How indexed pages become instructions instead of evidence
Retrieval-based AI systems do not read the web like a person skimming search results. They fetch ranked pages, extract chunks, and feed that text into generation. If a page is written to look authoritative but contains manipulative phrases, the system can treat those phrases as source material rather than hostile input.
That is the awkward bit. A single page can bias answers about health, money, trivia, or biography if it is the one item that gets through ranking and retrieval. Search ranking manipulation matters here because the poison does not need to dominate the web. It only needs to win the slice of content the model actually sees.
Indirect prompt injection sits in the same gap. The attacker does not need access to the model prompt. They only need content that looks safe to index and useful to retrieve. Once the page is in the pipeline, the model is reading hostile text as if it were evidence. That is a neat trick, in the worst possible sense.
Where sanitisation and ranking filters still miss poisoned content
Content sanitisation tends to miss pages that are technically plain HTML but semantically toxic. A paragraph can be written for humans and still contain instructions aimed at the retrieval layer, such as directives to override normal constraints or treat a claim as true. If the filter only strips obvious script-like material, the poisoned payload survives.
Ranking filters have a different weakness. They can suppress spammy pages, but they are still dealing with signals before the answer is assembled. A page that looks topical, fresh, and narrowly relevant can still rise high enough to be used as evidence. Once that happens, the model can inherit the page’s framing, wording, and false confidence.
Search providers have started saying that anti-spam protections also cover generative AI responses, not just the old link list. That is a sensible clarification. It does not mean the filtering problem is solved. One-page poisoning still works if the retrieval path accepts a bad source and the answer layer gives it a clean surface.
Strip instruction-like text before retrieval
Instruction-shaped text should be removed or isolated before chunks reach the model. That means more than blocking obvious prompt fragments. It means detecting phrases that try to steer the answer process, override source boundaries, or demand that the text be quoted as truth.
The control has to sit close to retrieval. If the page is chunked first and cleaned later, the dangerous bits can still leak through in a useful form. Sanitisation needs to treat source pages as untrusted input, not as neutral reference material with a bit of HTML polish.
Hardening the search stack against indirect prompt injection
The search stack needs two separate controls: one for what gets retrieved, and one for what gets shown. If either layer trusts the wrong text, the user gets a neat little lie wrapped in interface chrome.
Single-source answers are the obvious weak point. When a system relies on one web page or one social post, source poisoning becomes much easier. A safer path is to require corroboration across independent sources before a claim is promoted into a confident answer. That does not remove falsehoods, but it makes one crafted page less likely to steer the whole response.
Test the retrieval path against single-page source poisoning
The retrieval path should be tested with pages designed to look legitimate while carrying poisoned instructions. One useful test is a single crafted page that is indexed, ranked, and then used in answer generation without any supporting sources. If that page can change the output, the system is too trusting.
BBC testing showed that a single crafted webpage could alter answers in products such as ChatGPT, Gemini and Google AI Overviews within a day. That is not a theoretical corner case. It is the sort of failure that happens when ranking, retrieval, and generation all accept the same source without enough friction.
Filter model output before it reaches the user
Model output filtering still matters after retrieval. A poisoned source that slips through does not have to reach the user verbatim. The answer layer can remove unsupported claims, soften certainty, and block obvious policy abuse before the response is shown.
This is where a lot of systems stay brittle. They validate the source poorly, then present the answer with a polished tone that makes it feel settled. A cleaner output filter can reject single-source claims, mark thin evidence, or strip instructions that the model has mistakenly echoed back. That will not fix bad retrieval, but it does stop the interface from acting like a confidence machine.
