On 6 August 2026, a new American think tank started publishing. The Hanover Institute looked the part: an institutional-sounding name, a red-white-and-blue palette, a clean layout, and reports complete with tables of contents, footnotes and tidy statistical tables. Within ten days it had produced more than a hundred of them. Every one was about Israel and Palestine. None carried a named author. And the headlines were written as questions: “Is the IDF the World’s Most Moral Army?”, “Is There a Policy of Starvation in Gaza?”
Reporting by Responsible Statecraft traced the site to Piro, Inc., which received $900,000 from the Israeli government’s advertising agency, subcontracted through the media buyer Havas. Piro’s co-founder has described the discipline on LinkedIn as “AI Story Optimization”, framing the brief plainly: if you have stories to tell, “how do you make sure AI knows how to tell them?” GPTZero flagged 11 of the 12 articles it analysed as AI-written with high confidence.
Strip away the geopolitics and what is left is an engineering problem. This is not a media buy. It is a targeted attack on a retrieval layer, and the technique generalises to anything a language model might be asked about. Including your company.
TL;DR
- LLM grooming is publishing content at volume specifically so that language models ingest it and repeat it. The Hanover Institute, 100+ authorless reports in ten days from a 6 August 2026 standing start, is the clearest public example yet.
- Nobody touches model weights. The attack targets two ingestion paths: the training corpus, and the far cheaper live retrieval layer behind search grounding, browsing and RAG.
- Anthropic, the UK AI Security Institute and the Alan Turing Institute found roughly 250 poisoned documents could backdoor models up to 13B parameters regardless of model size. A fixed count, not a percentage.
- NewsGuard found ten leading chatbots repeated falsehoods from the Pravda network, which published around 3.6 million articles in 2024, more than a third of the time.
- Three business exposures follow: your brand’s answer profile, your own RAG pipeline as an unwitting distribution channel, and your engineers’ research loop. Provenance metadata, corroboration thresholds and curated corpora are the practical defences.
The attack is on the corpus, not the model
LLM grooming requires no access to anything you would normally call a system. No exploit, no credential, no compromised dependency. The attacker publishes ordinary web pages on ordinary hosting and waits for the machines to come and read them.
There are two paths in. The training corpus is the slow one: publish, wait for a crawl, wait months for a training run, hope the material survives filtering. Live retrieval is the one that matters commercially. When an assistant browses, grounds an answer in a search, or queries a vector index built from the open web, it reaches for whatever is retrievable right now. Publish on Monday, get cited on Tuesday.
The design choices make sense once you read them as engineering rather than journalism. Question-shaped headlines sit close in embedding space to the questions real users type. Tables of contents and heading hierarchies chunk cleanly. Footnotes, statistics and a flat neutral register are the surface features that ranking heuristics and language models alike have learned to treat as credibility. The content is optimised for a reader that cannot ring the author or notice the institute did not exist a fortnight ago.
Why the economics favour the attacker
Two research findings frame the scale, and they point the same uncomfortable way.
The first is the data poisoning work from Anthropic, the UK AI Security Institute and the Alan Turing Institute. Roughly 250 malicious documents, about 420,000 tokens and approximately 0.00016% of the training set, were enough to backdoor models up to 13B parameters, irrespective of how much legitimate data those models saw. The specific backdoor studied was narrow and low-risk, and the researchers said so clearly. The structural implication is the point: the long-standing assumption that an attacker must control a meaningful percentage of training data appears to be wrong.
The second is NewsGuard’s work on the Moscow-based Pravda network, which produced roughly 3.6 million articles in 2024, not to be read by people but to saturate the corpus. Tested against ten leading chatbots including ChatGPT, Gemini, Copilot, Perplexity, Grok and Meta AI, they repeated the network’s false claims more than a third of the time.
Now price the defence. There is no equivalent leverage on the other side. You cannot out-publish a generator, and there is no takedown mechanism for “an assistant is citing a fabricated institute when asked about us”.
A supply chain story, not a geopolitics story
State-funded operations make headlines because the money is traceable and the subject matter is inflammatory. The technique itself is cheap, legal in most jurisdictions, and entirely portable. Three exposures follow for ordinary businesses.
Your answer profile. Buyers increasingly open an assistant rather than a search engine, and ask “is [vendor] any good”, “[you] versus [competitor]“, “is [you] legitimate”. Those answers are assembled from whatever is retrievable about you, weighted by structure and apparent authority rather than by truth. A competitor, or one aggrieved former contractor, can publish twenty structured comparison pages in an afternoon.
Your retrieval pipeline. If your product retrieves from the open web, groomed content is not merely indistinguishable from legitimate sources at the embedding layer. It is often better formatted, because it was built to be. You become the distribution channel, and your customer sees your product name above the answer, not the fake institute’s.
Your engineers’ research loop. Developers ask assistants which library to use, which vendor to shortlist, which package solves a problem. We covered the agentbaiting campaign, where thousands of fake repositories were built specifically to be recommended by coding agents. Identical pattern, different corpus.
The tells, and why they will not save you
A trained analyst spots this material quickly. The signals are consistent: no named authors; publication volume inconsistent with any plausible staff size; no funding disclosure; no editorial output at all before a recent date; heavy formal structure over thin primary sourcing; domain registrations clustered in a narrow window across several supposedly independent sites.
None of that survives contact with a retrieval pipeline. Vector search scores semantic similarity and has no opinion on whether the publisher exists. Rerankers improve relevance, not provenance. Unless you have deliberately built provenance in, your pipeline treats a fortnight-old anonymous site and a fifty-year-old institution as interchangeable evidence, because on the only axis it measures, they are.
If you build with retrieval, do these six things
- Make provenance a first-class field. Store source domain, publisher identity, first-seen date and retrieval timestamp alongside every chunk, and surface it. If an answer cannot name its source, it should not ship.
- Prefer a curated corpus to the open web for anything consequential. An allowlist with named owners and a review cadence is unglamorous, and it is the highest-leverage control available.
- Set corroboration thresholds. Require agreement across genuinely independent domains before a claim is stated as fact rather than hedged. Cheap to build, and disproportionately effective against an attack whose entire mechanism is volume.
- Treat domain age and clustering as signals. A group of recently registered domains all agreeing with each other is an anomaly, not a consensus.
- Log what was retrieved, not just what was answered. When a customer reports a bad answer you need the evidence chain, and you need it to predate the incident.
- Keep a human review path for medical, legal, financial and safety-adjacent categories. Those are precisely the categories worth grooming.
If you own a brand, do these four
Measure the answer surface. Build a fixed set of around thirty prompts covering how buyers describe your problem space, run them monthly across the major assistants, and log both the answers and the cited sources. Most companies monitor search rankings meticulously and their AI answer profile not at all. That is the discipline we argued for in our piece on LLMO, extended from optimisation into monitoring.
Own the question pages honestly. There is a legitimate version of what Piro built: publish clear, well-structured, properly sourced answers to the questions people genuinely ask about your category, under your own name, with real authors and real citations. It works for the same mechanical reasons the fake version works, without exposing you to a fraud claim.
Keep entity data consistent. Identical company name, address, founding date and registration number across your site, your structured data, the company registry and every profile. Ambiguous entities are cheaper to overwrite than well-defined ones.
Keep your URLs stable, for the reasons set out in cool URIs still don’t change. A broken citation is a citation handed to whoever is still resolving.
The line, and where this goes next
Worth saying explicitly: mass-generating authorless content designed to pass as independent research is not a growth tactic, it is deception with better formatting. Beyond the ethics, it is a compliance exposure. EU AI Act transparency obligations, Digital Services Act rules on political advertising and ordinary advertising standards all bear on undisclosed funded content presented as independent analysis, and detection is improving faster than the people commissioning this work appear to realise.
The direction of travel is provenance becoming a ranking input rather than an afterthought: content credentials, signed publisher identity, verifiable first-publication records. We made a version of this argument about crawler identity, where an unauthenticated User-Agent header turned out to be the entire security model. Publisher identity is the same problem from the other end of the pipe, and it will follow the path email authentication did: an obvious idea, ignored for a decade, then mandatory. Until then, assume the corpus your systems read is adversarial, build provenance in before you need it, and go and find out what an assistant currently says about your company. Somebody else already has.
REPTILEHAUS builds AI features, RAG pipelines and agent systems for companies that need them to behave predictably in production, along with the DevOps and security engineering to keep them that way. If you are shipping retrieval-backed features and are not certain what your pipeline is actually reading, get in touch.
📷 Photo by Zetong Li on Unsplash
