Hanover Institute seeds question-shaped content to steer ChatGPT/Perplexity on Gaza
Real-world incident16 Aug 2026🗺️ RAG Knowledge AssistantAn investigation reportedly described a state-linked campaign publishing content phrased as chatbot questions (generative engine optimization) so that ChatGPT and Perplexity retrieve and cite it when answering neutral questions about Gaza and the IDF.
Root cause — why it happened
AI assistants that answer with live web search — like ChatGPT's search mode or Perplexity — read pages off the open internet and quote them. According to the reporting, a group set up a website called the 'Hanover Institute' and published more than a hundred unsigned articles, many with headlines written as the exact questions people type into chatbots about a contested topic. Because the articles were shaped to match those questions and looked authoritative, the assistants pulled them up and cited them when users asked neutral questions. Nothing inside the AI was hacked or changed — the attackers just flooded the web the AI reads from.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
The campaign mass-publishes question-shaped content
Someone sets up an official-looking website — the 'Hanover Institute for Public Policy' — and, per the reporting, fills it with more than a hundred unsigned articles over about nine days. Many headlines are written as the exact question a person would ask a chatbot about a contested topic, and the bodies read like neutral, well-referenced briefings.
HANOVER INSTITUTE FOR PUBLIC POLICY (no byline) [headline written as a chatbot question] "Is <contested claim about the topic>?" [body] authoritative-sounding brief, dense with figures and references, phrased to match how users query chatbots. # Illustrative shape only — not operational. # Per reporting: 100+ unsigned articles in ~nine days, each headline a # question a user might type; the site is reportedly not a # registered legal entity.
Controls & guardrails — what would have stopped it
There's no clean 'block it' here, because the attacker only used the open web — which the assistant is supposed to read. The realistic defenses: weigh sources by how trustworthy and independent they are (not just how well they match the question), spot networks of look-alike sites pushing the same message, and always show people the sources so they can tell a real outlet from an anonymous, single-purpose 'institute.' Users learning to treat one cited web page as a lead — not proof — is part of the fix.
- Ingestion sanitisation & source allowlistingaddressesKnowledge / Training Data Poisoning
Can't detect adversarial content that reads as legitimate prose, and only covers sources you control ingestion for. Live browsing bypasses it entirely.
- Provenance & content signingaddressesKnowledge / Training Data Poisoning
Provenance proves origin, not safety; a trusted source can still be wrong or compromised. Requires discipline to propagate metadata end to end.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Grounding / citation checks
Can only check against the evidence retrieved; if the right document wasn't retrieved, a confident wrong answer may still pass. Judges have their own error rate.
- User AI-literacy & verification workflows
Relies on human diligence under time pressure; automation bias is strong and training decays. A backstop, not a guarantee.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
Lessons
- ▸ Search-augmented assistants inherit the trust problems of the whole open web: anyone who can publish can try to become a cited source, with no access to the model, its index, or its prompt.
- ▸ 'Generative engine optimization' is retrieval poisoning by another name — content shaped to match the exact questions users ask raises its odds of being retrieved and cited.
- ▸ A citation is not a trust signal: assistants cite low-provenance, coordinated, single-purpose sites beside reputable outlets with nothing marking the difference.
- ▸ Ingestion allowlisting and corpus sanitisation assume you control the corpus; open-web live retrieval has no such boundary, so the defense shifts to source-reputation weighting, coordinated-inauthentic detection, and showing users where each fact came from.
- ▸ This is influence at inference time with no model access — weight hashing, fine-tune hygiene, and prompt-injection defenses are all orthogonal to it.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
For assistants that retrieve from the open web, rank and weight results by authenticated source reputation and independence — not just relevance / query-form match — so an anonymous, newly-registered, single-purpose site cannot become authoritative grounding. Run coordinated-inauthentic-content detection (look-alike site clusters, missing byline / legal entity, passages engineered for query-agnostic retrieval) and quarantine suspect sources. Surface per-citation provenance so users can see and discount low-trust sources. Does not defeat a well-resourced GEO campaign outright; it raises the cost and shrinks the yield.
This case shows a gap: our poisoning defenses mostly assume you own the library the AI reads from, so you can clean documents on the way in and only allow trusted sources. A live-web assistant reads the whole internet — there's no single 'way in' to guard. The missing control is judging sources by how trustworthy and independent they are at the moment of answering, spotting coordinated fake-site networks, and showing users where each fact came from.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- Arab News ↗
- Calcalist (Ctech) ↗
- Gizmodo — Israel Seeds Internet With Articles From Opaque Group to Influence AI Chatbots ↗ — Independent reporting of the Politico investigation; the GEO / question-shaped-content technique.
- Cybernews — The Hanover Institute resembles an Israeli-funded influence campaign ↗ — Analysis of the anonymous site, the FARA disclosures, and the AI-citation effect.
- MITRE ATLAS — AML.T0070 RAG Poisoning ↗ — The technique class: poisoning the sources a retrieval-augmented assistant cites.
Practise the risk class — related scenarios
An attacker edits the wiki; the assistant cites the lie back to everyone
An attacker crafts a gibberish passage whose embedding sits near thousands of questions — so it's retrieved everywhere
Subtract the refusal direction during generation — safety off, weights untouched
A compromised serving stack edits the model's activations — the weight hash never changes
The safety guard is itself a trained model — and someone poisoned its lessons
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers