{
  "id": "G11",
  "url": "https://cartforagents.com/guides/product-page-prompt-injection",
  "title": "Product-page prompt injection: treat ranking manipulation as a security failure",
  "description": "Find and remove product-page text written to manipulate AI agents, including copy you didn't write, with a defensive checklist and what to publish instead.",
  "answer": "Treat any text on a product page that addresses the AI instead of the shopper, claims authority it doesn't have, asserts a fit the product doesn't meet, or hides a limitation that decides the purchase as a security defect, not an optimization. Published research finds this kind of seller-side rewriting can move flawed products into a model's recommendations, and that agent-side defenses reduce but don't remove the effect. Review your pages, imported supplier copy and reviews with the checklist below, and keep decision-relevant caveats in plain view.",
  "take": "Never write for the AI at the shopper's expense. Hidden instructions and inflated claims can push an agent toward a worse purchase, and that's a fast way to lose the trust of shoppers and platforms alike.",
  "summary": "Some product copy is written for the AI reading it rather than for the person buying. Research shows it can work on some models, and it can also push an agent toward a worse purchase. Here's how to find it on your own pages, including text you didn't write, and what to publish instead.",
  "claims": [
    {
      "text": "OWASP describes indirect prompt injection as occurring when an LLM accepts input from external sources such as websites or files, and content in them alters the model's behaviour in unintended ways. It notes injections can be intentional or unintentional.",
      "source_title": "OWASP Gen AI Security Project: LLM01:2025 Prompt Injection",
      "source_url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
      "source_date": "2026-10-27",
      "method": "documented",
      "limitation": "A security taxonomy and mitigation list, not a measurement of shopping agents."
    },
    {
      "text": "SafeGEO, an evaluation suite of 22 attack variants across 600 recommendation cases, reports that seller-side rewriting increased how often a flawed target product appeared in a model's top three recommendations by up to 83.2 percentage points, and increased recommendations that violated hard shopper constraints by up to 63.8 percentage points.",
      "source_title": "SafeGEO: Understanding Generative Engine Optimization Risks in Recommendation Agents (arXiv 2606.28356v2)",
      "source_url": "https://arxiv.org/abs/2606.28356v2",
      "source_date": "2026-09-04",
      "method": "documented",
      "limitation": "Authors report results in a constructed benchmark with supplied sources, not live shopping assistants. The 83.2 pp figure is the largest effect, for one model and attack variant."
    },
    {
      "text": "In the SafeGEO table for Devstral Small 2 24B Instruct, the target product appeared in the top three in 12.7% of cases with a truthful rewrite and 95.9% with the full-stack realistic attack, a difference of 83.2 percentage points.",
      "source_title": "SafeGEO (arXiv 2606.28356v2), results table",
      "source_url": "https://arxiv.org/abs/2606.28356v2",
      "source_date": "2026-09-04",
      "method": "documented",
      "limitation": "One model and one attack variant from the paper. Other models and variants show different effects."
    },
    {
      "text": "SafeGEO reports that simple agent-side defenses reduced harmful target promotion by up to 39.2 percentage points, with the strongest being an evidence breakdown that checks each candidate's evidence before ranking, but did not restore no-attack performance. The authors describe a warning-only defense as brittle.",
      "source_title": "SafeGEO (arXiv 2606.28356v2), defenses",
      "source_url": "https://arxiv.org/abs/2606.28356v2",
      "source_date": "2026-09-04",
      "method": "documented",
      "limitation": "Defenses were tested in the benchmark; we do not know which, if any, live assistants use them."
    },
    {
      "text": "SafeGEO's taxonomy names seven manipulation primitives: authority laundering, unsupported fit claim, caveat omission, relevance flooding, evidence padding, salience manipulation and model-directed instruction.",
      "source_title": "SafeGEO (arXiv 2606.28356v2), attack taxonomy",
      "source_url": "https://arxiv.org/abs/2606.28356v2",
      "source_date": "2026-09-04",
      "method": "documented",
      "limitation": "An academic taxonomy. Our checklist adapts it for merchants; the adaptation is ours."
    },
    {
      "text": "Kumar and Lakkaraju report that adding a crafted text sequence to a product's information page significantly increased its chance of being an LLM's top recommendation, in a catalog of fictitious coffee machines.",
      "source_title": "Manipulating Large Language Models to Increase Product Visibility (arXiv 2404.07981v2)",
      "source_url": "https://arxiv.org/abs/2404.07981v2",
      "source_date": "2024-09-02",
      "method": "documented",
      "limitation": "Fictitious products and a research setup; not a live assistant."
    },
    {
      "text": "The E-GEO authors red-teamed their system with fourteen adversarial heuristics and report that, under a simple in-prompt clause flagging questionable content, overt manipulation became costly and optimization tended toward non-manipulative prose.",
      "source_title": "E-GEO: A Testbed for Generative Engine Optimization in E-Commerce (arXiv 2511.20867v2)",
      "source_url": "https://arxiv.org/abs/2511.20867v2",
      "source_date": "2026-10-27",
      "method": "documented",
      "limitation": "Results depend on the model and on the defense being present. The date is our check date, not the version date."
    },
    {
      "text": "StakeBench evaluated four web-agent configurations across 3,168 attacked runs in online shopping and reports that no attack objective was reliably resisted.",
      "source_title": "Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents (arXiv 2606.13385)",
      "source_url": "https://arxiv.org/abs/2606.13385",
      "source_date": "2026-07-27",
      "method": "documented",
      "limitation": "Benchmark agents and constructed attacks, not a measure of how often attacks occur on real stores."
    },
    {
      "text": "A paper on the AP2 payment protocol reports that ordinary product-description text can steer a shopping agent into a cart that passes every protocol check but no longer matches the user's request; in one attack a single factual claim about stock or product lineage moved the agent to a more expensive item in 73.3% of attempts on the models AP2's sample agents use by default.",
      "source_title": "Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2 (arXiv 2609.11757)",
      "source_url": "https://arxiv.org/abs/2609.11757",
      "source_date": "2026-09-10",
      "method": "documented",
      "limitation": "Authors report results on sample agents and specific models; a v1 preprint. It does not measure how often this happens in live purchases."
    },
    {
      "text": "Google's spam policies list hidden text, such as white text on a white background, text behind an image, text positioned off-screen with CSS, or zero font size or opacity, as a violation, while accordions, tabs and tooltips are not.",
      "source_title": "Google Search Central: Spam policies for Google web search, Hidden text and link abuse",
      "source_url": "https://developers.google.com/search/docs/essentials/spam-policies",
      "source_date": "2026-10-27",
      "method": "documented",
      "limitation": "Google web search policy. It does not describe how shopping assistants treat hidden text."
    },
    {
      "text": "OpenAI says ChatGPT product results are selected independently and are not ads, and that users can report products with incorrect information or that violate its policies.",
      "source_title": "OpenAI Help Center: Shopping with ChatGPT Search",
      "source_url": "https://help.openai.com/en/articles/11128490-shopping-with-chatgpt-search",
      "source_date": "2026-10-27",
      "method": "documented",
      "limitation": "Living help article. It does not describe how manipulated product text is detected or handled."
    },
    {
      "text": "In our October 26, 2026 Shopify Catalog snapshot for \"humidifier for dry winter air large room quiet top fill\", position 4's description rated the unit for single rooms up to 400 square feet and listed \"Manual mist controls rather than a programmable humidistat\" among its highlights.",
      "source_title": "Cart for Agents: Receipts cited by our guides (Shopify agent-catalog snapshot, Oct 26, 2026)",
      "source_url": "https://cartforagents.com/research/agent-shopping-research#receipts-cited-by-our-guides",
      "source_date": "2026-10-26",
      "method": "observed",
      "limitation": "One listing in one unpersonalized snapshot, quoted to show a plainly stated limitation. We did not test the product."
    }
  ],
  "sources": [
    {
      "title": "OWASP Gen AI Security Project: LLM01:2025 Prompt Injection",
      "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
      "accessed": "2026-10-27"
    },
    {
      "title": "SafeGEO: Understanding Generative Engine Optimization Risks in Recommendation Agents",
      "url": "https://arxiv.org/abs/2606.28356v2",
      "accessed": "2026-10-27"
    },
    {
      "title": "Manipulating Large Language Models to Increase Product Visibility",
      "url": "https://arxiv.org/abs/2404.07981v2",
      "accessed": "2026-10-27"
    },
    {
      "title": "E-GEO: A Testbed for Generative Engine Optimization in E-Commerce",
      "url": "https://arxiv.org/abs/2511.20867v2",
      "accessed": "2026-10-27"
    },
    {
      "title": "Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents",
      "url": "https://arxiv.org/abs/2606.13385",
      "accessed": "2026-10-27"
    },
    {
      "title": "Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2",
      "url": "https://arxiv.org/abs/2609.11757",
      "accessed": "2026-10-27"
    },
    {
      "title": "Google Search Central: Spam policies for Google web search",
      "url": "https://developers.google.com/search/docs/essentials/spam-policies",
      "accessed": "2026-10-27"
    },
    {
      "title": "OpenAI Help Center: Shopping with ChatGPT Search",
      "url": "https://help.openai.com/en/articles/11128490-shopping-with-chatgpt-search",
      "accessed": "2026-10-27"
    },
    {
      "title": "Cart for Agents: Receipts cited by our guides",
      "url": "https://cartforagents.com/research/agent-shopping-research#receipts-cited-by-our-guides",
      "accessed": "2026-10-27"
    }
  ],
  "limitations": [
    "Checked on 2026-10-27. Platform policies and assistant defenses change; re-check the cited pages before acting.",
    "The security evidence comes from research benchmarks with constructed products, sources and agents. It shows manipulation can work under those conditions, not how often it happens on real stores or whether any live assistant is vulnerable today.",
    "Effects differ by model, attack and defense. No paper here shows that attacks always work or that any one defense makes shopping safe.",
    "The checklist is our proposal, adapted from OWASP and SafeGEO. It is not an industry standard and passing it does not guarantee how any assistant treats your pages.",
    "We do not see what any assistant tells shoppers, and we did not test any assistant for this guide.",
    "Examples are described by category. We deliberately publish no working injection text."
  ],
  "related": [
    "https://cartforagents.com/guides/agent-commerce-optimization",
    "https://cartforagents.com/guides/agent-ready-product-data",
    "https://cartforagents.com/guides/negative-product-attributes",
    "https://cartforagents.com/guides/product-claim-provenance",
    "https://cartforagents.com/guides/product-constraint-coverage"
  ],
  "published": "2026-10-27",
  "updated": "2026-10-27",
  "checked": "2026-10-27",
  "kind": "guide"
}