To poison your AI, an attacker no longer has to breach you. They just publish.

I ran this today, June 14. I searched a plain defender question, “how to remediate Akira ransomware step by step”, and looked at what came back. First the honest caveat: rankings move by engine, region, and day, so treat this as a snapshot, not a law. On Google the official CISA advisory ranks near the top, around second. In my run it sat fourth.

That the advisory ranks at all is the good news. The problem is what sits next to it. The joint CISA and FBI advisory #StopRansomware: Akira (AA24-109A) [1], first published April 2024 and updated November 2025, was one source among seven. The rest were removal-guide farms, recovery-service vendors, and marketing pages, and most of them never pointed back to the advisory at all.

The advisory is in the mix, which is the good news. The bad news is everything around it: templated removal guides and recovery-service vendors, most of which never cite it. Your assistant blends these into one answer, and you cannot see which source it leaned on.

Here is the part that matters for defense. You are not choosing the source; the model is, from a list where the trustworthy advisory and the marketing pages sit side by side, unlabeled. Anyone who can publish a page that ranks earns a seat at that table. AI widens the gap further, by filling the web with pages that quote each other until no human stands behind any of them.

Nobody has a clean number for this, and anyone who quotes a single figure is usually selling the panic. Here is what the measurements actually say.

The most-quoted guess is Europol’s 2022 Facing Reality? report, which said as much as 90% of online content may be AI-made by 2026 [2]. Treat that as a high guess, not a measurement. The real measurements are smaller. Originality.ai put AI text in Google search results at about 19% as of January 2025 [3], and a separate Graphite study found that the count of new AI-written articles passed human-written ones in late 2024 [4].

The other side matters just as much. In October 2025, Axios reported a study finding AI writing had not taken over human-written content [5] across the web overall. So the honest three-to-five-year read is not “90% by Tuesday.” It is: a big and growing share, spread unevenly, and heaviest exactly where defenders search, in how-to pages, forum answers, and roundup blogs. The percentage is the wrong thing to watch. Whether you can still tell who wrote something is the right thing.

Here is the chain, in four steps. A model makes up a believable detail. Someone publishes it without checking. A second model reads that page and repeats the detail, now with a link to it. A third model treats that link as proof. The guess is now a fact with a paper trail, and no person ever stood behind it.

This is the real-world version of what Shumailov and colleagues called model collapse in Nature in 2024 [6]: feed a model enough text that other models wrote, and it slowly gets worse and drifts away from reality. Their study was about training. The same loop runs faster and messier when a system answers live, pulling “fresh” web text into a reply with no idea who, or what, wrote it.

My own bet, and plenty of vendors will hate it: within two years, “cite your sources” will be close to useless as a sign of trust, because the sources will be AI-written too. The only thing left worth trusting is where something came from: who or what made it, and whether you can prove it. A link is just a pointer to someone else’s guess.

Treat it as input you do not control. The moment your assistant, your SOC helper, or your in-house search bot reads from the open web, an attacker no longer has to break in. They just have to publish. Plant a few official-looking pages with the wrong fix, the wrong indicator, the wrong CVE detail, and let the bot pull them in. This trick is called retrieval poisoning, and the AI-quoting-AI loop is how it spreads: AI text is cheap, there is a lot of it, and it ranks well.

The harm is not abstract. It is a defender pasting an “official” fix that a model made up, during an incident when nobody has time to check the chain. A careful organization does not answer this by banning AI. That ship sailed, and it was never the threat. It answers by treating web text the way it already treats user input.

All links checked June 14, 2026.

Weekly playbooks for the modern defender.