public record

The evidence ledger.

What follows is the public record: incidents documented by platform security teams, peer-reviewed research, national broadcasters, and independent trackers. Dates are publication dates. Nothing here is our finding; our job is to make findings like these routine.

whenwhat happenedref
2026.02Microsoft Security publishes 'AI Recommendation Poisoning': 50+ live payloads across 31 companies in 14 industries, with instructions telling assistants to prefer, omit, or disparage specific brands. The first platform-level naming of the threat.MSFT-SEC
2026A CCS-published census of 1.2B URLs across 24.8M hosts validates 15.3K prompt injections, the majority embedded in non-rendered layers (HTTP headers, HTML comments, metadata). Roughly 1,500 target reputation or recommendation outcomes.CCS-26
2025.12Aurascape documents scam operations planting fake support phone numbers on trusted domains (.gov, .edu), and AI Overviews and assistants surface them as official contacts. Victims report real losses.AURA-1
2026.03China's annual consumer-rights broadcast exposé reveals a commercial dark-GEO industry: ¥3.6K-32.8K per quarter to place products and narratives inside AI answers; a fake product appeared in answers within two hours of seeding.CCTV-315
2025.02NewsGuard tracks the Pravda network: ~3.6M articles per year engineered for machine retrieval reach 33% repetition rates across 10 leading chatbots on covered narratives. Proof that volume buys machine memory.NEWSG
2025Forcepoint X-Labs finds ten live prompt-injection payloads performing fraud, data destruction, and API-key exfiltration, in the wild, not a lab.FXL-10
2025.06EchoLeak (CVE-2025-32711): the first zero-click indirect-injection CVE chain: hidden instructions in shared content exfiltrating chat data without user action. The attack class got a number.CVE-ECH
2025Anthropic reports cutting prompt-injection attack success rates from 23.6% to 11.2% in its browser-agent defenses. Real progress that still leaves a double-digit hole. OpenAI's security leadership calls prompt injection 'frontier, unsolved.'ANTH-ASR

Sources: Microsoft Security, CCS proceedings, Aurascape research, CCTV 3·15, NewsGuard, Forcepoint X-Labs, CVE-2025-32711, Anthropic. Full citation trail lives in the w3p research corpus. ask us for the reading list.

The threat taxonomy

Three classes cover what we have seen. All three produce the same outcome: an AI answer the brand never earned and cannot trace.

hidden instructionsinjection class

Content written for the machine layer and kept from human eyes: prompt injections in headers, comments, metadata, CSS-hidden blocks, Unicode smuggling, poisoned llms.txt or schema. The payload instructs the agent; the reader never sees it.

planted narrativespoisoning class

Claims seeded into the citation graph at volume: fake-review clusters, citation farming, engineered 'studies', dark-GEO campaigns, competitor sabotage. Nothing is hidden. The manipulation is in what the sources collectively say.

divergence evidenceforensics class

The provable gap: AI answers that differ from confirmed reality because the source environment was engineered. Dual-view captures, citation trails, and timestamps: the forensic bridge between a wrong answer and the planted source.

Detection is public knowledge now. The archive is what’s scarce.

The research community has already published the detection methodology. What nobody can backfill is the longitudinal record. what the web taught AI about your brand, day after day, campaign after campaign. That is the asset w3p is building, and why every surface we ship writes to the same archive.

Have a case the ledger should know?

Suspicious answers, planted pages, poisoned sources. Send them to the people building the archive.

Report a finding