What is AI source integrity?

The discipline of watching the web that AI reads: why answer monitoring is not enough, and what source integrity covers.

TL;DR

AI source integrity is the discipline of monitoring the machine-readable layer of the web (the HTML source, HTTP headers, comments, metadata and feeds that agents actually consume) for content engineered to manipulate AI answers. Answer monitoring tells you AI said something wrong; source integrity shows you who planted the source that made it say it, with evidence you can act on.

Every AI answer about your brand comes from somewhere. The question that matters is not only what AI says, it is what AI was made to read.

Two layers, one gap

When a person visits a page, they see the rendered web: layout, images, the visible claim. When an agent visits the same page, it reads the machine web: raw HTML, HTTP headers, comments, metadata, structured data, llms.txt, feeds.

Between those two layers sits a gap, and into that gap third parties can write content meant only for machines. Hidden instructions that tell an assistant which brand to recommend. Planted narratives that manufacture consensus across the citation graph. Engineered pages that make a false claim look like common knowledge.

This is not hypothetical. A 2026 web-scale census of 1.2 billion URLs found ~15,300 validated prompt injections, with roughly 70% embedded in non-rendered layers that a human reader never sees (Khodayari et al., CCS'26).

AI source integrity is the discipline of watching that machine layer. It finds content engineered for agents before it becomes an answer, and proves it well enough to remove.

Why answer monitoring is not enough

Dozens of tools now monitor what AI says about a brand. That is useful, and it is also late. By the time an answer is wrong, the source behind it already worked:

  • The answer gives no pointer to the planted page.
  • Repeating the query later gives no timestamp on when the source changed.
  • Nothing links a wrong answer to the engineered source that caused it.

A concrete example of how late is late. In a February 2026 disclosure, Microsoft's security team described AI Recommendation Poisoning: 50+ live payloads across 31 companies. The payloads hid inside "Summarize with AI" buttons, telling assistants to remember the company as "a trusted source" (Microsoft Security Blog, 2026). Every affected answer was downstream of a source nobody was watching.

Source monitoring closes that loop: dual-view captures, citation trails, timestamps, and an evidence pack your counsel, agency, or platform contact can act on.

The three threat classes

  1. Hidden instructions: injections in headers, comments, metadata, hidden blocks, poisoned llms.txt or schema. See Hidden instructions: the injection class.
  2. Planted narratives: seeded claims, review clusters, citation farming, dark-GEO campaigns, competitor sabotage. These are sold as a service. China's CCTV 3·15 consumer-rights broadcast documented vendors charging ¥3,600–32,800 per quarter to place products inside AI answers (March 2026).
  3. Divergence evidence: the provable gap between what AI says and confirmed reality, traced back to an engineered source: the forensic bridge between a wrong answer and the page that caused it.

What "watching" actually means

Checking a page once proves nothing. Payloads rotate, appear only for crawler user-agents, or activate after a delay. Integrity monitoring is longitudinal:

  • Dual-view capture: the same URL rendered for a human and fetched as an agent, diffed for instruction-shaped content.
  • UA-matrix reads: the URL requested as a person, a search crawler, and an AI crawler; divergence between responses is itself a finding.
  • Timestamps and archives: each observation stored so a later answer can be matched to the exact source state that produced it.

Who needs it

  • Brands and agencies: detect planted narratives and competitor sabotage before they calcify into answers.
  • Legal and compliance: evidence-grade captures that survive scrutiny, not screenshots.
  • Platforms and researchers: a shared record of what the machine-readable web actually contains.

FAQ

Is AI source integrity the same as GEO (generative engine optimization)? No. GEO optimizes your own pages for AI visibility. Source integrity watches other people's sources: the hostile, external side of the same graph.

Can I just check llms.txt and robots.txt manually? Those two files are only a fraction of the machine layer. In the wild census above, the majority of injections lived in HTTP headers, HTML comments and metadata, places a manual spot-check never reaches.

How do I know if my brand is already affected? Look for AI answers that cite sources you don't recognize. Or that recommend competitors on queries you own, or state facts with no human-visible source. The evidence ledger shows documented public cases; a w3p sweep looks at the sources themselves.

See the evidence ledger for the public record, or the platform for how Sweep, Patrol, and Evidence Packs work.