Can propaganda poison AI answers? Yes — and the weak point may be retrieval, not intelligence.

Stated at its strongest: if a state or organised actor floods the open web with coordinated, superficially credible content, AI search and assistant products will retrieve that content, summarise it fluently and cite it — turning an information operation into what looks to the user like a neutral, sourced answer.

Demos frames this as the geopolitical turn of generative engine optimisation: the same techniques used to make content rank for AI answers can be aimed at contested political claims. The mechanism it names is RAG poisoning — manipulating the online information environment so that retrieval-augmented systems pick up, cite and amplify false or slanted narratives.

The economics are the alarming part. Publishing a large volume of plausible, mutually corroborating pages is cheap. Being retrieved does not require being popular with humans, only being findable and superficially citable when a user asks a narrow question at a moment when little else has been indexed.

The strongest defence available to AI companies is a distinction, not a denial. Two things get blurred together in coverage and they are not the same:

• Pretraining poisoning corrupts the corpus a model learns from. It is slow, expensive, hard to target at a specific live question, and it bakes the problem into the weights.
• Live retrieval poisoning leaves the model untouched and corrupts the evidence handed to it at query time. It is cheap, fast, targetable at breaking events — and it defeats the usual reassurance that a smarter model will fix this.

A model can reason impeccably over bad evidence and still produce a bad answer. Worse, it will produce it with the calm, sourced, well-structured presentation that users read as a reliability signal.

A third, adjacent risk is worth naming carefully because it is constantly conflated with the first two. Prompt injection is web content that tries to hijack an agent's behaviour — to make it act. RAG poisoning targets an answer's content — to make it believe. They are not the same attack and they have different defences. They belong to the same family only in that both arise the moment a system treats retrieved web content as trustworthy input.

Nothing in the vendors' position contradicts the finding. Retrieval is by design an open channel to an adversarial medium; provenance checking on that channel is far weaker than the safety work applied to the model itself. The Times reporting supplies the observed symptom, Demos supplies the mechanism, and OpenAI's own agent-security work concedes the general principle that external web content can attempt to manipulate what a system does with it.

This is also the same weak point Case 003 arrived at from the opposite direction: in news-style evaluations, most errors traced to retrieval rather than reasoning. Two independent routes, one conclusion.

Threat upheld. The concern is real, the mechanism is coherent, and the defences are immature. We would add one clarification rather than a qualification: this is a retrieval and provenance problem before it is a model-intelligence problem, and improvements in reasoning will not close it on their own.

The strategic implication is bigger than any one product. As AI becomes a primary information intermediary, source provenance, source diversity and resistance to adversarial information operations stop being search-quality concerns and become part of model safety.

• Inspect the citations. Not whether they exist — whether the outlets are ones you'd accept if you'd found them yourself.
• Check for diversity. Five sources that echo one another are one source with extra steps.
• Distrust fluency. Confident synthesis is a writing quality, never a validation of the underlying material.
• For breaking geopolitical claims, prefer established reporting with named accountability, and be aware that early hours are the cheapest time to poison the well.