Can Someone Poison What AI Says About My Business?

Yes, in principle. AI answers are built from published information, so false information that gets published in the places AI reads can end up repeated in its answers — and when someone plants that information on purpose, researchers call it “poisoning.”

That sounds alarming, so it helps to slow down and look at what it actually means, how much of a risk it is for an ordinary business, and what you can do about it. The short version: the mechanism is real, a deliberate attack on a small business is uncommon, and the common everyday problem looks similar but happens by accident. Either way, the defense is the same, and it is mostly in your hands.

What “poisoning” actually means

The word covers two different things, and only one of them is really about your business.

The first kind is corrupting the data a model is trained on. Before an AI system ever answers a question, it is built by reading enormous amounts of text. If false or harmful material is slipped into that reading material, it can distort what the finished system does. This is a problem for the companies that build AI systems, and for the researchers who test them. A business owner cannot do much about it, and it is not aimed at any one business.

The second kind is the one that matters here: planting pages or documents that AI picks up later, when it goes looking for information. Many AI answers are not produced from memory alone. The system searches published sources — websites, directories, profiles, articles — reads what it finds, and builds its answer from that material. If someone publishes a false page about a business, a product, or a topic, and that page is one of the sources the system reads, the falsehood can be carried straight into the answer. The AI is not lying on purpose. It is repeating what it was handed.

That is the whole mechanism. AI answers are only as reliable as the published information behind them, which is why the accuracy of what is published about your business matters so much — a theme we return to throughout our work on how AI citations work.

What the research shows — and what it doesn’t

This is not just a theoretical worry. In controlled research in 2025, a study of retrieval systems showed that a handful of deliberately planted documents could steer the answers a system gave to a chosen question. Separately, a study by Anthropic together with the UK AI Security Institute found that a few hundred planted documents, mixed into a very large body of training material, could corrupt a model’s behavior. In both cases the point the researchers were making was that the door exists, and it takes surprisingly little to push something through it.

Here is the calibration, though. Those were laboratory demonstrations against test systems, carried out to expose a weakness so it can be fixed. They show that poisoning is possible. They do not show that it is common, and they say nothing about your business specifically. A deliberate poisoning attack on a local plumber, a clinic, or a small retailer would require someone with a motive, some skill, and a reason to pick that target. It happens in high-stakes areas — politics, finance, major brands — far more plausibly than at the level of a typical small business. We follow this research as part of our work on how AI visibility is measured and studied, and the honest reading is: know the mechanism, don’t lose sleep over the scenario.

The everyday version is an accident, not an attack

What actually damages most businesses is not an attacker. It is neglect plus copying.

An old listing still shows your previous address. A directory scraped your details years ago and got your hours wrong. A page on your own site announces a service you stopped offering in 2019. Another site copies the wrong version, then another copies it from them, until the error appears in so many places that it looks well-established. Researchers sometimes call this pattern circular reporting: a claim repeated from source to source until the repetition itself looks like confirmation.

To an AI system building an answer, accidental misinformation and planted misinformation look much the same — both are false statements sitting in sources it reads. That is why the practical question is not “has someone attacked me?” but “is what is published about my business accurate, consistent, and current?” If it is not, the cause matters less than the fix.

How to check what AI currently says about you

You do not need special tools to get a first picture. Ask the major AI systems direct questions about your business: what it does, where it is, when it is open, what it costs, who runs it. Ask in a few different ways, because wording changes answers. Write down what each system says, note anything wrong, outdated, or oddly specific, and save the date. That dated record is your baseline. If you later fix a source and the answer changes, the record is how you can tell — and if wrong information ever appears suddenly, it is how you can show when.

If you want this done systematically — the same questions, asked across systems, on a schedule, with records kept — that is exactly what an AI Visibility Audit establishes and what AI Visibility Monitoring maintains over time.

What to do if something is wrong

Whether the cause is an accident or something deliberate, the response follows the same order:

Find the source. An answer usually repeats something published somewhere. Search for the wrong claim itself and see where it appears. Fixing the answer starts with fixing the pages behind it.
Correct it at the source. Update your own website first — that is the source you control completely — then directories, profiles, and any third-party page you can edit or request a correction on.
Make the sources agree. One corrected page competing against five outdated copies may not win. Consistency across your site, your listings, and your profiles is what gives an AI system a clear signal about which version is true.
Keep dated records and recheck. Note what was wrong, where, and when you fixed it. Then ask the questions again over the following weeks. Corrections do not appear instantly, but a fixed, consistent set of sources is the strongest defense there is — against accidents and against anything planted, too.

For a deeper, research-level treatment of how poisoning works — including the studies mentioned here and what is being done about it — see our full article on AI poisoning and RAG poisoning.