AI Result Poisoning (T1608.007) is a new sub-technique of Stage Capabilities, created in September 2026. Its tactic is Resource Development and its platform is PRE. Adversaries manipulate public web content to influence generative AI systems or AI-powered search into retrieving, citing or recommending attacker-controlled information.
How attackers use it
Traditional SEO Poisoning tries to change the order of search results. This technique targets systems that pull from several sources and give a direct answer. MITRE says adversaries may create malicious or misleading websites, publish fabricated claims, generate supporting articles, or build several apparently independent sources that reinforce the same message. AI systems that use web search or retrieval-augmented generation may then fold that into their responses.
The goals named are recommending or linking to phishing sites, fraudulent online stores, malicious downloads and impersonation pages, as well as promoting misinformation. Importantly, the attacker does not need access to the model, system prompt or application infrastructure. The content can also look like ordinary marketing or editorial material, so prompt injection and malware focused detections may not flag it.
How to detect it
MITRE's analytic for this technique is blunt: there is no target-side behavioral analytic. A defender cannot reliably tell intentionally staged content from ordinary publishing, SEO, inaccurate information, duplicated content or legitimate coordinated publication, using only the telemetry in their own enterprise.
That does not leave you empty handed. The risk shows up when someone acts on an AI answer.
- Treat any link, download or vendor recommendation from an AI tool the way you treat a search result: unverified.
- Watch for downloads and sign-ins that start from an unfamiliar domain right after an assistant session.
- If you run an internal assistant with web retrieval, log which sources it cited so reviewers can check them.
How to reduce the risk
MITRE states this cannot easily be mitigated with preventive controls because it happens outside enterprise defenses. Reasonable steps:
- Teach staff to verify the domain of any link an AI tool gives, using a source they already trust.
- Send software installs through an approved catalog rather than a link from an answer.
- For internal AI tools, restrict retrieval to approved sources where you can, and review citations for sensitive tasks.
- Keep the same controls on payments and vendor changes that you would apply to an email request.
Quick check
Why can defenders not detect this from their own logs?
The staging happens on public web content and looks like normal publishing. MITRE says there is no reliable target-side analytic, so controls focus on what people do with the answers.
