Category: Industry

Google has added a paragraph to its “Creating helpful, reliable, people-first content” page warning site owners against fabricated author identities. It sits in the section on who created the content. Google’s page now shows a last-updated date of October 5, 2026 (UTC), and trade reports place the first appearance of the paragraph around October 1 to 2. Google announced no ranking update alongside it.

This piece sets out what the page says, what is new and what is not, and what the evidence does and does not show about bylines. It is written for teams responsible for search engine optimization and content marketing, and it ends with a short audit you can run on your own author pages.

What Google’s page says now

Read from Google’s documentation, the section on who created the content does three things in sequence. It encourages adding accurate authorship information, such as bylines, where readers might expect it. It tells site owners to avoid deceptive authorship information. And it says that fabricating creator profiles, for example with AI-generated headshots, made-up names or false credentials meant to make content look as if human experts wrote it, is a form of deception.

The consequence is stated plainly. Deception, Google says, “makes a page untrustworthy to both users and our automated quality systems.” The page adds that it is a signal of a low-quality page.

Two things about that wording matter. The target is fabrication: invented people, fake faces and false credentials. And the stated purpose is to make content appear human-expert written, which ties the problem to misleading readers about who is behind the content.

What is new, and what is not

The paragraph itself is new. Search Engine Journal’s Matt G. Southern reported on October 2 that an archived copy of the page from June 8 lacked it. The same revision added a definition of main content and four attributes that Google says its raters assess: effort, originality, talent or skill, and accuracy, with a higher bar for accuracy on topics that affect health, finances, safety or well-being.

The principle is not new. Google’s Search Quality Rater Guidelines already treat deception as grounds for the lowest rating. Section 4.5.3 of the September 11, 2025 edition covers deceptive information about a website or its content creators, and says pages using deception should be rated Lowest. Search Engine Journal adds that those guidelines already named fake creator profiles. Relevant Audience makes the useful point that what changed is where the statement appears: in public documentation aimed at site owners, not only in guidance for raters.

The date, checked at Google’s page

This is where care is needed. The date on Google’s page is the date of the latest revision, not necessarily the date the paragraph was added. Search Engine Journal described a version dated October 1 on October 2, and the page now says October 5, so it has been revised since. SEO consultant Marie Haynes said the change was made on October 2. Search Engine Journal also reported that Google’s documentation updates page did not list the edit, and we did not find an entry for it either.

The safest wording is that the paragraph appeared in early October 2026 and that Google has not published a dated announcement for it.

What it does not say

The guidance leaves several things open, and some readings going around go further than the page does.

It announces no ranking update, no system name and no penalty. It does not explain how Google would detect a fabricated profile. Google’s page also notes that its raters do not control how pages rank, so the rater attributes describe what quality evaluation looks for, not a published ranking formula.

It does not say bylines help you rank. Google’s Search Liaison said in January 2024 that “Just adding a byline doesn’t give a ranking boost.” The new paragraph does not contradict that. It says deception is a risk, not that honest authorship is a lever.

And it is not a ban on AI. The sentence concerns fabricated people presented as human experts. Our reading is that a clearly labeled editorial team, or AI assistance disclosed where readers would wonder, is a different situation from an invented doctor with a generated photo. Google’s page does suggest disclosing automation where readers would reasonably ask how content was made.

Bylines and AI citation: what the evidence shows

It is tempting to treat real authors as a way to win citations in AI answers. The evidence does not support that yet, so we would not frame it that way.

The most direct data we found comes from Discovered Labs, a vendor that sells answer engine services, so read it with that in mind. It tested Perplexity only, using 400 questions and 5,770 pages from Google’s first results page. Pages published by companies were cited more often than pages by individual authors: 39.5% against 27.1%. The study calls the gap an association, not proof of cause. It also classifies a staff byline on a company blog as company content, so it does not test bylines directly. It cites a separate study of 497 Google results across 30 queries that found no measurable effect from bylines and credentials on citation.

That is thin evidence in both directions. What it supports is modest: treat authorship as a trust and risk matter, not as a citation tactic. Real people behind your content protect you from the downside Google has now named, and they help readers judge whether to trust you. They are not a proven way to get cited.

What counts as a fabricated profile

Google’s sentence names three examples. In practice, a team should check for these:

An author who does not exist. A name invented to give content a face, with no real person who wrote, reviewed or answers for it.

A photo that is not the person. An AI-generated headshot or stock image presented as the author.

Credentials that cannot be verified. Titles, years of experience, degrees or licenses that the person does not hold.

A fourth case sits close to the line, and it is our reading, not Google’s. A real expert’s name placed on content they did not write or review. Google’s separate instruction to avoid deceptive authorship information is broader than the fabricated-profile sentence, so this is worth treating as a risk.

A byline audit you can run this week

Start with a list of every author name that appears on your site, including old posts and contributors who have left.

Check that each name belongs to a real person who can confirm they wrote or reviewed the content. If a byline is a pen name, replace it with a transparent label such as your editorial team, and say so.

Check the photo. Use a real photograph of that person, or no photo.

Check the credentials. Every claim should be something the person can document: a license, a publication, a role at a named employer.

Check the author page. Google’s page asks whether bylines lead to further information about the author and the topics they write about. Each byline should link to a page with a real bio, links to their professional profiles and a list of their work. A bio at the end of an article with no link to a profile page leaves that question half answered.

Check sensitive topics. Where content covers health, legal or financial decisions, the accuracy bar is higher. Name the expert reviewer and the review date. Teams in healthcare and legal fields should be the strictest.

Check AI disclosure. Where AI assisted the draft, decide what readers should be told, and make sure a named person is accountable for the final text.

Fix, do not delete by reflex. If an author profile cannot be verified, correct the byline, label it accurately, or have a qualified person review and sign off on the content. Removing posts without a plan can cost you pages that were working.

Why this matters for AI search visibility

AI assistants and answer engines draw on pages that readers and search systems already treat as credible. Our guide to how AI search works explains how a page can be cited without ranking at the top, and why clear answers, specific claims and self-contained sections matter more than decoration. For generative engine optimization, the practical lesson from Google’s change is to build content on accurate, attributable information so that no part of it depends on a fake face. Our full guide to generative engine optimization covers that groundwork.

The same logic applies to answer engine optimization. Answers drawn from your pages carry your name, so the people and claims behind them need to hold up. Our look at why third-party mentions matter in AI search makes a related point: independent credibility is earned, and it is hard to fake.

To see where your brand and its experts are actually mentioned, a free AI Visibility Audit checks real questions across platforms. Our complete guide to the AI Visibility Audit explains the method.

Where this leaves you

The confirmed facts are these. Google’s people-first content page now warns that fabricating creator profiles, such as with AI-generated headshots, made-up names or false credentials, is a form of deception that makes a page untrustworthy to users and automated quality systems. The page shows a last-updated date of October 5, 2026, and trade reports place the paragraph’s first appearance at October 1 to 2. Google announced no ranking update, penalty or detection method, and the page does not say bylines improve rankings.

The practical response is an audit, not a rewrite. Make sure every byline is a real person, every photo is that person, every credential can be verified and every author has a page that proves it. Whether the aim is generative engine optimization, answer engine optimization or plain search engine optimization, treat that as a baseline for trust, not as a trick.

Frequently Asked Questions

1. What did Google add to its people-first content guidance?
A paragraph in the section on who created the content saying that fabricating creator profiles, such as with AI-generated headshots, made-up names or false credentials to appear expert, is a form of deception.

2. When did Google add it?
Google’s page shows a last-updated date of October 5, 2026, which is the latest revision. Trade reports place the first appearance of the paragraph around October 1 to 2. Google has not published a dated announcement for it.

3. Is this a ranking update?
Nothing announced says so. Google named no update, system, penalty or detection method. The wording describes what quality evaluation looks for.

4. Do author bylines improve rankings?
Google’s Search Liaison said in January 2024 that adding a byline does not give a ranking boost. Google’s page encourages accurate bylines for readers, but does not call them a ranking factor.

5. Does this ban AI-generated content or AI headshots?
No. The sentence concerns fabricated profiles presented to make content seem expert-written. Google’s page does suggest disclosing automation where readers would wonder how content was made.

6. Will real authors help me get cited in AI answers?
There is no solid evidence that they do. One vendor study of Perplexity found company pages cited more often than individual-author pages, and a second study it cites reported no measurable byline effect. Treat authorship as trust, not a citation tactic.

7. What should I do first?
List every author on your site, confirm each is a real person with a real photo and verifiable credentials, and make sure each byline links to a genuine author page.

If you want to know how your brand and its experts appear across Google and AI answer engines today, that is exactly what we look at in a free AI Visibility Audit.

Picture a Monday morning report. Your rank tracker says a key page has fallen out of the top 10, and the pages that replaced it look unrelated. The usual reaction is to start rewriting. A new question belongs first: did the ranking change, or did the tool receive the wrong results page?

On October 10, 2026, the rank-tracking company Nozzle published research claiming that since September, Google has been returning complete, normal-looking results pages to its rank trackers with the real results swapped out. Nozzle sells rank tracking, and Google has not commented. This piece sets out what was reported, what is and is not established, and how to check before you react. It is written for teams responsible for search engine optimization reporting.

What Nozzle reported

Nozzle’s page analyzes 27.5 million search results pages from its customer datasets, collected between August 20 and October 9, 2026, across 49 countries, desktop and mobile.

From August 20 to September 9, about 0.17% of pages were poisoned, which is Nozzle’s baseline. On September 13, requests to Google began failing in large numbers. The first poisoned pages appeared on September 20. They peaked at roughly a quarter of all pages between September 27 and 29, at 24.9%, 26.7% and 27.0%. Since October 1, daily rates have run at about 4% to 11%. Across the period since September 13, Nozzle puts it at 8.0%.

The word poisoned matters. Google does not refuse these requests, according to Nozzle. It answers with a full page of wrong results. Nozzle puts it this way: “A poisoned request succeeds.” There is no error, no captcha and no change in the page template, so the only way to spot it is to compare a keyword’s results over time.

How it was measured, and a caution about the 8.0%

A keyword’s usual sites are those in the top 10 on at least 60% of its baseline pages. A page counts as poisoned when fewer than half of them appear on any page of the results, and they return later. Those thresholds are the study’s own choices.

Several limits apply. Detection is inferred from each keyword’s history, not from a signal Google has confirmed. The sample comes from Nozzle’s own customers, and the last few days are still filling in. And the headline 8.0% does not state its denominator: the daily table is labeled “All SERPs,” while the country and industry tables calculate against judged pages. Cite it as “Nozzle reports about 8%,” not as a measured rate of Google behavior.

What a poisoned page looks like

Nozzle reports these patterns on poisoned pages, compared with its baseline.

Organic results kept only 20.7% of the previous page’s sites, against 88.5% at baseline. A tracked project’s own site fell out of the top 10 on 58.6% of poisoned pages, against 2.7% at baseline. Reddit rose from 20.8% to 28.8% of top-10 appearances, and Facebook from 28.3% to 33.8%. An AI Overview appeared on 34.9% of poisoned pages, against 54.2%. Ads and shopping results were largely stable.

One example shows how complete the swap can be. For the desktop, US search “white label local seo,” all nine page-one sites on October 4 were the usual vendors. On October 7, all nine had been replaced by unrelated results, including a WordPress tool, a steakhouse and government sites.

The effect is usually brief. About 80% of poisoned spells lasted a single page, and 77.9% of poisoned pages had their usual sites back within three days. A real ranking change persists, which is how the two can be told apart.

Where it appears to hit hardest

Nozzle’s tables show wide variation. Since September 13, the poisoned share was 8.5% in the United States, 10.5% in Canada and 11.5% in Australia, with the United Kingdom lowest at 3.0%. Treat country figures as indications, since they depend on Nozzle’s sample sizes.

“Near me” searches were poisoned more often (11.4%) than other queries (7.8%), and navigational brand searches least often (5.3%). If you manage local SEO reporting, that is worth knowing.

By industry in the US, legal was highest at 15.9%, peaking at 51.3% on September 27. Pets was lowest at 4.3%. Firms in the legal sector should be the most careful about reacting to a single day.

The tools matter too. On the same days, one collection route returned 1% to 7% poisoned pages while another returned 9% to 30%, so how your vendor collects data affects what it sees.

A second vendor, and a reporter’s concern

Nozzle is not alone. DemandSphere, another rank-tracking company, posted on October 7 that Google returns spurious results when it suspects bot traffic, affecting about 11% of its daily results pages. PPC Land reported the figure on October 13. DemandSphere’s post does not describe a method or sample size. Both figures are vendor-reported and unaudited, and they agree on the mechanism and rough scale, little more.

Barry Schwartz of Search Engine Roundtable reported on October 12 that third-party rank tracking is returning incomplete or inaccurate data. He relayed the three tactics that Nozzle’s Derek Perkins described: wide IP blocking aimed at large residential proxy networks, a big increase in captchas, and injecting bad data into suspect pages. Schwartz singled out the third: “The third approach, injecting bad data, concerns me the most.” His reasoning is that tools may not notice it, so they can appear to work while their data is wrong. Several vendors, including Sistrix, SE Ranking and DataForSEO, reportedly posted notices about data problems.

What is not established

Google has not publicly commented on Nozzle’s or DemandSphere’s figures or on the September changes. Everything about motive comes from vendors and the trade press.

Nozzle reads the pattern as Google’s response to bulk collection of its results for AI grounding, which rank tracking resembles. DemandSphere’s founder makes a similar argument. Schwartz’s view, as reported, is that Google is aiming at AI bots and scraping services, not SEO tools. Roger Montti of Search Engine Journal adds that altered pages could also confuse spammers reverse-engineering rankings, a point Nozzle did not raise. None of these readings is confirmed.

There is also a confound. Google’s September 2026 spam update ran from September 24 to October 8, according to PPC Land and Looploop, so real ranking volatility and altered data overlapped in the same weeks. Our earlier piece on the September spam update covers the real-volatility side. A single dashboard showing a drop in that window could not tell the two apart.

Even first-party data can lag. Looploop reports that the Search Console Performance report ran more than 64 hours behind on October 11, so check the date range first.

How to tell a real drop from a poisoned page

Start with Search Console. If it still shows impressions and clicks for the same queries and dates, the site very likely did not drop. Confirm that its data is current first.

Compare against history. Look at the keyword’s usual top 10 over several weeks, not just yesterday, because yesterday may also have been poisoned.

Wait one to three days. Most altered pages clear quickly, while a real change persists.

Read the shape of the page. Nozzle says fewer AI Overviews, fewer “People also search for” modules, more image packs and social or forum sites, and shorter pagination are suggestive, but none is reliable alone.

Cross-check tools. A drop that only one tool reports is a question, not a conclusion.

Ask your vendor how it detects swapped pages and what its error rates are. Relevant Audience, citing PPC Land, reports that most do not yet publish comparable figures.

Hold off on changes. Do not rewrite pages from one chart. Our guide to reading your own traffic before you change anything sets out a three-step method that works here too.

What to change in your reporting

Make first-party data the reference. Search Console, analytics and conversions should anchor the monthly report, with the rank tracker used for trends. Our look at Google’s AI visibility reports in Search Console explains what that data does and does not include.

Set a rule for alerts. A drop seen on one day, in one tool, should trigger a check, not a client email. Require it to persist, or to appear in Search Console, before it is reported as a ranking loss.

Annotate your dashboards. Mark September 13 to October 9 as a period of suspected data problems, so later readers do not mistake a poisoned dip for a penalty.

Why this matters for AI search visibility

Nozzle’s data shows AI Overviews appearing less often on poisoned pages (34.9% against 54.2%). Any measurement that infers AI visibility from collected Google pages may pick up the same noise. That is our inference, not Nozzle’s finding, and tools that measure AI answers by other methods may behave differently.

The practical response is to avoid relying on one source. Generative engine optimization and answer engine optimization are about being cited and recommended in AI answers, and measuring that well means testing real buyer questions across several platforms, not reading a single scraped page. Keep the basics of generative engine optimization and answer engine optimization strong: clear answers, accurate information and consistent entities. Our complete guide to the AI Visibility Audit explains how that cross-platform measurement works. Strong search engine optimization remains the base for all of it.

Where this leaves you

The confirmed facts are these. Nozzle published research on October 10, 2026, covering 27.5 million results pages, and reports that since September 13 about 8.0% were poisoned, against 0.17% at baseline, with a peak near 27% in late September. DemandSphere reports about 11% on its own data. Google has not commented, the mechanism is Nozzle’s account, the motive is interpretation, and both figures come from vendors who sell rank tracking.

The lasting lesson is about method. A rank tracker is a sample of what Google returned to a tool, not a record of what your customers saw. Before reacting to a drop, check Search Console, compare with history, wait a few days and look at more than one source.

Frequently Asked Questions

1. What did Nozzle report about Google and rank trackers?
On October 10, 2026, Nozzle reported that since September, Google has returned complete, normal-looking results pages to rank trackers with the real results swapped out. It measured 8.0% of 27.5 million pages as poisoned since September 13, against 0.17% at baseline.

2. Has Google confirmed this?
No. Google has not publicly commented on Nozzle’s or DemandSphere’s figures or on the September changes. The explanations come from vendors and trade press.

3. Can I trust the 8.0% figure?
Treat it as Nozzle’s reported estimate. It is from a rank-tracking vendor and inferred from keyword history.

4. How do I know whether my ranking drop is real?
Check Search Console for the same queries and dates, compare with several weeks of history, and wait one to three days. Altered pages usually clear within days, while a real ranking change persists.

5. Does this affect Search Console data?
Nozzle’s study concerns data collected from Google results pages, not Search Console. Search Console can lag, though, so confirm the date range first.

6. Does this change how I should track AI visibility?
Tools that infer AI visibility from collected Google pages may pick up the same noise, which is our inference. Testing real buyer questions across several AI platforms does not depend on one scraped page.

7. Should I stop using my rank tracker?
No. Use it for trends, and confirm important changes in Search Console and analytics. Ask your vendor how it detects swapped pages and what its error rates are.

If you want to know how your brand appears across Google and AI answer engines, measured from real answers and not a single dashboard, that is exactly what we look at in a free AI Visibility Audit.

When someone searches for your business by name on their phone, the panel that appears is often the first and only thing they read. For years, that panel has been built from your Google Business Profile: hours, phone number, photos, reviews and a map pin. In September 2026, marketers began reporting something new at the top of it, an “AI Overview” label above a short, AI-written description of the business.

It is a test, not a launch, and Google has not announced it. But it points in a direction every local business should take seriously, because the description is no longer only what you wrote. This piece covers what was reported, what is and is not known, and a practical checklist of what to check now.

What was reported

On September 17, 2026, Search Engine Roundtable reported that some local knowledge panels, which are Google Business Profiles, now show an “AI Overview” label. A Show more button below the description expands the panel into a chat-style follow-up experience that resembles AI Mode. Ben Fisher, co-founder of the local search agency Steady Demand, posted about it first, and Barry Schwartz of Search Engine Roundtable said he was able to reproduce it himself.

On September 23, the UK agency Marwick Marketing described the same behavior. Its write-up says the change has so far been spotted only on mobile and that UK marketers have replicated it. It also says Google has not announced anything, and it describes the change as “not confirmed as a permanent change yet”.

That is the full set of established facts. We found no official Google statement or documentation describing the feature.

A test, not a rollout

The distinction matters because it should shape your response. A rollout is a settled change that you plan around. A test is something Google may expand, modify or withdraw, and may be showing to only some users, in some places, on some devices.

There is also precedent for this kind of experiment. Search Engine Roundtable reported in June 2024 that Google had shown AI-generated text as the description in some local panels, text that business owners had not written themselves. Schwartz’s September report says Google has been testing variations of this for a while. So the sensible reading is not that local search changed overnight. It is that Google keeps experimenting with letting AI describe a business, and the current version is the most visible so far.

The practical consequence is that some customers will see the classic panel and some may see the AI version. Both need to be right.

What the one detailed example shows

The most detailed public example is Schwartz’s own. He found that most of the AI-written description of his business was correct. One part, a section on what he calls niche solutions, was somewhat out of date. Importantly, he did not blame the AI for that. He noted that the content on his own company site was old, which suggests where the description drew its detail.

That small example carries a useful lesson. An error in an AI description may not be an AI invention. It may be an accurate summary of outdated information you published, or left in place, somewhere. Schwartz’s own reaction was mixed. He wrote that he was unsure he wanted AI describing his business “when I can” do it himself.

For a local business, the lesson is that every public statement about you, on your site, your profile and elsewhere, is a potential input. If a service you stopped offering is still listed, a summary can repeat it.

What a larger snapshot adds, with caution

On September 26, Fisher’s company published a study of how AI Overviews merge with business panels on mobile. It should be read with that context in mind: the author sells local search services, and the study is a single-day snapshot, which the author acknowledges.

The sample was 100 local brands across ten service industries, searched on mobile from a New York anchor point, with four query variations per brand. The study reported that 26% of brands showed an AI Overview on a plain brand-name search on mobile, against 6% on desktop. Of the overviews that appeared, about 80% were merged into the business panel. In four of 68 phone searches, the result surfaced a different, similarly named business. And in a three-day repeat test, one of 20 brands changed layout from one day to the next.

We would not treat those figures as a benchmark. One day, one city and an agency author make the findings suggestive, not conclusive. They support three cautious observations. The experience is not uniform. It appears more common on mobile. And a business can be confused with another of similar name, which is a reason to check your own results rather than assume.

What may feed the description, and what is unproven

The obvious question is which of your information the AI uses. Marwick Marketing says local panels draw on Google Business Profile data and on Google’s Knowledge Graph. Beyond that, advice circulating in the industry gets more speculative.

Some commentators say the services list matters more than website copy, or that review wording shapes the description, or that posts and photos act as freshness signals. Those are interpretations. We found no published test showing which fields drive the text, and one widely cited guide rests on a single reported example with no sample size or method.

So the honest position is this: nobody outside Google can say exactly how the description is built. What you can do is make every plausible source accurate, current and consistent. That costs little, and it is the same work that supports good local search engine optimization whether or not the test continues.

What to check now

Start with what customers see.

Search for your business by name on a phone while logged out of your Google account. Note whether an AI Overview label appears, read the description line by line, and take a dated screenshot. Do the same for a search like your name plus reviews. Results vary, so repeat the check on different days.

Look for errors. List anything wrong, outdated or missing, such as retired services, old locations or wrong hours, then trace each one to its source: your website, your profile, a directory or a review.

Then fix the sources.

Review your Business Profile against Google’s own guidelines. Choose categories carefully: Google tells businesses to use “the fewest number of categories” that describe the core business, and to pick the most specific ones. Make sure the services and products you list are real and current. Keep the business description honest and relevant, and remember that the guidelines do not allow special promotions, prices or links in it.

Check hours, including holiday and seasonal hours, and make sure your address and phone number match exactly across your website, your profile and your main directories. A mismatch gives any summarizer two versions to choose from.

Update your website. If the AI reads your site, an outdated services page or an old about page is a liability. Remove or revise anything that no longer applies.

Look at your reviews. Respond to recent ones, and read how customers describe you. Their language will appear in the public record about your business. Do not ask for scripted reviews or write fake ones.

Test for confusion. If your name is similar to another business, search from a different location or on a different device and see whether the wrong business appears. If it does, keep your name, address and categories distinct and accurate.

Finally, set a routine. Pick a day each month, repeat the checks and keep the dated screenshots in one place.

What not to do

Do not stuff keywords into your business name or description to influence the AI. Google’s guidelines say the name should reflect how customers know the business, and violations can lead to changes in your information or removal of your listing.

Do not assume you can opt out. Marwick Marketing reports that the only option it found was filtering AI results with the Web results toggle, which is a viewer’s choice, not a business’s.

Why this matters beyond Google

This is part of a broader shift in how people find local providers. Generative engine optimization and answer engine optimization are about being described correctly and recommended in AI-generated answers, and the AI Overview in a business panel is one of those answers, attached to your name. The same discipline applies on every platform: clear, accurate, consistent information published in places machines can read.

The Steady Demand snapshot also found that most AI citations in its sample pointed to third-party platforms, such as review sites and forums, rather than official brand sites. As a single-day sample, that is only an indication. But it is a reminder that what other people say about you may shape the answer as much as what you say yourself. Strong local search engine optimization, generative engine optimization and answer engine optimization now overlap, and a profile that is accurate everywhere is the common denominator.

Where this leaves you

The confirmed facts are these. Search Engine Roundtable reported on September 17, 2026 that some local knowledge panels show an AI Overview label, with a Show more button that opens a follow-up chat. The change was reproduced by Schwartz and by UK marketers, appears so far to be mobile only, and has not been announced by Google. It is a test.

The response is a routine, not a rebuild. An AI Visibility Audit can show where your information is wrong across AI platforms. Search for yourself, read what the panel says, trace any error to its source, and correct your profile, your website and your listings. Treat your public information as the raw material for every summary of your business, human or machine.

Frequently Asked Questions

1. What is the AI Overview label in local knowledge panels?
It is a label that some searchers see at the top of a business’s panel, above a short AI-written description. A Show more button opens a chat-style follow-up, similar to AI Mode. Search Engine Roundtable reported it on September 17, 2026.

2. Has Google confirmed this feature?
No. Google has not announced it, and we found no official documentation. It should be treated as a test that may change or disappear.

3. Is it only on mobile?
So far, reports describe mobile. Marwick Marketing says it has only been spotted there, and a September snapshot study by Steady Demand found AI Overviews far more often on mobile than on desktop. That study was a single-day, agency-run sample, so treat it as an indication.

4. Can I opt out of AI descriptions of my business?
We found no business-side opt-out. Marwick Marketing reports that the only option it found is a viewer filtering AI results with the Web results toggle.

5. What should I check first?
Search for your business by name on a phone while logged out, read the description, and screenshot it. Then check your profile categories, services, description, hours and contact details, and your website for outdated statements.

6. Does review wording affect the AI description?
Some commentators say so, but we found no published test that proves it. What you can do is respond to reviews, keep your service information accurate and never write or script fake reviews.

7. How often should I check?
Monthly is a reasonable routine for most local businesses. Keep dated screenshots so you can see what changed and when, and check more often if you make major changes to your services or hours.

If you want to know how your business appears across Google and AI answer engines, and where the information is wrong or missing, that is exactly what we look at in a free AI Visibility Audit.

For years, shopping on Google followed a familiar path: a search, a click, a visit to your store, a purchase. Your analytics were built around it. In late September 2026, part of that path moved. Eligible US Shopify merchants can now sell directly inside Google’s AI Mode and the Gemini app, where a shopper taps Buy and pays without ever opening the merchant’s website.

For merchants, the change is both an opportunity and a measurement problem. Sales can arrive from a surface where your tracking does not run. This piece sets out what was announced, who is affected, how to opt out, what the checkout supports and what it does not, and a decision framework for whether to leave it switched on. We have kept to what documentation and reputable reporting confirm, and flagged what is unclear.

What changed

On September 22, 2026, Search Engine Land reported that Google is notifying eligible Shopify merchants that their products can be bought directly in AI Mode in Google Search and in the Gemini app. The checkout runs on the Universal Commerce Protocol, an open standard Google developed with other companies, including Shopify, that lets AI agents interact with merchants and payment systems during shopping.

Two details deserve attention. First, merchants did not have to apply. Search Engine Land reports that eligible products are included automatically once a Shopify store is matched with its Google Merchant Center account, and Shopify’s help center confirms that direct checkout is on by default for eligible stores. Second, the rollout is gradual. Shopify says direct checkout is still rolling out to Google users and may not yet be available in every store, and Google’s own documentation, as quoted by ContentGrip, describes the program as “a phased program for select participating merchants”.

Who is eligible

Shopify’s help center lists the requirements. Your store must be based in the United States and sell to US customers. You need a valid Google Merchant Center account and must meet Google’s requirements, including its free listing eligibility and return policy rules. Your products must be available in Merchant Center, either through Shopify’s Google and YouTube sales channel with product and shipping sync turned on, or through a third-party feed provider or manual upload. Products must also be eligible for Shopify Catalog, you must agree to the Shopify Agentic Storefronts Supplemental Terms of Service, and your terms of service, privacy policy and refund policy must be completed in your Shopify settings.

Direct checkout is shown only to US-based shoppers.

There is no extra fee. Shopify states that you pay only your standard payment processing fees. Merchants also keep the underlying customer and order relationship, according to Search Engine Land, and the retailer remains the seller of record, according to Google’s documentation as cited by ContentGrip.

How to opt out

If you want shoppers to complete purchases on your own site, Shopify’s help center gives these steps. In the Shopify admin, go to Sales channels, then Agentic. Deactivate the setting called Allow Shopify to manage for me. Click Google AI Mode and Gemini. Switch Direct checkout off, then click Save.

Opting out does not remove you from AI Mode. Your products can still appear in results, but shoppers are redirected to your online store to complete the purchase.

What direct checkout supports, and what it does not

The in-AI checkout is not an exact copy of your store’s checkout. Shopify’s documentation sets out the gaps.

Supported: automatic discounts and discount codes, and Shopify Functions for shipping, discounts and cart and checkout validation.

Not supported: subscriptions, product bundles, customizable products and B2B-only products. Local delivery, in-store pickup and pickup points. Requiring customers to sign in before checkout. Only a subset of accelerated checkout options. Many checkout blocks, including upsells, loyalty and rewards blocks, consent collection blocks, chat blocks and trust badges, may not display, so the checkout can look different from your own. Shopify also asks that required legal disclosures appear within the first 6,000 characters of a product description.

Why this is a measurement problem

Shopify’s help page states plainly that “Google Analytics and custom pixels won’t fire” in direct checkout. Only server-to-server pixel events fire, and only two of them: checkout started and checkout completed.

Your analytics tag, ad platform pixels and attribution tools all depend on code running in the shopper’s browser on your site. When the purchase happens inside Google’s surface, that code never loads. The sale is real, but the session your tools normally record does not exist on your side.

Three practical consequences follow.

Revenue can be undercounted in tools that rely on client-side tracking. If you compare Google Analytics revenue with Shopify order totals, a widening gap may be this checkout, not a tracking bug.

Channel reporting can shift. Because the journey no longer includes a visit to your site, orders may not be credited the way you expect. Shopify’s page does not describe how these orders are labeled in your admin or reports, and we found no authoritative source that does, so treat any confident claim about it with caution.

Funnel analysis loses steps. These buyers generate no product page views, add-to-cart events or checkout steps on your site, so a shift in conversion rate could reflect where people buy, not how well your pages convert.

The practical answer is to reconcile against Shopify’s own order data, which records the purchase wherever it happens, and to stop treating the browser-side analytics tag as the only source of truth for revenue.

What is still unclear

Some claims in circulation should stay out of your planning until they are confirmed. Some coverage repeats specific review thresholds, such as a minimum number of reviews and a minimum star rating. Those figures relate to Merchant Center’s store ratings rules for showing ratings with ads, and we could not confirm that they are conditions for this checkout. Shopify’s eligibility list above does not include them.

Reports of a separate, wider default-on rollout of agent checkout across Shopify, including a figure of about one million merchants, rest on thin sourcing, so we have not relied on them.

Finally, there are open questions on reporting: how these orders are labeled, what Google will offer in Merchant Center for AI surface performance, and how consent settings apply. Recheck the documentation before committing.

Opt in or opt out: a decision framework

There is no single right answer. It depends on what you sell and how you measure it. Use these questions.

Do you sell subscriptions, bundles, customizable items or B2B-only products? If these make up a large share of revenue, the AI checkout cannot handle them, and keeping the feature on mainly matters for your simpler products.

How much of your profit comes from checkout upsells or loyalty features? If the answer is a lot, redirecting shoppers to your own checkout protects that revenue.

How dependent is your reporting on client-side tracking? If your team, or your agency, cannot trust revenue numbers without it, you may prefer to opt out until your reporting is ready.

Do you want to learn? Some merchants will reasonably leave it on for a few weeks and compare Shopify order data with previous periods, as long as they set a review date.

For most stores, a good default is to keep the feature on for a defined trial period if your product mix is mostly simple, one-time purchases, and to switch it off if subscriptions, bundles or upsells drive revenue.

What to do this week

Open the Agentic section in Shopify and see whether direct checkout is on for your store.

Review your Merchant Center feed and your Shopify policies. Product discovery in AI Mode is powered by Merchant Center, so missing attributes, mismatched prices or incomplete return policies can limit what shows up.

Check product descriptions for legal disclosures in the first 6,000 characters.

Place a test order if possible and see how it appears in Shopify and in your analytics.

Reconcile weekly. Compare Shopify order totals with analytics revenue.

Why this matters for visibility

This checkout sits at the end of a discovery path, and the path begins with product data. Shopify’s documentation says product discovery in AI Mode is powered by Google Merchant Center, so a store whose data is complete and consistent has a better chance of being shown. That is where search engine optimization, generative engine optimization and answer engine optimization meet ecommerce: accurate titles, complete attributes, clear policies, authentic reviews and consistent information across your site and your feed.

The checkout does not change the basics. It raises the stakes on them, because a recommendation in an AI answer can now turn into a sale without a visit to your site. For brands that want to understand how they appear in these answers before deciding how to respond, an AI Visibility Audit is a sensible starting point, because you cannot manage what you have not measured.

Where this leaves you

The confirmed facts are these. Google and Shopify have enabled a native checkout in AI Mode and the Gemini app for eligible US Shopify merchants, powered by the Universal Commerce Protocol. It is on by default for eligible stores and can be turned off in the Agentic settings. Merchants keep the customer and order relationship. Google Analytics and custom pixels do not fire, and only server-to-server started and completed events are sent. Several features, including subscriptions and bundles, are unsupported.

The response is a decision, not a panic. Check your setting, choose deliberately, protect what depends on your own checkout, and measure through Shopify’s order data while your reporting catches up. Strong search engine optimization, generative engine optimization and answer engine optimization all start with clean product data, either way.

Frequently Asked Questions

1. Is Google’s AI Mode checkout turned on for my Shopify store?
If your store is based in the US, sells to US customers and is matched with a valid Merchant Center account, it is likely eligible, and Shopify says direct checkout is on by default for eligible stores. The rollout is gradual, so check Sales channels, then Agentic, in your Shopify admin.

2. How do I opt out of direct checkout in AI Mode?
In Shopify admin, go to Sales channels, then Agentic. Deactivate Allow Shopify to manage for me, click Google AI Mode and Gemini, switch Direct checkout off and save. Your products can still appear, but shoppers are sent to your online store to buy.

3. Do I still own the customer and the order?
Search Engine Land reports that merchants keep the underlying customer and order relationship, and Google’s documentation, as cited by ContentGrip, says the retailer remains the seller of record. Shopify charges no extra fee beyond standard payment processing.

4. Will Google Analytics track these purchases?
No. Shopify’s help page says Google Analytics and custom pixels do not fire in direct checkout. Only server-to-server started and completed events are sent. Use Shopify’s order data to reconcile revenue.

5. Which products and features does the AI checkout not support?
Subscriptions, bundles, customizable products and B2B-only products are not supported, nor are local delivery, pickup or required sign-in. Many checkout blocks, such as upsells, loyalty and consent blocks, may not display.

6. Do I need 100 reviews and a 3.5 star rating?
We could not confirm that. Those figures relate to Merchant Center store ratings for ads and are not on Shopify’s eligibility list.

7. Should I leave it on or switch it off?
It depends on your product mix and your reporting. Stores with mostly simple, one-time purchases may reasonably test it for a defined period. Stores that rely on subscriptions, bundles, upsells or client-side tracking may prefer to opt out.

If you want to know how your brand and products show up across Google and AI answer engines, that is exactly what we look at in a free AI Visibility Audit.

On September 24, 2026, Google began rolling out its September 2026 spam update. Spam updates usually finish in a couple of days, so most site owners are used to a short burst of volatility followed by a clear before and after. This one is different. Google says the rollout may take up to two weeks, which means that for a full fortnight, every ranking change you see is a reading from a moving target.

That changes how you should respond. This piece covers what Google has confirmed, what it has not said, what early volatility data does and does not show, and a practical plan for the days between now and the end of the rollout. It is written for anyone responsible for search engine optimization at their company, whether you run a small site or manage a large content library.

What is confirmed

The core facts come from Google’s Search Status Dashboard and are consistent across Search Engine Land, Search Engine Journal and Search Engine Roundtable.

The update began on September 24, 2026, at 9:15 a.m. Pacific time. It applies globally and to all languages. Google’s dashboard says the rollout may take “up to two weeks to complete”, which puts the latest possible finish around October 8. It is the fourth spam update of 2026, following releases in March, June and August.

The rollout window is what stands out. The dashboard lists the earlier 2026 spam updates at 19 hours and 30 minutes for March, 2 days and 1 hour for June, and 2 days and 16 hours for August. Two weeks is several times longer than any of them. One point of precision matters here: two weeks is the announced maximum, not a measured duration. The update could finish sooner, and until Google marks it complete, nobody outside Google knows how long it will really take.

What Google has not said

Google has not said what this update targets. According to PPC Land, Search Central described it only as a normal spam update, with no new policy, no named category and no figures on how many queries are affected. That gap matters, because much of the commentary this week has filled it with confident claims about which sites are being hit and why. Treat those claims as hypotheses. The only firm statement from Google is that sites which see a change should review its spam policies. Anything more specific is inference from other people’s data.

What early data shows, and what it does not

Search Engine Roundtable reported that a long list of volatility trackers showed significant movement across the first weekend, September 25 to 27. The tools it named include Semrush Sensor, AccuRanker, Mozcast, Sistrix, Algoroo and several others. When that many independent trackers move at once, it is a reasonable signal that something real is happening in the results.

Glenn Gabe, a well-known analyst of Google updates, reported big drops across a number of sites in multiple verticals and countries. He described AI-generated content sites and programmatic content farms as among those losing rankings. That is one experienced observer’s read of the sites he tracks, and it fits how Google’s spam policies treat scaled content, but it is not confirmed by Google and it is not a full picture of who is affected.

There are three reasons to be careful with early data.

First, volatility is not damaging. Trackers measure how much results moved, not who won or lost. A large reading can come from a few sites moving a long way.

Second, the update is not finished, so the pattern on day five may look different by day ten.

Third, you are reading a mix of signals. Seasonal demand, your own recent changes, other Google systems and ordinary news cycles all move traffic at the same time. Attributing a dip to the spam update before it ends is a guess.

What to do while it rolls out

The most useful thing to do during a long rollout is resist the urge to react. Here is a working plan.

Record a baseline. Before anything else, capture your current position. Export Search Console performance data for the last 90 days by page and by query, along with clicks, impressions, average position and the countries you care about. Note recent changes such as redesigns, migrations, new content batches and link campaigns.

Annotate the timeline. Mark September 24 in your analytics and reporting tools, and add a note when Google marks the rollout complete.

Compare like with like. Weekday traffic and weekend traffic behave differently for many sites. Compare the days since September 24 with the same weekdays in earlier weeks.

Segment before you conclude. A sitewide traffic drop is rarely uniform. Split the data by page type, by folder, by template and by query group. If the loss is concentrated in one section, such as a batch of AI-assisted pages or a subdirectory of third-party content, that tells you far more than a total.

Do not make sweeping changes. Deleting hundreds of pages, rewriting templates or disavowing links mid-rollout makes it impossible to tell what caused what. If you suspect a policy problem, plan the fix and stage it.

Fix what is clearly broken. If you find hacked content, injected links, broken redirects or a security issue, fix it immediately.

Hold your publishing rhythm. Search Engine Land’s coverage advises sites that are not affected to keep doing what they were doing.

Audit against Google’s spam policies now

Whether or not you see a drop, this is a good week to check yourself against the policies Google points to. Google’s documentation names categories including cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and links, keyword stuffing, link spam, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation and user-generated spam.

Three of these tend to matter most for modern content teams.

Scaled content abuse is about producing large volumes of low-value pages in order to manipulate rankings, whether the pages are written by people, generated by AI tools or scrapped. The test is value per page, not the tool used. A large batch of near-duplicate location pages or templated question pages with thin answers is the pattern to look for.

Site reputation abuse covers publishing third-party content on an established site mainly to borrow its ranking strength. Sponsored sections or partner content hubs on an established site are examples.

Link spam covers buying, exchanging or generating links mainly to manipulate rankings. If you have inherited a backlink profile from a past agency, this is the moment to review it critically, not defensively.

If you find something that fits, note what it is, how many pages it affects and what you would do about it. You need not act during the rollout, but be ready to.

What recovery looks like

If you are affected, it helps to set expectations early. Google’s spam update documentation says that fixing problems may help a site improve if its automated systems learn “over a period of months” that the site complies with its policies. It also warns that for link spam, changes may not bring an improvement, because ranking benefits from those links cannot be regained.

So recovery is not a matter of days, and it is not guaranteed. The right frame is a remediation plan measured in months, not a quick reaction to a bad week.

Spam updates also occasionally catch sites that were not breaking the rules. Search Engine Land notes that this should not typically happen but sometimes does. If you believe you were caught unfairly, audit yourself carefully, document your evidence and keep monitoring.

Why this matters beyond classic rankings

Most teams now think about visibility in more places than the ten blue links. Generative engine optimization and answer engine optimization are about being cited and recommended in AI answers, which draw on the wider web and on search results. No one has published data showing how this specific spam update affects citations in AI Overviews, ChatGPT or Perplexity, and it would be a mistake to claim otherwise.

What can be said is narrower and more practical. Pages that lose organic visibility in Google lose a route to being seen and cited, and the qualities that spam policies punish, such as thin, repetitive, mass-produced content, are also poor candidates for being quoted in an AI answer. Strong search engine optimization, generative engine optimization and answer engine optimization all tend to rest on the same base: original, useful pages that answer a real question well. If you are building visibility for AI search, the spam policies are a sensible floor.

If you track AI citations, set that baseline now too, and compare again after Google says the update is complete.

Where this leaves you

The confirmed facts are these. Google started the September 2026 spam update on September 24, it is global, and it may take up to two weeks. It is the fourth spam update this year and the longest announced window. Google has not said what it targets. Early volatility is real, and some analysts report losses among AI-generated and programmatic sites, but that is observation, not confirmation.

The practical response for any search engine optimization team is patience with discipline. Take a baseline, mark the dates, segment your data, audit your own site against the spam policies, fix genuine defects and hold back on big changes until the rollout ends. A two-week update rewards teams that measure carefully, not teams that react fastest.

Frequently Asked Questions

1. When did Google’s September 2026 spam update start, and when will it finish?
Answer: It began on September 24, 2026, at 9:15 a.m. Pacific time. Google says the rollout may take up to two weeks, so the latest expected finish is around October 8. It could end sooner.

2. Why is this spam update considered the longest of 2026?
Answer: Because the announced window of up to two weeks is far longer than the earlier 2026 spam updates, which the dashboard lists at 19 hours and 30 minutes, 2 days and 1 hour, and 2 days and 16 hours. Two weeks is a maximum, not a confirmed actual duration.

3. What does the September 2026 spam update target?
Answer: Google has not said. It applies worldwide to all languages. Some analysts report ranking losses among AI-generated content sites and programmatic content farms, but that is their observation, not a statement from Google.

4. Should I change my site while the update is rolling out?
Answer: Not in a sweeping way. Record a baseline, annotate the dates, and segment your data. Fix clear defects such as hacked content or broken redirects immediately, but avoid large deletions, rewrites or disavows until the rollout is complete.

5. How long does it take to recover from a spam update?
Answer: Google says recovery can take months, because its automated systems must learn over time that a site follows its spam policies. For link spam, ranking benefits from those links may not return at all, even after cleanup.

6. Does the spam update affect visibility in AI answers?
Answer: No data has been published on that yet. Pages that lose Google visibility lose one route to being cited, and low-value mass-produced content is a poor candidate for citation anyway. Measure AI citations before and after the rollout and compare, and do not draw conclusions from one week.

7. How can I check whether my site is at risk?
Answer: Audit against Google’s spam policies, especially scaled content abuse, site reputation abuse and link spam. Then compare your Search Console data by page type and query group against a 90-day baseline.

If you want to know where your brand appears, and where it is missing, across Google and AI answer engines, that is exactly what we look at in a free AI Visibility Audit.

For the last two years, enterprise AI has mostly been sold as a feature: a chatbot in the corner of a screen, a summarize button, an assistant that answers one question at a time. On September 11, 2026, Salesforce made a different kind of pitch. It introduced seven named Agentforce agents, each built for a specific job, and described one of them as able to pursue a goal across weeks instead of a single conversation.

The naming is not a cosmetic detail. It signals a shift in how vendors want buyers to think about AI: less as software you configure and more as labour you deploy. This piece follows on from our earlier look at MCP and A2A governance, and it covers what Salesforce announced, what its customer results do and do not show, and what a buyer should ask before treating an AI agent like an employee.

What Salesforce announced

According to Salesforce’s announcement and coverage from Unite.AI and Startup Fortune, the seven agents and their jobs are as follows.

Casey is a help agent for customer service, working across voice, SMS, WhatsApp, and web chat. Paige handles IT and HR requests for employees, including through Slack and employee portals. Carter is a shopper agent that helps with product discovery, comparison, and checkout. Marshall is a supply chain agent that orchestrates back-office processes with audit trails. Piper handles inbound lead generation, engaging and qualifying leads for B2B sales. Fin is a customer agent that resolves complex customer-experience workflows. Hunter is an outbound sales agent that manages a pipeline from research through outreach.

Availability differs. Six of the seven, Casey, Paige, Carter, Marshall, Piper, and Fin, are generally available now. Hunter is in pilot, with general availability planned for November 2026.

Hunter is also the agent that uses a new long-horizon runtime. Salesforce describes it as built on three capabilities: memory, which preserves context across sessions; durable execution, which keeps a plan running over time; and dynamic steering, which adapts behavior based on feedback from users. The point of the runtime is that an agent can work toward a goal across days and weeks, instead of finishing one task and forgetting it. Hunter is the first agent to run on it.

The announcement included other platform pieces. Multi-Agent Orchestration, which routes work across coordinated teams of agents, is generally available. Agentforce Coworker, an employee-facing agent with AI Skills, and Agent Optimizer, a tool for refining agents, are scheduled for general availability in October 2026. Salesforce also introduced Agent Script, an open-source language for defining agent behavior with deterministic rules, which matters because it gives builders a way to fix certain steps in place instead of leaving everything to the model. None of the coverage we reviewed gave pricing.

How long the memory lasts

Some headlines around this launch describe agents with months of memory. The sources we reviewed do not support that. Salesforce’s own description is days and weeks. That is still a meaningful change, but the difference matters when a buyer is estimating how long an agent can hold onto a plan.

The customer results, and why to read them carefully

Salesforce published six customer results with the launch. All of them are reported by Salesforce, and none of the coverage we reviewed included independent verification or a definition of how each metric was measured.

Engine reported that 50% of chat inquiries are fully resolved by its help agent, which it calls Eva. Perk reported that Hunter built 60% of its sales pipeline. Autism Queensland reported that Paige resolves 70% of administrative requests. Hibbett reported that an agent handles 90% of core shopper journeys, after going live in six weeks. Asana reported 4x conversation volume driven by Piper. Anthropic reported that Fin resolves 79% of conversations autonomously.

These are useful as directional evidence. They are not benchmarks, and four things are missing that any buyer should ask about.

The first is definitions. Resolved could mean that a customer got a correct answer, or it could mean that the conversation ended without escalation. Those are very different outcomes. The second is baselines. Fifty percent resolved means more or less depending on what was resolved before the agent arrived. The third is scope. A figure for one team, one region, or one channel may not transfer to your business. The fourth is selection. Vendors highlight their strongest results, so a set of six published numbers says little about the distribution of outcomes across all customers.

There is one specific point on Perk. Hunter is still in pilot, so that result necessarily comes from early use, not a generally available product. Startup Fortune’s coverage made the same overall point, describing the results as early evidence and not a guarantee.

The governance layer was announced separately

Coverage of this launch sometimes lumps the AI Control Plane in with the seven agents. It was announced separately, one day earlier, on September 10, alongside what Salesforce calls a Trusted Enterprise AI Harness.

According to AI Weekly, the control plane provides routing, lineage, and cost and observability across both Salesforce and third-party AI, and it is positioned as a governance layer over a multi-vendor agent landscape. An analyst blog covering Dreamforce described it as a central registry of agents, MCP servers, and APIs with automatic discovery and a single gateway for model, MCP, and agent calls, and said it is designed to cover agents beyond Salesforce’s own.

Two cautions apply. AI Weekly reported that most capabilities are live while the rest are scheduled for fiscal year 2028, so buyers should not assume everything described is available today. And the same analyst blog noted that the control plane was initially previewed in 2025, which suggests some of it is an evolution of earlier work and not new this month. Neither source gave a general availability date for the full set.

A registry of agents, MCP servers, and APIs is exactly the kind of inventory that AI governance requires. It is also a reminder that governance products from a platform vendor cover that vendor’s view of the world first, so a company running agents from several suppliers should test how well the third-party coverage actually works.

Why names and job titles matter

Giving an agent a name and a role is a marketing decision, and it is also a framing decision. A named agent with a job title invites the same expectations we place on a person in that role: that it owns an outcome, that someone is accountable for it, and that it can be evaluated like a hire.

That framing has real benefits. It gives buyers a clearer mental model than a generic assistant. It pushes vendors to tie agents to measurable jobs such as resolving support tickets or qualifying leads, which is what sensible AI automation projects do anyway. And it makes it easier for a business to ask what work is being replaced, augmented, or created.

It also creates a risk. Names encourage people to trust an agent in the way they would trust a colleague, and an agent is not a colleague. It has no professional judgment, no personal accountability, and no understanding of context beyond what it has been given. Startup Fortune raised the question directly: “which decisions stay with people, which ones the agent takes alone?” That question should be answered in writing before an agent goes live, not discovered after an error.

Why weeks-long agents change the risk

The long-horizon runtime deserves separate attention, because it changes what can go wrong. A chatbot that answers one question and forgets it produces contained errors. An agent that holds a plan for weeks, remembers past interactions, and adjusts its behavior can compound a mistake, act on stale information, or continue a course of action after circumstances have changed.

Memory also raises data questions. What does the agent retain, for how long, and who can see or delete it? Durable execution raises control questions. How do you pause or stop an agent that is mid-plan, and how do you review what it did while nobody was watching? Dynamic steering raises accountability questions. When feedback changes an agent’s behavior, who approved that change?

These are design questions for anyone working on AI agent development, and they are procurement questions for anyone buying agents. The sensible default for a weeks-long agent is tighter limits: narrow permissions, explicit approval for irreversible actions, clear stop conditions, and a complete log of what it decided and why.

What to ask before you deploy a job-ready agent

Whether you buy from Salesforce or another vendor, the same questions apply.

What exactly is the job, and how is success measured? Define the metric before the pilot, including what counts as resolved or qualified.

What does the agent decide alone, and what needs a person? Write the boundary down and test it.

What data does it read, retain, and write? Confirm retention periods and deletion.

How do you audit and stop it? This is the core of AI governance for agents. Ask to see the logs and the pause controls.

How does it behave when it is wrong? Test escalation paths and error handling with real edge cases.

What is the fallback? Keep a documented way to run the process without the agent.

How does it fit with the rest of your agents? If you run agents from more than one vendor, check whether the governance layer really covers them.

Where this leaves you

The confirmed facts are these. Salesforce launched seven named agents on September 11, 2026. Six are generally available and Hunter is in pilot until a planned November release. Hunter runs on a new runtime designed to pursue goals over days and weeks. A separate governance announcement the day before introduced an AI Control Plane, with parts still to roll out. All customer results are Salesforce-reported and lack published definitions.

The broader shift is real. Enterprise AI is increasingly sold as a defined piece of work with a name attached. That makes it easier to evaluate, provided you insist on definitions, baselines, and limits. Businesses exploring AI automation, AI agent development, or generative AI development can borrow the useful part of the framing, which is to scope each agent to a specific job, and skip the risky part, which is treating it like a person.

Frequently Asked Questions

1. What are the seven Agentforce agents?
Answer: Casey (customer service), Paige (IT and HR), Carter (shopping), Marshall (supply chain), Piper (inbound lead generation), Fin (customer experience workflows), and Hunter (outbound sales). Salesforce announced them on September 11, 2026.

2. Which agents are available now?
Answer: Casey, Paige, Carter, Marshall, Piper, and Fin are generally available. Hunter is in pilot, with general availability planned for November 2026.

3. What is the long-horizon runtime?
Answer: It is a new runtime that lets an agent pursue goals across days and weeks using memory, durable execution, and dynamic steering. Hunter is the first agent to use it.

4. Are Salesforce’s customer results independent?
Answer: No. All six results are reported by Salesforce, and the coverage reviewed did not define how metrics such as resolved were measured. Treat them as directional evidence, not benchmarks.

5. What is the AI Control Plane?
Answer: It is a governance layer announced separately on September 10, 2026 that provides routing, lineage, cost and observability across Salesforce and third-party AI. Some capabilities are live and the rest are scheduled for fiscal year 2028.

6. How should a business evaluate an AI agent before deploying it?
Answer: Define the job and success metric, set the boundary between agent and human decisions, confirm data retention, check audit logs and stop controls, and test failure handling.

If you want to know which of your workflows are ready for AI agents and where the risks sit, that is exactly what we look at in a free AI Readiness Audit.

Most companies have a policy on which software employees can install. Far fewer have one for AI agents, the programs that can read files, call tools, and take actions on a person’s behalf. That gap is now the subject of a commercial product category, and the clearest sign came on September 1, 2026, when CrowdStrike launched Falcon Guardian at its Fal.Con conference in Las Vegas.

The launch is worth reading closely, not because a single product settles anything, but because of what it assumes: that unapproved AI agents are already running on company machines and that the endpoint is where they need to be caught. Two statistics have been attached to the story, and they need careful handling. Here is what is confirmed, what the numbers actually show, and what the practical lesson is for AI security and AI governance teams.

What CrowdStrike announced

According to CrowdStrike’s press release and coverage from SiliconANGLE, Security Boulevard, and BizTech, Falcon Guardian does four things.

First, it discovers known and shadow AI agents across Windows and macOS endpoints. Second, it blocks agents that are not on an approved list from running on managed systems. Third, it ties agent behavior to endpoint telemetry, linking user prompts to identities, the tools an agent invoked, and the resulting system changes. Fourth, it detects attacks aimed at agents and agents that misbehave, and it estimates the blast radius when an incident occurs.

CrowdStrike also announced supporting pieces: an AI Gateway for centralized control of enterprise AI traffic, a managed service called Falcon Complete for Guardian, a threat hunting service called Falcon Adversary OverWatch for Guardian, and integration with its Next-Gen SIEM.

Availability is uneven, and that matters for anyone planning around it. SiliconANGLE reported that the core Guardian features and the managed threat hunting service are available now, while the AI Gateway is pre-beta and expected to reach general availability next quarter, and Falcon Complete for Guardian is due later this quarter. CrowdStrike’s press release did not list pricing.

CEO George Kurtz framed the pitch in one line: AI has not changed the attack, it has changed its speed. The company’s argument is that the endpoint, which it has long positioned as the control point for stopping attacks, is also the place where agents execute.

What the sources do not say is equally useful. They name Windows and macOS as the supported endpoints and say nothing about other environments. They do not list which agent tools or frameworks Guardian recognizes. And none of the coverage we reviewed includes an independent evaluation of how well it works. Treat this as a vendor announcement, not a tested result.

What shadow AI means in practice

The term is borrowed from shadow IT, where employees adopt tools without approval from the technology or security team. Shadow AI is the same pattern applied to AI: assistants, coding agents, browser extensions, and automation tools that staff install or connect on their own.

It happens for understandable reasons. The tools are free or cheap, they are useful on day one, and many can be installed in minutes without any request to IT. A developer adds a coding agent. A marketer connects an assistant to a shared drive. A finance analyst runs an automation that reads email. Each decision looks small. Together they create a set of programs with real access to company data that nobody has inventoried.

Agents raise the stakes over ordinary shadow IT because they act, not just store. A file-sharing app that nobody approved holds data. An agent that nobody approved can read that data, send it somewhere, and run commands, often with the permissions of the person who installed it.

The two numbers, and what they do and do not show

Two statistics have been attached to this story. They come from different sources and they measure different things.

The first is 89%. CrowdStrike’s 2026 Global Threat Report, published on February 24, 2026, states that AI-enabled adversaries increased their activity by 89%, measured year over year from 2024 to 2025. That is a statement about attackers using AI, not about employees installing unapproved agents. It is also about activity, which is broader than the attacks some summaries describe. The same report says adversaries exploited legitimate generative AI tools at more than 90 organizations by injecting malicious prompts to steal credentials and cryptocurrency. That second figure is closer to the shadow AI concern, because it shows AI tools themselves being used as an attack path.

The 89% is real, and it comes from the company selling the product. It supports the argument that the threat is accelerating. It does not show how many unapproved agents are running inside any given company.

The second number is 17,800. AIR Security, a startup that announced $50 million in funding on September 3, 2026, reported finding more than 17,800 public AI add-ons, with 6.7 million installations in total, that rely on untrusted external sources for their instructions. The company also reported finding AI skills that impersonate Anthropic and OpenAI and are designed to get past security reviews and run arbitrary code. Coverage describes add-ons as skills, plugins, and MCP servers, which are the extensions that give agents new abilities.

Two cautions apply. AIR Security sells a firewall for AI agents, so it has a commercial interest in the finding, and it is a separate company from CrowdStrike. The coverage we reviewed also did not include a published methodology or a link to a full report, so the count cannot be independently checked. That does not make it wrong. It means it should be read as a vendor’s research and used to understand the type of risk, not as a measured baseline.

Together the two figures make a reasonable case for taking the issue seriously. Attackers are using AI more, and the supply chain of extensions that agents rely on is largely unvetted. Neither figure tells you your own exposure.

Why this is a governance problem first

The most important detail in the product description is easy to miss. Guardian blocks agents that are not on an approved list. That means someone has to create the list.

A detection tool can tell you which agents are running. It cannot decide which ones should be. That decision is AI governance: defining which agents are allowed, for which tasks, with which permissions, approved by whom, and reviewed how often. Without it, a discovery tool produces an inventory and a set of alerts with no policy to measure them against.

Kurtz described the aim as turning policy into protection. The order of that phrase is the point. Policy comes first. Organizations that buy enforcement tooling before they write the policy tend to discover that the hardest questions were never technical. Who can approve a new agent? What counts as sensitive data an agent may not touch? Which extensions and MCP servers are acceptable? What happens when a team needs something that is not on the list?

What a practical response looks like

You do not need to buy a product to start. The same steps apply whether you use an endpoint platform, a gateway, or manual review.

Find out what is already running. Ask every team which AI assistants, agents, and extensions they use, and check managed devices where you have the tooling to do so. Expect the first answer to be incomplete.

Write an approved list and a request path. If the only answer to a new tool is no, people will route around you. Make it easy to ask, and give a fast answer.

Vet the extension supply chain. Skills, plugins, and MCP servers can pull in instructions from outside your control. Review where each one loads content from, what permissions it requests, and who publishes it. Be cautious with anything that carries a familiar brand name but comes from an unverified publisher.

Apply least privilege. This is basic AI security hygiene, and it applies to agents as much as to people. Give agents the narrowest access they need. An agent that only has to read one folder should not be able to reach the whole drive or run commands on the machine.

Log what agents do. Record which identity started an agent, which tools it invoked, and what it changed. If something goes wrong, that record is what lets you estimate the blast radius.

Plan the response. Decide in advance who can disable an agent, revoke its credentials, and notify affected teams.

Evaluate vendors on evidence. When assessing any agent security product, ask which agents and platforms it covers, how discovery works, what it does when it finds an unapproved agent, and what independent testing exists.

For companies that build agents for customers or for internal use, this also shapes design. Teams working on AI agent development should build in identity, scoped permissions, and audit logging from the beginning, so that the agents they ship are ones a security team can actually govern.

Where this leaves you

Falcon Guardian is a confirmed product launch with a defined feature set, some parts available now and others still to come. The 89% figure is CrowdStrike’s own finding about attacker activity. The 17,800 figure is a separate vendor’s research with no published methodology in the coverage we reviewed. None of these prove that your company has a shadow AI problem today.

What they do show is that the industry now treats unapproved agents as an AI security category worth building products for, and that the endpoint is one place to look. The durable part of the story is the AI governance work underneath: an inventory, an approved list, vetted extensions, limited permissions, and a record of what agents do. Companies that have those in place can evaluate any tool from a position of strength. Companies that do not will be buying software to solve a policy gap.

Frequently Asked Questions

1. What is Falcon Guardian?
Answer:Falcon Guardian is CrowdStrike’s AI agent security product, launched on September 1, 2026 at Fal.Con. It discovers known and shadow AI agents on Windows and macOS endpoints, blocks agents that are not approved, and links agent behavior to endpoint telemetry.

2. What is shadow AI?
Answer: Shadow AI refers to AI tools and agents that employees use or install without approval from IT or security. Because agents can read data and take actions, they carry more risk than ordinary unapproved apps.

3. Where does the 89% figure come from?
Answer: It comes from CrowdStrike’s 2026 Global Threat Report, published February 24, 2026, which says AI-enabled adversaries increased their activity by 89% year over year. It measures attacker activity, not unapproved agents inside companies.

4. Is the 17,800 add-ons figure from CrowdStrike?
Answer: No. It comes from AIR Security, a separate startup that sells an AI agent firewall. It reported more than 17,800 public add-ons with 6.7 million installations relying on untrusted instruction sources. The coverage reviewed did not include a published methodology.

5. Do I need a product like Falcon Guardian?
Answer: Not necessarily. Start with an inventory of the agents in use, an approved list, and a request process. A tool can enforce that policy, but it cannot write it for you.

6. What should an AI governance policy for agents include?
Answer: It should define who can approve agents, which data they may access, which extensions and MCP servers are acceptable, what permissions they receive, how their actions are logged, and who can shut them down.

If you want to know which AI agents and tools your teams are already relying on, and where the governance gaps are, that is exactly what we look at in a free AI Readiness Audit.

Our earlier piece on MCP and A2A governance looked at the open standards that decide how agents connect to tools and to each other. This one looks at the layer underneath those standards, which is the model itself, and at a recent event that shows how quickly access to that layer can change for reasons that have nothing to do with your product.

On August 28, 2026, OpenAI announced that it will end Cursor’s access to its models on November 12. The immediate story is about two companies and an acquisition. The lasting story is about every business that has built a workflow on top of someone else’s model. Here is what is confirmed, what is disputed, and what a sensible response looks like.

What is confirmed

The sequence is short. SpaceX acquired Anysphere, the company behind the Cursor coding editor, in an all-stock deal reported at $60 billion, which closed on August 14, 2026. Two weeks later, on August 28, OpenAI published a post explaining its decision to end Cursor’s access to OpenAI models, with November 12, 2026 as the date.

OpenAI’s stated reason is trust. It said it cannot be confident that SpaceX will use its technology within OpenAI’s terms of service, and it pointed to a history of contract disputes involving Elon Musk’s companies, including, in OpenAI’s account, xAI’s violation of OpenAI’s own service terms. OpenAI also said it was giving the maximum notice its agreement allowed, which works out to a little over ten weeks, and that its contract included a limited window to cancel after a change of control.

OpenAI’s help center article adds practical detail. It describes November 12 as the end of a transition period and says the formal termination date will be confirmed later. The affected features are the local Chat and Agent modes that currently offer OpenAI models. The unaffected features are Cursor Tab and autocomplete, Auto model selection, Cloud and Background Agents, Automations, the Cursor CLI, and the Cursor API and SDK, all of which continue to use models supplied by Cursor.

Users who want to keep using OpenAI models have three routes. They can bring their own OpenAI API key, which is billed separately from any Cursor or ChatGPT subscription. They can install OpenAI’s Codex extension and sign in with a ChatGPT plan or an API key. Or they can connect through an AI gateway their organization already manages, such as Amazon Bedrock or Azure. One detail matters for budgets: a ChatGPT subscription does not include API usage, so a team that switches routes may see a new line item.

Anthropic responded quickly. Co-founder and Chief Compute Officer Tom Brown said the company will keep increasing compute to support Claude models in Cursor.

What is disputed or still unclear

Several points are less settled than the headlines suggest, and they are worth separating from the confirmed facts.

Cursor CEO Michael Truell said OpenAI models account for only about 5% of Cursor’s traffic. That is Cursor’s own claim, not an independent measurement, and DevOps.com reported that it was widely questioned on social media. Treat it as Cursor’s position, not as an established number.

Truell also said Cursor was in talks with OpenAI to find a solution. Nothing in the sources reviewed shows that those talks have produced an outcome, and no response from SpaceX appears in the coverage we could verify. The November 12 date could still change, either through negotiation or through the formal notice OpenAI’s help article mentions.

The $60 billion price and the August 14 closing date come from reporting on the deal. The OpenAI post and the help article do not discuss the price. So the accurate framing is that the deal was reported at that value.

None of this changes the central lesson. Even if OpenAI models are a small share of Cursor’s traffic, the event shows how a change of ownership can turn a supplier into a gatekeeper overnight.

Why this is not really a Cursor story

Every company that builds on a third-party model has the same exposure Cursor just discovered. The contract you signed can be ended by the supplier under conditions you do not control, and an acquisition, on either side, is one of the most common triggers. In this case the acquired party was the customer. It could as easily be the supplier, whose new owner may reprice, restrict, or retire the product you rely on.

There is also a competitive dimension. Within hours of OpenAI’s announcement, a rival lab publicly reaffirmed its support for Cursor. That is good news for the customer in the short term, but it moves the dependency instead of removing it. A team that swaps one model vendor for another is still exposed to the same category of risk, only with a different counterparty.

Treat model access the way finance teams treat any critical supplier. Ask who owns the vendor, what happens if that changes, how much notice the contract requires, and what your fallback is. Most engineering roadmaps never ask these questions, because the model feels like infrastructure. It is closer to a contract that can be ended.

Switching models is not a configuration change

The technical half of the risk is easy to underestimate. Standards like MCP and A2A make it easier to connect an agent to tools and to other agents. They do not make one model behave like another.

Analysts quoted by CIO made this point directly. Manoj Chandra Jha of Nord-IQ Research said prompts and agent instructions that work well with OpenAI models can produce different results with another model, which forces enterprises to retune both prompts and evaluations. Abhishek Satapathy of Avasant listed where the differences show up in coding agents: repository-level work, debugging, refactoring, test generation, multi-file changes, and tasks where an agent must inspect a codebase, make changes, run tests, and correct its own errors.

That list should look familiar to anyone doing AI agent development. Agents chain many steps together, so a small difference in how a model interprets an instruction can compound across a workflow. A prompt that produced clean output on one model can drift on another, with tool calls made in a different order, formats interpreted differently, or errors handled in a different way.

CIO also quoted Pareekh Jain, who advised enterprises to support multiple models, test alternatives regularly, and “avoid making important workflows too dependent on one model.” The word regularly matters. A fallback model that has never been tested is only a hope.

What resilience looks like

Cursor itself offers a useful example of preparation. Most of its product does not depend on OpenAI’s models at all. Tab completion, Auto selection, cloud agents, automations, the CLI, and the API all continue on Cursor-supplied models. A Forbes analysis argued that this reflects deliberate investment in its own coding model, Composer 2.5, built on open-source checkpoints, which lets Cursor treat frontier model access as something it can substitute. That is an analyst’s interpretation rather than a confirmed account of Cursor’s strategy, but the product structure supports the point. The features most exposed are the ones where users chose an OpenAI model by name.

Very few companies can train their own model. The principle still applies at smaller scale: keep the part of your product that users experience separate from the part that depends on a single supplier. For teams working on AI agent development, that usually means keeping business logic, tool definitions, and evaluation data in your own repository, and treating the model as a component you can replace. Prompts written for one model should be documented as model-specific, so nobody assumes they will transfer.

A practical checklist for model dependency

Whether you are building internal tools, customer-facing agents, or a full product, the same steps reduce the risk. This is the kind of work that belongs in any serious AI development plan from the start.

Inventory every model dependency. List each workflow, which model it calls, through which route, and under which contract. Include shadow usage, such as teams running personal API keys.

Put an abstraction layer between your application and the model. Route calls through one internal interface so that changing the model is a change in one place, not a rewrite.

Build an evaluation suite before you need it. A set of representative tasks with expected outcomes lets you compare a replacement model on evidence instead of impressions. This is the piece Jha’s comment points to, and it is the one teams most often skip.

Test a fallback model on a schedule. Run the evaluation suite against at least one alternative every quarter, and keep prompts tuned for it, not only for your primary.

Read the contracts. Look for change-of-control clauses, notice periods, usage restrictions, and pricing terms. Note who can end the agreement and under what conditions.

Understand the billing routes. As the Cursor case shows, subscriptions and API access are often billed separately. Know which one each workflow actually uses.

Assign an owner. Model dependency is a business risk, so it needs an owner outside the engineering team who reviews it alongside other supplier risks.

Where this leaves you

OpenAI’s decision on Cursor is confirmed, with November 12 as the announced end date, though the formal termination date and the outcome of talks remain open. The claim that OpenAI models are 5% of Cursor’s traffic is Cursor’s own. The wider point does not depend on either detail. Access to a model is a supplier relationship, and supplier relationships change when ownership changes.

For teams investing in generative AI development and agent workflows, the response is measured, not alarmed. Inventory the dependencies, build the evaluation suite, test the fallback, and review the contracts. The cost is a few weeks of engineering time. The alternative is discovering your dependency on a Tuesday afternoon with a ten week clock running.

Frequently Asked Questions

1. When does OpenAI stop providing models to Cursor?
Answer: OpenAI announced on August 28, 2026 that access ends on November 12, 2026. Its help center describes that date as the end of a transition period and says the formal termination date will be confirmed later.

2. Why did OpenAI end the agreement?
Answer: OpenAI said it cannot be confident SpaceX will use its technology within its terms of service, following SpaceX’s acquisition of Cursor’s parent company. It cited a history of contract disputes involving Elon Musk’s companies.

3. What still works in Cursor after the cutoff?
Answer: Cursor Tab, Auto model selection, Cloud and Background Agents, Automations, the CLI, and the API and SDK continue on Cursor-supplied models. The affected features are local Chat and Agent modes that offer OpenAI models.

4. Can developers keep using OpenAI models in Cursor?
Answer: Through other routes, yes. OpenAI lists bringing your own API key, using the Codex extension, or connecting through an AI gateway such as Amazon Bedrock or Azure. API usage is billed separately from a ChatGPT subscription.

5. Is it true that OpenAI models are only 5% of Cursor’s traffic?
Answer: That is what Cursor CEO Michael Truell said, but it is Cursor’s own figure and was questioned publicly. It has not been independently verified.

6. How can my business reduce model dependency risk?
Answer: Inventory every model dependency, put an abstraction layer between your application and the model, build an evaluation suite, test a fallback model regularly, and review supplier contracts for change-of-control terms.

If you want to know how exposed your own workflows are to a single vendor, that is exactly what we look at in a free AI Readiness Audit.

If your entire AI visibility plan is to publish better pages on your own site, the research says you are working on the smaller half of the problem. Two academic studies and one large industry analysis, each looking at a different slice of AI search, land on the same practical conclusion: what other people publish about you carries far more weight in AI answers than what you publish about yourself.

That is a strong claim, and it is also one that gets stretched in the retelling. The headline figure of 93% applies to specific engines in a specific kind of query, not to every AI platform in every situation. Here is what each source actually measured, where the numbers hold, where they do not, and what it means for how you spend a marketing budget.

Study one: a small group of outlets dominates news citations

The first paper is “News Source Citing Patterns in AI Search Systems” by Kai-Cheng Yang, posted to arXiv on July 7, 2025. It analyzed 366,087 citations across 12 AI search models from three providers: OpenAI, Perplexity, and Google. The data was collected over seven weeks between March and May 2025 from the AI Search Arena dataset.

A little over 9% of those citations, 32,865 in total, pointed to news outlets. That is worth stating up front, because it means the paper is not claiming that AI engines mostly cite journalism. It is examining the news slice of citations and finding that the slice is extremely concentrated.

The concentration differs sharply by provider. The paper reports that the 20 most frequently cited news sources account for 67.3% of citations for OpenAI models, compared with 31.9% for Google and 28.5% for Perplexity. Reuters and the Associated Press alone were cited at rates of 22.8% and 12.2% for OpenAI models. In other words, when ChatGPT-style models reach for a news source, they reach for a very short list.

One caution applies. The paper is a preprint posted on arXiv, so read it as a well-documented research finding rather than settled consensus, and note that it covers models tested in 2025.

The takeaway for marketers is narrower than the headline suggests. If you want news-based visibility in OpenAI-powered answers, the door is small, and the outlets standing in it are wire services and major national publishers. That does not make earned media pointless. It tells you that not all earned media is equal.

Study two: earned media versus your own site

The second paper is “Generative Engine Optimization: How to Dominate AI Search” by Mahe Chen, Xiaoxuan Wang, Kaiwen Chen, and Nick Koudas, submitted on September 10, 2025. The authors ran controlled experiments across ten consumer product verticals, with 100 queries each, and classified every cited source as earned media, brand-owned, or social content. Their abstract describes a systematic and overwhelming bias toward earned media, meaning third-party authoritative sources, over brand-owned and social content.

The numbers vary by engine, and the variation matters. In the consumer electronics vertical, Claude drew about 93.7% of its citations from earned media and ChatGPT about 93.6%. Perplexity was far lower at 53.3% earned, with 31.6% from brand-owned sites and 15.1% from social platforms.

Across the paper’s broader brand tests, the pattern held. For well-known brands, ChatGPT cited earned media 93.5% of the time and brand-owned pages 6.5%. Claude sat at 87.3% earned and 6.8% brand-owned. Perplexity came in at 67.4% earned and 8.8% brand-owned, with 23.8% from social. Gemini showed 63.4% earned and 25.1% brand-owned. For niche brands, ChatGPT reached 95.1% earned and 4.9% brand-owned, and Claude 86.3% earned and 10.6% brand-owned.

So the tidy line that AI engines cite earned media 93% of the time is accurate for ChatGPT and, in one vertical, for Claude. It is not accurate for Perplexity, and it clearly overstates the case for Gemini, which gave brand-owned pages a quarter of its citations in the well-known brand test. Your own website is close to invisible for ChatGPT on product queries. It is a real contributor to Gemini.

Note also that this is a preprint, and the queries are consumer product comparisons. A B2B services buyer asking about agencies or software may see different source mixes. Treat the paper as strong evidence about direction, not a guarantee for your category.

The third source: most citations do not come from Google’s first page

Ahrefs added two findings that support the same conclusion from a different angle.

In an analysis of 15,000 long-tail queries published on August 11, 2025, Ahrefs found that only 12% of URLs cited by ChatGPT, Gemini, and Copilot also appeared in Google’s top 10 for the same prompt. Put the other way, roughly 88% did not. Perplexity was the exception, with 28.6% overlap. This is why ranking well on Google, while still valuable, does not guarantee a citation. The AI engines are retrieved from a different set of pages.

The second finding is more useful for anyone planning outreach. Ahrefs examined the 1,000 pages ChatGPT cited most in September 2025 and concluded that roughly two-thirds of them are effectively off-limits to traditional outreach. The breakdown was Wikipedia at 29.7%, homepages and landing pages at 23.8%, educational pages at 19.4%, app stores at 6.6%, reviews at 5.8%, news and media at 5.2%, language and grammar sites at 4.0%, dictionary and reference at 2.2%, blog articles at 1.9%, community forums at 0.9%, and corporate pages at 0.5%.

Ahrefs counted only four categories as influenceable: educational pages, reviews, news and media, and blog articles. Together they make up 32.3% of the top 1,000.

This corrects a common retelling. Several summaries describe the off-limits share as Wikipedia, government sites, education, and major news. That is not what Ahrefs found. In the Ahrefs breakdown, educational pages and news were on the influenceable side, and the off-limits side was mostly Wikipedia, other organizations’ homepages, and reference-style sites. The opportunity is in educational content, reviews, news mentions, and articles.

What this does and does not prove

It proves that publishing on your own domain is not enough to earn citations from ChatGPT or Claude on product research queries. It supports the case that third-party mentions matter, and that they matter more on some engines than others.

It does not prove that your own website is irrelevant. Brand-owned content still accounts for 5% to 25% of citations in the Chen study depending on the engine, and pages that AI systems retrieve from your site are part of what makes third-party coverage credible. Your site is where a cited claim gets verified.

It also does not prove that any earned mention helps. The Yang paper shows that the citation pool for news is narrow, and the Ahrefs data shows that news is only 5.2% of ChatGPT’s most cited pages. A mention in a low-authority outlet is unlikely to move the needle.

What this means for link building and digital PR

The strongest business case in this research is for redefining what link building and digital PR are for. For years, the goal was a link that passed ranking signals. The goal now includes being named, described, and reviewed in the places AI engines already trust.

That changes priorities in four ways.

Prioritize the sources engines already cite. Before pitching anyone, check which publications, review platforms, and educational sites appear in AI answers for your category. Build the target list from that, not from domain authority alone.

Pursue reviews and comparisons, not just news. Reviews and educational pages are a much larger share of ChatGPT’s influenceable citations than news. Accurate, current listings on review platforms and inclusion in independent comparison content deserve more of the budget than they usually get.

Create material that other people want to cite. Original data, clear definitions, and expert commentary give journalists and educators a reason to reference you. This is the foundation of effective digital PR, and it also gives educational and blog sources something to link to.

Keep your own site accurate and consistent. When an outlet mentions you, engines and users will check your site. Consistent naming, clear service descriptions, and current facts make the third-party mention easier to trust.

Treat Wikipedia as a consequence, not a target. At 29.7% of ChatGPT’s top 1,000 cited pages, it is the single largest source, and Ahrefs places it outside the reach of outreach. Trying to force an entry is the wrong response. The sustainable route is to earn the independent coverage that makes a company notable in the first place, which is exactly what a disciplined digital PR program produces over time.

Expect a slow payoff. Third-party coverage takes weeks to publish and longer to be picked up by AI engines, so judge a campaign over quarters, not days. Pair the outreach with a monthly citation check so you can see which placements actually change what the engines say.

Set a baseline before you begin. Record which prompts cite your brand today, on which platforms, and from which sources. Repeat monthly. Without that, you cannot separate the effect of an outreach campaign from ordinary platform variability.

Where this leaves you

Optimizing your own site remains necessary. Sound search engine optimization fundamentals still determine whether you are found and understood. But the evidence now points to a second requirement that sits outside your domain. On ChatGPT and Claude, earned media supplies roughly nine in ten citations for product research. On Perplexity and Gemini the share is lower but still a majority. That is the reason generative engine optimization and answer engine optimization now include off-site work, and why link building teams are being asked to think about mentions, reviews, and reference sources, not just links.

Frequently Asked Questions

1. Do AI engines really cite earned media 93% of the time?
Answer: For ChatGPT and Claude in the consumer electronics vertical of the Chen study, yes: about 93.6% and 93.7%. Perplexity was near 53% and Gemini near 63% to 66% in other tests, so the figure does not apply to every engine.

2. What counts as earned media in these studies?
Answer: Third-party authoritative sources such as independent reviews, journalism, and expert publications. Brand-owned pages and social content are classified separately.

3. Does this mean my website does not matter for AI visibility?
Answer: No. Brand-owned pages still receive about 5% to 25% of citations depending on the engine, and your site is where third-party claims get checked. It is necessary but not sufficient, which is why answer engine optimization now includes off-site work.

4. Is it true that two-thirds of ChatGPT’s top citations cannot be influenced?
Answer: Ahrefs reported that roughly 67% of ChatGPT’s top 1,000 cited pages fell outside traditional outreach. Educational pages, reviews, news, and blog articles, about 32.3%, were the influenceable share.

5. Which earned media should I prioritize?
Answer: Start with sources AI engines already cite in your category: review platforms, educational content, and a short list of authoritative publications. Wire services and major national outlets dominate news citations for OpenAI models.

6. How do I measure whether digital PR is improving my AI citations?
Answer: Track a fixed set of buyer prompts on ChatGPT, Claude, Perplexity, and Gemini each month, and record whether your brand is cited and from which source.

If you want to see which third-party sources are shaping AI answers about your brand today, that is exactly what we cover in a free AI Visibility Audit.

This is the third piece in our series on how AI platforms decide who gets cited. The first looked at how much AI referral traffic ChatGPT controls. The second looked at how selective it is about which sources it trusts. This one asks the practical follow-up: if two of the biggest AI platforms disagree this much about sources, what does that do to the way you measure visibility?

The headline number is that only about 11% of domains are cited by both ChatGPT and Perplexity. It has been repeated in dozens of articles this year, usually with a sentence claiming that single-platform tracking leaves 89% of your visibility invisible. That last part goes further than the data supports. The 11% figure is real and worth acting on, but it is also easy to misread, and several of the studies stacked underneath it measure different things. Here is what each one actually found, and what it means for how you track your brand.

Where the 11% comes from

The figure appears in three related but distinct places, and they are not the same study repeated three times.

The first is a dataset of 680 million citations covering August 2024 to June 2025, analyzed by Profound and cited in Averi’s B2B SaaS benchmark report. Averi’s report states that only 11% of domains are cited by both ChatGPT and Perplexity. Worth noting: the 680 million analysis is Profound’s work, and Averi uses it as a supporting reference rather than presenting original research of its own. Several articles online attribute the analysis to Averi directly, which is a small but real attribution error.

The second is a Qwairy analysis of 118,000 AI responses collected between January and March 2026 across ChatGPT, Perplexity, Google AI Mode, and Claude, which Whitehat SEO cites in its own comparison. It found that only 11% of cited domains appeared across multiple platforms. That is a slightly different measurement from the first one. It looks across four platforms at once instead of comparing ChatGPT and Perplexity as a pair, so the matching 11% is a coincidence of two different methods, not one result confirmed twice.

The third is a Wellows study of 22.7 million citations across 1.15 million questions, covering January to June 2026. It approaches the same question from the opposite direction and reports that 89% of websites ChatGPT cited on a given question were never cited by Perplexity on that same question. That is essentially the mirror image of the 11% figure, measured at the website level, on identical questions.

So three datasets, three time windows, and two different definitions of overlap all point the same way: the two platforms draw on substantially different sets of sources. That agreement is the meaningful finding. The exact percentage matters less than the direction.

What the 11% does and does not mean

Now for the overreach. A low overlap between two platforms’ cited domains does not mean 89% of your potential visibility is hidden from you. Authority Tech, which curates and compares these studies, states explicitly that the figure does not imply that. There are three reasons.

First, the overlap is measured across all domains cited, not across your domain. Your brand could appear consistently on both platforms while the rest of the web fragments around you. The 11% describes the whole citation landscape, and your own footprint inside it is a separate question.

Second, Wellows itself is careful about this. Its authors describe the gap as a different candidate pool rather than a more unpredictable engine, and they point out that the number measures which sources answer a particular question, not which websites are permanently available to each platform.

Third, overlap depends heavily on how strictly you match. Wellows reports different results at website level, page level, and with different levels of address cleanup. A percentage that moves that much with the matching rule should be read as a range, not a fixed law.

The accurate version of the claim is narrower and still useful: if you only measure one platform, you are measuring a different slice of the web than the one your buyers see on the other. That alone is reason enough to change how you track.

A different 12% that gets mixed in

Ahrefs published a widely quoted 12% figure that often gets bundled into this conversation, and it deserves separating out. Ahrefs analyzed 15,000 long-tail queries in a study published on August 11, 2025, and found that only 12% of URLs cited by ChatGPT, Gemini, and Copilot also ranked in Google’s top 10 for the same prompt. The measurement compares AI citations with Google rankings. It does not compare one AI platform with another.

The Ahrefs data does contain a useful platform-level detail, though. Perplexity’s overlap with Google’s top 10 was 28.6%, far higher than ChatGPT at around 8%. So Perplexity leans on pages that also rank well in traditional search, while ChatGPT draws more heavily from pages that do not. Placed next to the 11% cross-platform figure, that goes a long way toward explaining why the two platforms disagree. They are retrieving from different places.

For anyone doing search engine optimization alongside AI visibility work, this is the important takeaway. Ranking well in Google helps you with Perplexity noticeably more than it helps you with ChatGPT. Treating them as one channel with one strategy will over-serve one and under-serve the other.

The same brand, very different results

Two more datasets show what this looks like at the brand level, and both are better evidence for multi-platform tracking than the 11% headline.

Superlines analyzed 34,234 AI responses across 10 platforms between January 14 and February 13, 2026, and reported a 615x gap in citation volume between the highest-citing platform, Grok at a 27.01% citation rate, and the lowest, Claude, at close to zero. The number is striking, but it needs context. It reflects how differently each platform handles linking out to commercial brand sites, which is partly a product design difference and not purely a measure of how much each platform likes any given brand.

Slate HQ published a 90-day study on March 30, 2026, tracking six B2B SaaS brands across ChatGPT, Perplexity, Gemini, Claude, Google AI Overview, and Google AI Mode, with more than 300,000 citation data points. Its central finding is that 76.3% of all citations went to domains that were neither the brand nor its direct competitors. Most of the visibility lives on third-party sources.

The per-platform breakdown Slate published for one email security client illustrates the spread. Brand-owned citation share was 10.2% on Google AI Mode, 10.0% on Google AI Overview, 9.1% on Claude, 6.9% on Gemini, 6.8% on Perplexity, and 4.5% on ChatGPT. Those are the numbers for one client, not an average across all six brands, and it would be wrong to say ChatGPT was the weakest platform for every company studied. But the spread within that single brand, more than double between the highest and lowest platform, makes the point clear. The same company can look strong on one platform and weak on another during the same 90 days.

Slate also found that Claude had the narrowest external source pool at 54% unidentified sources, while Perplexity cast the widest net at 67.7%. Different platforms are not just citing different pages. They are behaving differently in how broadly they search.

What to do with this

The practical response is not to panic about an invisible 89%. It is to stop treating AI visibility as a single number.

Track each platform separately. A blended score hides exactly the variation the studies above describe. At a minimum, report ChatGPT, Perplexity, Google AI Overviews, and Claude as separate lines, and watch each for movement independently. This is the foundation of any serious generative engine optimization program.

Identify which sources each platform trusts in your category. Since most citations go to third-party domains, your visibility depends on where you are mentioned as much as on what you publish. Check which review sites, directories, and community platforms each engine leans on for your topics, then look at whether you are present there.

Match your optimization to the platform. Because Perplexity correlates more strongly with Google rankings, traditional ranking work supports it. ChatGPT draws from a broader mix, so entity clarity, third-party mentions, and presence on the sources it favors carry more weight. This is where generative engine optimization and answer engine optimization diverge in practice, even though they are often discussed as one thing.

Set a baseline before changing anything. Record your citation presence per platform for a fixed set of prompts this week, then repeat monthly. Without a starting point, you cannot tell whether a change came from your work or from platform variability.

Treat every overlap statistic as a range. Different matching rules produce different percentages, and the sample sizes, time windows, and definitions vary. Use the studies to understand direction, then validate against your own prompts.

Where this leaves you

Only 11% of domains being cited by both platforms is a real signal, backed by three independent datasets using different methods. It does not mean 89% of your visibility is lost, and it is not the same as the Ahrefs 12% figure, which compares AI citations with Google rankings. What it does show is that ChatGPT and Perplexity behave like separate channels with separate source preferences, and that measurement built around one will miss what the other is doing. Track them separately, benchmark against a baseline, and treat the percentages as direction, not precision. That is the discipline answer engine optimization now demands.

Frequently Asked Questions

1. Is it true that only 11% of domains are cited by both ChatGPT and Perplexity?
Answer: Yes, that figure appears in several studies, including a 680 million citation dataset analyzed by Profound and a Qwairy analysis of 118,000 responses. Definitions differ slightly between studies, so treat 11% as an approximate indicator of low overlap, not an exact constant.

2. Does this mean 89% of my AI visibility is hidden if I only track one platform?
Answer: Not exactly. The 11% describes overlap across all cited domains, not your own brand. It does show that each platform draws on a different pool of sources, so single-platform tracking gives you an incomplete picture.

3. Is the Ahrefs 12% the same statistic?
Answer: No. Ahrefs found that only 12% of URLs cited by ChatGPT, Gemini, and Copilot also rank in Google’s top 10 for the same prompt. That compares AI citations with Google rankings, not one AI platform with another.

4. Which platform gives brands the highest citation share?
Answer: It depends on the brand and category. In Slate HQ’s example for one email security client, Google AI Mode and AI Overview were highest and ChatGPT was lowest. That is a single-client result and should not be generalized to every company.

5. What does the 615x citation gap mean?
Answer: Superlines found a 615x difference in citation volume between the highest platform, Grok, and the lowest, Claude, across 34,234 responses. It reflects how differently platforms link to commercial sites, so it shows platform behavior more than brand preference.

6. What should I track first?
Answer: Start with a fixed list of prompts your buyers actually ask, then record whether your brand is cited on ChatGPT, Perplexity, Google AI Overviews, and Claude separately. Repeat monthly and compare against that baseline.

If you want to see where your brand stands on each platform, not just one, that is exactly what we cover in a free AI Visibility Audit.