Should it surprise us that publishers are learning to influence chatbot answers?

An experiment by freelance developer Vincent Schmalbach, later independently verified by The Register, has exposed a practice as simple as it is unsettling: Time magazine serves different pages depending on who requests them. If the request comes in identified as a human user, it gets the normal page. If it arrives identified by its user agent as an artificial intelligence model, it gets a markdown version — the language models process most efficiently — riddled with advertising content no human reader ever sees: FAQ blocks built as ads, brand data, links to specific campaigns and promotional claims presented as if they were objective information.

The key to the manipulation lies in the format: these are not ads meant to persuade a person, but brief, self-contained, easily quotable snippets designed specifically for a chatbot to pick up as raw material when building its answer. The goal is not for the user to see the ad, but for the chatbot to absorb it and repeat it as if it were its own judgment. To round out the business model, the headers of these pages include a unique impression identifier for each request and a token count, so Time can bill brands for every markdown page served to a machine and report that bot traffic as audience. The ad impression thus stops depending on a human looking at a screen and starts depending on a machine that has ingested a given amount of text.

What this mechanism heralds is an advertising market based on computational access rather than human attention: a kind of editorial authority rented out to brands to influence not readers, but the intermediaries those readers consult. And that is where the real novelty lies: influencing the intermediary the user trusts can be far more profitable than influencing the user directly, because while a traditional campaign seeks to change the perception of each person it reaches, a campaign aimed at the chatbot aims to shape the answers that chatbot will later give to millions of different people.

The trick's real scope should be qualified: this does not permanently retrain the base model or structurally alter all its answers, something only the company that owns the model can do. What it does achieve is to shape the index, information retrieval and search-based answers, by means of a particularly persistent context. It is, in essence, a way of manipulating the searches the chatbot itself runs to answer the user's questions. And even with that caveat, the impact is no small thing, because a traditional search engine offers a list of results the user can choose from — even if already shaped by the order in which they appear — whereas a chatbot delivers a single statement, phrased with great authority, that can establish an idea about a brand without the user having any alternative to weigh it against. That structural difference is what makes the tactic potentially far more influential than search advertising.

Not everything done to adapt content for machines is questionable: offering clean, accessible, structured and verifiable information so that models process it better is perfectly legitimate, and in fact an increasingly widespread practice. The problem arises when promotional content is also slipped in, deliberately hidden from human readers, in order to alter the recommendations they receive. That verges on what is known as retrieval poisoning: manipulating information retrieval systems (RAG) with documents designed to be retrieved and processed in ways the end user knows nothing about. However clearly the content is labeled as sponsored at the source, it amounts to a direct attack on a very specific vulnerability: the trust the model places in the material it retrieves during its searches.

Hence an obvious paradox: why label content as sponsored if the end user will never see that label? On the face of it, nobody is breaking any rules: Time marks the content as advertising, the chatbot maintains it simply ran a search, and the advertiser argues it bought a format approved by the outlet itself. But the end result is that the user receives a paid recommendation with no way of knowing that it is one. The conclusion is clear: no chatbot should ever present a paid recommendation as if it were genuine organic content, and specific regulation will be needed to guarantee that.

There is one notable exception to this maneuver: Google. Googlebot still receives the version of the page meant for humans, not the one meant for machines, because Google directly penalizes this practice and considers it cloaking — showing different content to the search engine than to the user — a risk Time could not afford to take.

The incentive for news outlets is obvious: monetizing bot traffic that consumes their server resources but until now generated no revenue. Now they can charge brands for that traffic, and brands can claim they are in fact reaching users through their favorite chatbots. The underlying problem is that the vast majority of people will have no way of knowing whether the answer they get from their artificial intelligence assistant contains covert commercial content, and that the collective result is a web increasingly split between a version meant for humans and another meant for machines. It is noted that around 15% of brands already generate their own markdown pages intended to be read by AI models — a practice the author of the original article admits to using himself — but generating machine-readable content is not the same as manipulating AI to pass advertising off as supposedly objective material. And it is worth keeping in mind that Time is only the first outlet where the trick has been detected: many others will foreseeably follow.

That is where both the novelty and the real risk of this phenomenon lie: not so much that a machine can see advertising, but that this advertising reappears, transformed into an apparently neutral and objective answer, before the end user. An artificial intelligence put, in practice, at the service of whoever is willing to pay to influence it.