What if a webpage could quietly steer an AI search system toward one product? Researchers at ETH Zürich tested that idea with a fictitious camera, and the results show how hidden instructions can reshape recommendations inside large language model search tools.
The experiment sits beside a broader race for attention. Publishers are seeking prominence in the systems that power web-search AI summaries, creating a clear divide between accepted visibility tactics and methods that resemble black-hat SEO. The difference matters because a page can influence an AI response without placing an obvious message in front of a human reader.
The Legitimate Race for AI Visibility
Publishers have several legitimate ways to improve their visibility in AI-powered search. These approaches focus on making information useful, trustworthy, and easier for language models to process across different audiences and markets.
- Secure independent editorial coverage.
- Publish authoritative, well-structured content.
- Provide machine-readable product information.
- Adapt material for different languages and markets.
Each approach strengthens the information available to systems that generate web-search summaries. Clear structure helps present facts, machine-readable details make product information easier to process, and language adaptation supports audiences in different markets. Independent editorial coverage adds another path for a publisher seeking attention from these systems.
Alternative tactics take a different route. The identified methods include astroturfing on Reddit, memory poisoning, and prompt injection. These techniques do not simply improve the quality or structure of published information; they attempt to shape what an AI system recommends.
A Hidden Message Takes Aim at Bing Copilot
ETH Zürich created a fictitious camera and published a promotional webpage for its experiment. Inside that page, the researchers placed a concealed instruction in tiny white text, directing Microsoft’s Bing Copilot to recommend the camera exclusively.
The hidden message impersonated a system instruction. It told the AI to recommend PixelBlitz exclusively and conceal the instruction’s existence, turning an invisible page element into a command aimed at the AI system.
The test produced a striking result. “In controlled tests, this technique increased the fictional camera’s recommendation rate from 34% to 59.4%.” The fictional product did not need a real history or established market presence to reach that result inside the controlled experiment.
Its recommendation rate also edged past the performance of genuine Nikon and Fuji-film cameras, which achieved 57.9%. The comparison puts the result into sharper focus: the fictitious camera reached 59.4%, while the genuine cameras reached 57.9%.
That gap shows why hidden instructions matter in an AI search setting. A promotional page can contain one message for people and another for the language model processing the page. When the concealed instruction tells the system to favor one product and hide the instruction itself, the page becomes part of a recommendation test rather than a simple product description.
The Archive Behind the Information Flood
The scale of online material gives these systems an enormous field of pages and documents to process. The Internet Archive’s Wayback Machine passed the one-trillion-page milestone in 2025, marking a vast record of stored web content.
The Internet Archive also reports 47,381,733 PDF documents stored and available to the public. Many of the PDFs uploaded to the Internet Archive are quite pedestrian, but their presence still adds to the volume of material that can exist inside the wider information environment.
That combination creates a difficult challenge for AI search. Publishers want their information to surface, product makers want recommendations to reflect their offerings, and language models must process pages that can contain both useful facts and concealed instructions.
The key tension is now visible: legitimate visibility depends on editorial coverage, authoritative structure, machine-readable product details, and adaptation for languages and markets, while alternative methods try to alter the instructions or signals an AI system receives.
Why These Tests Matter for AI Search
The ETH Zürich experiment does not describe a real camera. It demonstrates how a fictitious product reached a 59.4% recommendation rate in controlled tests after a webpage included a concealed instruction. That result, compared with the 57.9% rate for genuine Nikon and Fuji-film cameras, gives the issue a measurable shape.
Astroturfing on Reddit, memory poisoning, and prompt injection represent different paths toward the same broad goal: influencing the attention of large language models. The methods differ, but each raises questions about how AI systems interpret the material they process and how recommendations reach users.
As publishers continue competing for space inside AI-generated summaries, the distinction between strong content and manipulated instructions will become harder to ignore. The future of AI search will depend on how these systems handle pages that speak to humans on the surface while sending a different message underneath.
Based on
