. Click the footnotes. Most people don’t, and that’s exactly the gap the operation is designed to exploit. On contested or political topics, don’t take one model’s answer as settled. And when an unfamiliar research institute shows up in a citation, search the institute itself. If you can’t find a founding date or a funding source, that’s a question mark, not a source.

The Takeaway

Search-era manipulation at least left visible tracks. When a garbage site hit the top of the results, people noticed. Now the process happens inside the model, out of view. The answer always arrives calm and confident, and whatever it was built on sits hidden behind a one-line summary.

What changed is the cost structure of influence. Instead of persuading millions of people, you train the one tool those millions consult every day. Of the answers a chatbot gave you today, how many sources did you actually check?