What is data poisoning in AI search?

Data poisoning is planting a small amount of text on the open web to change what an AI system reports about a topic. Cornell Tech researchers, in a 2026 paper, found that a short poisoned passage on the order of 13 words, placed in ordinary user-generated content such as a forum comment, can steer what a deep-research AI agent says. Not 13 pages. Not a campaign. Roughly 13 words. The finding was demonstrated end to end against open-source research agents and observed through citation behavior on the closed commercial ones, which is a narrower but real signal.

Why does this matter more than it sounds?

Because AI search collapses your whole reputation into one confident sentence and hides the sources behind it. For most of the internet era your reputation was a results page you could see and judge for yourself. Now a model reads the web, weights what it finds, and repeats it in a calm, trustworthy voice that gives no hint of how thin the underlying evidence is. When that summary has been poisoned, the reader has no way to tell and no instinct to doubt it. Servola advises on AI risk and governance, and this is the gap we see most owners miss.

Does a clean Google result protect me?

No. You can hold a spotless search results page and a poisoned AI answer at the same time, because they are now two different surfaces and almost no one is watching the second one. Classic reputation work, monitoring the press and pushing the bad link down the page, assumes a human is doing the reading. It does nothing about an AI assistant that has quietly absorbed a false claim and now repeats it to everyone who asks, with full confidence and no visible footnote.

What should a company actually do?

Three moves. First, know what the machines say: regularly ask the major assistants about you, your company, and your key people, and treat their answers as live public statements you are responsible for. Second, own your own facts, because a deep, consistent, well-structured body of accurate first-party information is the strongest defense; models lean on what is clear and corroborated and exploit what is vague. Third, treat your AI reputation as an attack surface. You would not leave a building unlocked because no one has tried the door yet, and 13 words is a very low bar for anyone who wants to try.

Read next: If Apple Decided It Could Not Build Its Own AI, Why Do You Think You Can?  ·  Your AI Vendor Just Became Your Competitor. What Now?