The pages look normal. The listings are fake.
On October 10, the rank-tracking firm Nozzle published research that should unsettle everyone in search. They examined 27.5 million Google results pages across 49 countries and found that 8 percent of those it could assess have been poisoned since September 13. Before that date, the figure was 0.17 percent. At the worst point, September 27 to 29, about a quarter of tracked pages were affected, peaking at 27 percent on the 29th.
Poisoned, in this context, has a specific meaning. Google is not blocking scrapers with an error page or a CAPTCHA. It is serving them a complete, normal-looking results page where the organic listings have been quietly swapped for different ones. Nothing on the page says anything is wrong. A refused request tells a scraper to try again. A poisoned one gets stored as real.
Who this is aimed at, and who gets hit anyway
The target is not mysterious. AI companies scrape Google results at massive scale to ground large language models, feed retrieval systems, and power competing search products. Nozzle attributes the poisoning to exactly this bulk collection of its results to feed AI answers. Google’s terms have always restricted automated access. Poisoning is a tactical evolution: instead of telling the scraper to go away, let the bad data enter its datasets undetected and degrade everything built on top of it.
But scrapers are not the only ones drinking from this well. Rank trackers collect results pages the same automated way, and they are caught in the same net. DemandSphere reported spurious results in about 11 percent of its daily checks. Morningscore watched result sets truncate for nearly a week in late September and logged phantom ranking drops that later recovered on their own.
Think about what that means for the industry that reports on search. Every agency dashboard, every rank report, every GEO monitoring tool that pulls Google data through automated collection is now partially built on pages Google may have falsified. When a client’s rankings appear to collapse overnight, the first question is no longer whether an algorithm update hit. It is whether the data was ever real.
What Google is telling us without saying a word
Google has not commented publicly on the poisoned results. The silence is part of the signal.
I read it as one of two things. Either Google is getting ready to make its own play in the AI search space and is salting the earth behind it, or Google has decided it will not play fair as the AI game takes shape. In the first reading, poisoned data is competitive preparation. In the second, it is a warning shot to every AI company building on Google’s index without permission.
Neither reading is good news for businesses building their visibility strategy on borrowed data. If the platform can falsify the measurements at will, the measurements were never truly yours.
The end of passive monitoring
This is where I want to be blunt with business owners.
A large and growing industry sells GEO monitoring: dashboards that track how often AI systems mention your brand, where you rank in AI answers, how your citations trend. As a category, monitoring has value. It tells you where you stand.
But monitoring was never a strategy. A dashboard cannot earn you a citation. It cannot fix a thin review profile. It cannot place your business in a publication that AI systems trust. And now the data underneath some of those dashboards may be fabricated by the very platform being measured.
The businesses that will win AI search are not the ones with the best dashboards. They are the ones doing the actual work while everyone else watches numbers.
What actually moves the needle
AI systems cite what they trust, and they trust what they can verify across independent sources. That has not changed, and poisoning does not change it. What works:
Real press coverage on real publications. When independent outlets publish about your business, those pages become citation sources that no scraper poison can touch, because they live on the publication’s own domain.
Genuine reviews and community conversation. AI models lean on reviews, forums, and discussion precisely because they are hard to fake at scale. A business worth talking about earns the mentions that passive monitoring only counts.
Content worth citing. Clear, specific, expert content that answers real buyer questions gives AI systems something to quote. Commodity content gives them nothing.
Infrastructure inside the systems where agents act. As AI agents begin transacting, not just answering, businesses need machine-readable presence where the agents operate. Our agency runs an MCP server that lets AI agents search our publication network and place orders directly. That is what building for the agent economy looks like.
A team that implements instead of watches. Strategy documents do not earn citations. Somebody has to pitch the story, place the coverage, fix the profiles, build the pages, and wire up the infrastructure. Passive monitoring plus no implementation equals standing still while the ground moves.
The industry correction
Search has seen this pattern before. A new channel appears. Vendors sell shortcuts and dashboards. The platform changes the rules. The companies that built on fundamentals survive, and the ones that built on measurement theater do not.
In May 2026, Google updated its spam policies to say that attempting to manipulate generative AI responses in Search counts as spam. Poisoned SERPs carry the same posture into the data layer itself. The message to the industry is consistent: the shortcuts are closing, the data is getting noisier, and the only durable position is earned presence across sources you do not control.
For agencies, this is a moment of honesty. If your deliverable is a report, your client is paying for numbers that the platform can now falsify. If your deliverable is coverage, citations, and infrastructure, your work lives on domains Google cannot poison.
Build the footprint
The ground is moving faster than most businesses’ planning cycles. Google altering its own results pages would have been unthinkable as a routine tactic five years ago. Today it is a documented defense strategy, running at up to a quarter of tracked pages.
You cannot monitor your way out of this. You can only build your way out: real coverage, real reviews, real content, real infrastructure, maintained by people who do the work instead of watching the dials.
That is what we do. And in a landscape where the data itself can lie, it is the only strategy I trust.
Sources: Nozzle, “Poisoned Google SERPs” (October 10, 2026); DemandSphere, “Spurious data in Google SERPs” (October 7, 2026); Morningscore, “How Google Gave Rank Trackers Truncated Results for a Week” (October 8, 2026); Search Engine Roundtable, “Google: Spam Policies Apply To AI Responses (AI Overviews & AI Mode)” (May 15, 2026).