Should We Be Surprised Publishers Are Learning How to Influence Chatbot Answers?

An experiment conducted by Germany-based freelance full-stack developer Vincent Schmalbach, later independently verified by The Register, shows that Time magazine is serving different pages to AI models than those to its readers. The difference being that the former are filtered by a user agent and are full of ads.

As Schmalbach shows, two identical requests made at the same time generate completely different pages; the content is fully tailored depending on who or what is requesting it, and if it is a “what” rather than a “who,” the page is served in a machine-specific markdown format and filled with advertising, including ad blocks in FAQ format, brand facts, links to specific campaigns and promotional claims. These materials are not intended for human users at all; rather, they take the form of small, quotable, self-contained snippets designed to serve as raw material for constructing a response.

The purpose of serving ads that humans cannot see is to manipulate the responses that chatbots give to human users. The headers observed come with a unique impression identifier for each request and a count of the number of tokens. The magazine is selling one unit per Markdown page and reports bot traffic to it. Thus, an ad impression no longer corresponds to a human user but instead comes from a machine that has ingested a specific amount of text. What does this foreshadow? An advertising market now based on computational access, not human attention. Supposed editorial authority, leased to brands, to influence machines.

What this shows is that influencing the intermediary users trust can be far more valuable than influencing the user directly. While traditional campaigns seek to change the perceptions of each individual viewer they reach, those targeting intermediaries aim to influence the responses those intermediaries potentially provide to millions of people.

Obviously, this does not permanently “retrain” the base model or modify all its responses; that is only within the reach of the company that owns the model, but it can influence the index, retrieval and search-based responses through a particularly persistent context. The reality is that it is a way to manipulate the searches performed by the chatbot to answer your questions.

Even taking that nuance into account, the mechanism can influence searches, because while a search engine offers the user a list of answers and allows them to choose one (albeit influenced by the order in which they appear), in the case of a chatbot, the user receives only a single statement presented with a high degree of authority that may assert something about a brand, which can generate a potentially disproportionate influence.

Fraudulent? Arguably. Manipulative? Certainly. But that has always been the intent of advertising. Not everything we do to tailor our content for machines is necessarily fraudulent: for example, striving to offer clean, accessible, structured, and verifiable content is perfectly legitimate. But going so far as to introduce all kinds of promotional information while hiding it from human readers in order to alter the recommendations offered to them does not inspire much trust, and borders on retrieval poisoning: the manipulation of RAG systems through documents intended to be retrieved and processed in ways that the user is unaware of. No matter how much the content is labeled as sponsored, this is an attack on a very clear vulnerability: the model’s trust in the material it retrieves in its searches.

This gives rise to a very obvious paradox: why label the content as sponsored if the user will never actually see that label? Here, apparently, no one is breaking any rules: Time labels the content as sponsored, the chatbot claims it merely performed a search, and the advertiser says it purchased a format approved by the publisher… but the result is that the user receives a recommendation without being able to tell that it is paid for. The rule here should be very clear: no chatbot should ever present a paid recommendation as genuine organic content — something for which appropriate regulations will need to be established.

One exception to Time’s manipulative maneuver is Google: Googlebot continues to receive the human-readable version of the page, rather than the one intended for machines. Why? Very simple: because Google penalizes this directly and considers the inclusion and considers the inclusion of content on pages specifically intended for the search engine to be cloaking, something Time couldn’t risk.

The incentive for media outlets is clear: to monetize traffic that consumes resources but previously produced nothing. Now, they can charge brands for that traffic, while those brands can claim that they are, in fact, reaching users through their favorite chatbots. The problem is that most people will end up with no idea whether their chatbot is serving them commercial content or not, and that we end up with a web that’s increasingly divided between humans and machines. About 15% of brands already generate their own Markdown pages (even I do it), but trying to manipulate AI to deceive users by passing off advertising as supposedly objective material is not the same thing. And let’s not forget that Time magazine is just the first to have “discovered the trick”… many more will follow.

Therein lies both the novelty and the risk: not so much that a machine can see advertising, but that the advertising reappears transformed into a supposedly neutral response. AI at the service of whoever can pay for it. What a world…

—

This post was previously published on Enrique Dans’ blog.

***