For most of the internet era, ecommerce visibility was largely a ranking problem. Brands competed to appear near the top of search results, marketplaces refined their ranking algorithms, and an enormous optimization industry grew around understanding the signals that determined who appeared first.
That system also produced its darker counterpart: negative SEO. Instead of improving its own visibility, a bad actor could try to weaken a competitor by interfering with the signals a search engine used to judge that competitor.
AI shopping creates a different version of the same underlying problem.
A shopper might now ask an assistant, "What is the best running watch under $300 for marathon training?" Instead of presenting ten links and leaving the customer to investigate, the system can interpret the request, compare available information and return a small set of products it considers suitable.
That changes the economics of visibility. Being fourth in a conventional search result still gives a shopper a reasonable chance of seeing you. Being excluded from an AI-generated shortlist can mean disappearing from the decision entirely.
This is part of the wider change XENA has explored in The AI Retail Search Shift in 2026, where discovery moves away from simple keyword matching toward systems that interpret intent, use cases, attributes and context. It also explains why brands are starting to think about whether content should target traditional search or conversational AI.
Once recommendations become commercially valuable, however, another question follows naturally: what happens when companies begin trying to manipulate them?
AI Recommendations Are More Persuadable Than We Might Assume
The concern is no longer theoretical.
A study published at EMNLP 2025, Bias Beware: The Impact of Cognitive Biases on LLM-Driven Product Recommendations, examined whether product descriptions containing familiar psychological cues could change the recommendations produced by large language models.
The researchers tested language associated with social proof, scarcity, exclusivity and other cognitive biases. Their findings showed that wording alone could affect recommendation behavior, even though the underlying products had not fundamentally changed. Social proof was particularly notable because it consistently improved recommendation rates and rankings across the study's experiments, while scarcity and exclusivity sometimes had the opposite effect.
This does not mean that inserting "popular choice" into a product page will automatically push an item to the top of a commercial AI assistant. Real recommendation systems can combine retrieval, product feeds, merchant information, reviews, ranking systems and proprietary safeguards that are not reproduced in academic experiments.
What the research does establish is more consequential: an LLM can treat persuasive product language as part of the evidence it uses to form a recommendation.
That creates a subtle change in the role of ecommerce copy. Traditionally, product copy needed to persuade the customer after the customer reached the page. In AI-mediated discovery, product information may also influence the machine deciding whether that page or product becomes part of the customer's consideration set in the first place.
For brands adapting to that reality, clarity becomes more important than cleverness. XENA's guide to writing product pages AI can actually understand makes the case for explicit product facts, intended uses and clear connections between attributes and customer needs. Those practices help machines interpret a product accurately without relying on exaggerated claims.
The Negative SEO Analogy Only Goes So Far
Calling this "AI negative SEO" is useful because the competitive incentive is familiar, but the mechanics are different.
Traditional search manipulation tends to focus on ranking signals. Recommendation manipulation can potentially target the information environment from which an AI forms its judgment.
An AI shopping system may draw from product pages, merchant feeds, specifications, reviews, comparison articles, pricing information, retailer data and other web sources. It can then combine those pieces of evidence into an answer that sounds far more definitive than the raw information it consumed.
Legitimate optimization improves the quality of that evidence. Accurate product dimensions, complete attributes, clear compatibility information, current prices and useful descriptions make it easier for both customers and machines to understand what a product actually offers.
This principle is increasingly important because AI buyers are screening products against increasingly specific requirements. A vague statement such as "premium performance for modern lifestyles" gives a recommendation engine almost nothing useful to compare, while a precise description of materials, dimensions, compatibility and intended use gives it meaningful decision criteria.
Manipulation begins when the objective shifts from making the product easier to understand to making the system reach a distorted conclusion.
A claim that a backpack has a 25-liter capacity is factual and testable. A claim that the same backpack is "the trusted choice of experienced travelers" is much harder to evaluate unless the recommendation system can determine what evidence supports it.
That distinction may become one of the central trust problems in AI commerce.
The New Spam Target Is the AI's Picture of Reality
Search spam tried to influence where a webpage appeared. Recommendation spam may try to influence what the model believes about the products it is comparing.
Consider a simplified example. One product has thorough specifications, ordinary marketing copy and a collection of independent reviews. Another appears across multiple sources surrounded by repeated claims that it is the market leader, the professional choice or the product customers are switching to.
A careful human researcher would want to know whether those claims originated independently or whether they all trace back to the same campaign. An AI recommendation system needs to make a similar judgment, except it may be doing so across huge quantities of information and under pressure to produce an immediate answer.
If repeated claims are mistakenly treated as independent evidence, manufactured consensus can begin to resemble genuine consensus. This is especially significant in conversational shopping, where the customer may never inspect all of the underlying sources.
XENA's analysis of paid versus organic visibility in ChatGPT recommendations highlights why that distinction matters. Organic recommendation systems and advertising are not the same thing, which means being understood and trusted by the recommendation layer can carry commercial value independently of paid placement.
That value inevitably creates an incentive to influence the layer itself.
Research Is Moving From Persuasion to Direct Recommendation Manipulation
The cognitive-bias research is only one part of a broader body of work investigating the integrity of AI recommenders.
A 2025 paper on retrieval-augmented recommendation systems studied provider-side data poisoning, where researchers made relatively small changes to item descriptions. Their experiments found that subtle metadata modifications could promote or demote products in the resulting rankings while escaping relatively simple detection methods.
The key point is not the specific manipulation technique. It is that relatively modest changes to the material a recommendation system retrieves can produce downstream changes in product exposure.
Research published in 2026 pushed the question further. A July preprint examined competitive ranking manipulation in web-connected LLM recommendation environments while keeping retrieved sources fixed. Across the study's tested settings, a selected recommendation reached the number-one position in 62 of 124 technique trials. When successful cases were tested again in fresh sessions, the researchers reported a mean success rate of 0.805.
Those numbers are striking, but they require context. The study evaluated particular models and controlled scenarios, so the findings should not be treated as evidence that every commercial AI assistant can be manipulated in the same way.
What they do reinforce is the broader pattern: changing the information an AI reads can change the recommendation it produces.
That makes the quality and integrity of ecommerce information more important than ever. XENA's 2026 ecommerce playbook argues that product information increasingly needs to serve both human customers and machine-driven discovery systems, a requirement that becomes even more significant when the machine is narrowing thousands of options into a handful of recommendations.
What Happens When Every Brand Starts Optimizing for the Model?
The next problem is not necessarily a sophisticated attack. It may simply be an arms race.
A June 2026 preprint examining brand bias and cognitive manipulation found evidence of what its authors described as a social dilemma. In the study's experimental environment, individual brands could gain from certain optimization strategies, but the benefit largely disappeared when all competing brands adopted them. Brands that did not participate could also lose recommendation visibility.
That pattern is familiar because search went through a similar evolution.
Once marketers discover that an algorithm rewards a particular signal, the signal attracts optimization. As adoption grows, useful optimization can give way to increasingly aggressive attempts to reproduce the signal. Eventually the signal becomes less reliable, and the platform has to change the way it evaluates content.
AI recommendations could follow the same cycle, except the relevant signals are more complex than links or keyword placement. They may include popularity language, reviews, product attributes, contextual mentions, comparison pages, reputation signals and the apparent agreement of multiple sources.
This is why recommendation spam may be harder to recognize than the spam of an earlier internet era. It may not look like gibberish, keyword stuffing or a suspicious page filled with links. It may look like polished marketing content.
Where Does Legitimate AI Optimization End?
There is nothing inherently manipulative about helping an AI system understand a product.
In fact, improving machine readability is becoming basic ecommerce hygiene. If a laptop weighs 1.2 kilograms, that fact should be easy to find. If a cosmetic product is fragrance-free, that attribute should be clear and consistent across the product page and feed. If a warranty lasts three years, the terms should be explicit rather than buried in promotional language.
As XENA's work on AI-readable product pages explains, machines need clear relationships between what a product is, who it is for, what problem it solves and why a buyer might reasonably choose it. That kind of optimization improves the quality of the underlying information.
Manipulation is different because its purpose is not to clarify reality but to exploit the recommendation system's assumptions.
The most sustainable dividing line may therefore be evidence. An optimization claim should ideally make a product easier to verify, compare or understand. If the tactic only works because a model is likely to mistake promotional language for independent proof, it is operating in a very different territory.
This distinction is also relevant to answer engine optimization. Brands can improve their visibility by building stronger product information, connected content and credible supporting evidence without manufacturing the signals they hope an AI will notice.
Platforms Are Already Treating Generative Manipulation as Spam
The platform response is beginning to become more explicit.
Google's current Search spam policies state that spam includes attempts to manipulate Search systems into featuring content prominently, including attempts to manipulate generative AI responses. The policy was updated in May 2026, making the connection between conventional search spam and generative-response manipulation unusually clear.
That is important because it suggests AI-generated answers are not developing as a completely separate trust ecosystem. Many of the same principles that governed search integrity are being extended into generative experiences.
The technical challenge, however, is considerably more difficult than publishing a policy.
A recommendation system needs to distinguish between information that is promotional but true, information that is promotional and unsupported, and information that may have been deliberately created to influence the system. The EMNLP research also found that simply directing a model to focus on objective features was not enough to remove the observed vulnerability, which suggests that "ignore the marketing" is unlikely to be a complete defense.
Platforms need a deeper way to judge evidence.
What a Serious Defense Could Look Like
The likely answer is not one universal spam detector. It is a layered system for establishing trust.
Platforms can place more weight on structured and independently verifiable attributes when those attributes are relevant to the recommendation. Price, dimensions, ingredients, compatibility, material and warranty information are fundamentally different from claims such as "most trusted," "expert recommended" or "everyone's favorite."
Source provenance is another important part of the problem. If ten pages repeat the same claim but all trace back to one press release or coordinated content campaign, the recommendation system should ideally recognize that it is looking at repetition rather than ten independent confirmations.
Cross-source verification could help in a similar way. Claims supported by merchant data, independent reporting, authenticated reviews and consistent structured information should carry a different level of confidence from statements that appear only in marketing copy.
Platforms may also look for recommendation instability. If a minor piece of promotional wording causes an otherwise unchanged item to make an unusually large jump in ranking, the system has a reason to question whether that language deserves so much influence.
This is also why AI visibility measurement needs more nuance than simply checking whether a brand's name appears in an answer. XENA's SearchPanel tracks how major AI systems describe and recommend products at the SKU level, helping brands see where their products are visible and where the underlying information may need improvement. Used responsibly, that kind of measurement is less about finding a phrase that tricks a model and more about identifying gaps in the evidence AI systems already have.
Authenticity Could Become the Scarce Signal
The hardest part of defending AI recommendations is that legitimate marketing and manipulation often use the same language.
"Trusted by thousands of customers" could be a fabricated popularity cue, or it could be an accurate summary of verified purchase data. "Recommended by professionals" could be meaningless promotional copy, or it could reflect documented professional endorsements.
An effective recommendation system cannot simply reject persuasive language because persuasive language is a normal part of commerce. It has to determine whether the claim is supported.
That creates an interesting long-term advantage for brands with clean, consistent and verifiable information. As AI systems become more skeptical of unsupported signals, the businesses most likely to retain visibility may be the ones that make product truth easy to confirm.
This is consistent with the broader shift described in XENA's Generative AI in E-commerce guide. AI can help brands improve product information and respond more quickly to changing demand, but lasting visibility depends on the quality of the data and content feeding those systems.
The same principle applies to conversational discovery. When AI is doing more of the initial comparison work, well-structured product information becomes part of the selling infrastructure, not simply a conversion asset sitting at the end of a traditional search journey.
The Stakes Increase When AI Can Act for the Shopper
Recommendation manipulation becomes considerably more important once AI assistants begin moving from research toward action.
The traditional shopping funnel created friction, but some of that friction also created opportunities for verification. A customer searched, opened several product pages, compared alternatives, read reviews, went back to search and eventually made a decision.
Agentic shopping can compress much of that journey.
As XENA explains in Agentic AI in E-commerce: How 2026 Winners Move From Dashboards to Decisions, AI systems are evolving from tools that simply provide information into systems capable of helping users evaluate choices and take actions.
The same shift is visible in practical shopping use cases where AI agents can compare prices, merchant terms and product characteristics before narrowing the market for the customer.
That concentration of decision-making power changes the stakes. If an AI assistant chooses three products from a category containing thousands, the integrity of that shortlist becomes economically significant. Manipulating the recommendation layer could eventually be as valuable as manipulating the first page of search results once was, particularly if shoppers increasingly trust the assistant enough to skip independent research.
So What Is the AI Version of a Negative SEO Attack?
There may never be one tactic that neatly earns that name. "Recommendation poisoning" is probably a better description of the broader risk.
Instead of attacking a webpage's position in a search index, recommendation poisoning attempts to distort the evidence, signals or confidence an AI system uses when deciding what deserves to be recommended.
Sometimes the objective could be increasing one product's visibility. In other cases, the more damaging possibility is suppression, where unreliable or strategically shaped information makes competing products less likely to appear.
The emerging research does not prove that today's AI shopping systems are universally vulnerable, nor does it justify treating every attempt at AI optimization as manipulation. It does, however, establish enough evidence to take the issue seriously. Cognitive biases can affect LLM recommendations, modest changes to retrieved product information can alter exposure, and controlled web-recommendation experiments have demonstrated that changes in source content can influence generated rankings.
That sets the stage for a familiar contest between optimization and platform integrity, but with an important difference.
Search spam was largely about manipulating what a machine found and where it placed it. Recommendation manipulation is increasingly about influencing what the machine concludes after it has found the information.
For ecommerce businesses, the safest long-term strategy is therefore unlikely to be chasing whatever wording appears to influence a particular model today. It is building product information that remains clear, consistent and credible regardless of which AI system evaluates it.
For platforms, the challenge is harder. They need recommendation engines that can tell the difference between popularity and manufactured popularity, authority and claimed authority, independent consensus and coordinated repetition.
That may become one of the defining trust problems of AI commerce.
For more research and practical guidance on AI discovery, product visibility and ecommerce growth, explore the XENA Intelligence blog.
