Nozzle reports that Google began delivering poisoned search results—complete pages with incorrect data—to rank trackers and AI companies on September 20, 2026. These results appear in 5% to 11% of daily searches since October 1, 2026. This affects anyone relying on third-party search data for AI grounding or ranking audits. (AI grounding: the process of using search results to provide a factual basis for LLM-generated answers.)
Is this for you?
If you rely on third-party search data for AI grounding or ranking audits, you must verify data integrity against retention rates to ensure accuracy.
- If you use automated rank tracking tools, you must verify data integrity against retention rates to ensure reports reflect actual rankings.
- If you are an AI data engineer, you should check if your grounding data source is being skewed by poisoned results.
- If you are an SEO practitioner, you can use the 20.7% retention threshold to identify and discount misleading ranking data.
- Skip this if you are a standard Google search user, as the poisoning targets specific scraper signatures and request routes.
What you can do now
- Check if your keyword retention rate drops toward 20.7% to identify poisoned data.
- Compare the appearance of AI Overviews in your data against the 34.9% poisoned frequency.
- Configure scraper request headers to use different user agents and proxy rotations to bypass signature identification.
Key figures
- Poisoned retention rate
- 20.7% (since Oct 1, 2026)
- Normal retention rate
- 88.5%
- AI Overviews in poisoned results
- 34.9%
- AI Overviews in baseline
- 54.2%
- Image packs in poisoned results
- 44.2%
If you use automated rank tracking tools to monitor keyword volatility, you must now verify data integrity against retention rates to ensure your reports reflect actual rankings rather than Google’s defensive measures.
Google’s shift from refusal to SERP poisoning
Google’s primary mechanism for defending against data collection has shifted from refusing requests to providing poisoned search results. Nozzle defines this poisoning as Google answering scraper requests with a complete page whose results are wrong, where the page itself does not indicate the data is manipulated. A refused request allows a scraper to identify a block and attempt a different route, but a poisoned result is stored as legitimate data by the collecting system.
Google’s strategy targets two primary groups: AI companies using search results for AI grounding—the process of using search results to provide a factual basis for LLM-generated answers—and rank trackers that collect large volumes of SERPs. By providing ‘wrong’ data, Google thwarts the bulk collection of results used to train or ground large language models while simultaneously confounding the accuracy of rank tracking tools.
Retention rates as a signal for poisoned data
Retention rates serve as the primary metric for detecting when Google is manipulating a search result. Nozzle found that normal search results retain 88.5% of the same websites for repeated searches on the same keywords. In contrast, poisoned results retain only 20.7% of the websites from successive searches. The 20.7% retention rate identifies a specific ‘poisoned’ state for rank trackers, indicating that the results are being swapped out intentionally.
Poisoning duration also follows a specific decay pattern according to Nozzle's data.
Poisoning duration also follows a specific decay pattern according to Nozzle’s data. Poisoning lasted for one search result in 80% of cases, for two successive results in 15% of cases, and for three or more successive results in only 5% of cases. This suggests that Google’s poisoning is often a localized, per-request event rather than a persistent state for a specific keyword.
Cost-saving substitutions of AI Overviews and UGC
Google substitutes high-cost search features with lower-cost content when serving poisoned results to scrapers. Because the LLM inference required to generate AI Overviews (AIO) costs more than a standard result, Google reduces their appearance in poisoned results. (AI Overviews (AIO): Google's generative AI feature that provides answers at the top of the SERP.) Nozzle reported that AI Overviews appear 34.9% of the time in poisoned SERPs compared to a 54.2% baseline.
Google replaces these high-cost features with cheaper alternatives like Image Packs and User
Google replaces these high-cost features with cheaper alternatives like Image Packs and User Generated Content (UGC). (User Generated Content (UGC): content originating from social media and forum platforms like Reddit and Quora.) Image packs appear 44.2% of the time in poisoned results versus 23.0% in the baseline, while Forum blocks appear 27.0% of the time in poisoned results versus 20.5% in the baseline. Specific platforms showing increased frequency in these poisoned results include Facebook, Instagram, LinkedIn, Quora, and Reddit.
| Feature | Poisoned Appearance | Baseline Appearance |
|---|---|---|
| AI Overviews | 34.9% | 54.2% |
| People Also Search For | 52.7% | 87.2% |
| Image Packs | 44.2% | 23.0% |
| Forum Blocks | 27.0% | 20.5% |
Request route triggers vs. geographic targeting
Request routes, rather than geographic location, appear to be the primary trigger for Google’s poisoning mechanism. Nozzle observed that local and national search results show nearly identical poisoning rates when other variables are equalized. Specifically, local results for cities and postal codes showed poisoning rates of 8.4% and 10.7%, while national results showed 7.8%.
Google identifies the scraper's signature and responds with a poisoned page accordingly.
When the same phrase was tracked nationally and locally in the same country on the same device, the results were identical at 7.5% and 7.4% across 21,508 pairs. This similarity proves that the poisoning trigger is the technical request route used by the scraper, not the location of the user. Google identifies the scraper’s signature and responds with a poisoned page accordingly.
Kwame’s search audit: a worked example
Kwame runs a growth engineering team and notices that the appearance of AI Overviews in his scraped data has dropped by 30% over the last week. To investigate, Kwame compares his current data against the Nozzle analysis. He identifies that poisoned results show AI Overviews only 34.9% of the time compared to the 54.2% baseline.
Kwame then checks the retention rate of his last 100 searches.
Kwame then checks the retention rate of his last 100 searches. He finds the retention rate has dropped to 20.7%. Kwame concludes that his specific scraping route is being ‘poisoned’ by Google to thwart his AI grounding efforts. If Kwame’s retention rate had remained at the 88.5% baseline, he would have instead concluded that a recent Google algorithm update had reduced the visibility of AI Overviews for his specific keywords.
Applications for identifying poisoned data
SEO practitioners and engineers can use these findings to validate and clean the data used for business decisions. The following applications help distinguish between real ranking shifts and artificial poisoning:
- Identify poisoned data by monitoring retention rates; if a keyword’s retention drops toward 20.7%, the data should be treated as misleading.
- Explain rank volatility to clients; SEO agency owners can use these figures to explain why rankings appear to jump erratically in reports.
- Audit AI grounding data quality; AI researchers can use the 34.9% appearance frequency to determine if their training sets are being intentionally skewed.
- Predict poisoned content types; researchers can expect a higher density of UGC from platforms like Reddit and Quora when a request route is targeted.
Data verification for rank tracking
This analysis reduces the need to assume all ranking volatility is organic. (ranking volatility: frequent and non-organic changes in keyword positions that may be caused by artificial data manipulation.) By establishing the 20.7% retention threshold, practitioners can now verify if a sudden jump or drop in a keyword’s position is a result of Google’s poisoning mechanism. If the retention rate is near the 20.7% mark, the data is poisoned and should be discounted for reporting purposes.
Nozzle did not state which specific Google update triggered this behavior, nor did they confirm if Google has officially acknowledged the poisoning. Further verification would require an independent audit of the same request routes across different geographic regions to see if the 7.5% and 7.4% consistency holds across all industries.
Google SERP Poisoning: what to check, compare and watch
- Scraper request header
- Google may identify and poison results based on the specific scraper request header used by the rank tracker. Rank tracking software developers: configure the scraper request header to use different user agents and proxy rotations.
- Historical ranking data
- Poisoned SERPs introduce artificial volatility that makes it difficult to compare current data against historical ranking data. Rank tracking software developers: compare current rankings against historical ranking data to identify if volatility is caused by poisoning.
- Retention rate metric
- The retention rate of websites in successive searches helps identify if results are being poisoned. Rank tracking software developers: monitor the retention rate metric for specific keywords to detect if results are being poisoned.
- Manual search audit
- If automated rank trackers receive poisoned data, a manual search audit provides more reliable verification. Rank tracking software developers: perform a manual search audit when rank tracking software shows extreme keyword volatility.
- Grounding data source
- AI companies use Google's search results to ground LLM answers, which may be poisoned to thwart scraping. AI data engineers: configure the grounding data source to use alternative search APIs or diverse datasets.
- LLM inference cost
- Google may show fewer AI Overviews in poisoned results because the LLM inference cost is higher. AI data engineers: compare the cost of LLM inference against the cost of displaying standard search results.
Google SERP Poisoning: questions the original report leaves open
- Which update is it, and has Google confirmed it?
- The original report did not say which update it is or if Google confirmed it.
- What does Google say site owners should do?
- The original report did not say what Google says site owners should do.
- How can a site owner check whether they were affected, and against which date range?
- The original report did not say how a site owner can check or what date range to use.
- How long does recovery take, and what should not be done in the meantime?
- The original report did not say how long recovery takes or what not to do.
Key terms
- SERP Poisoning
- The act of Google providing misleading search results to specific requests to confound data collection by trackers or AI companies.
- AI Grounding
- The process of using search results to provide a factual basis for LLM-generated answers.
- AI Overviews (AIO)
- Google’s generative AI feature that provides answers at the top of the SERP. Ranking Volatility
- Frequent and non-organic changes in keyword positions that may be caused by artificial data manipulation.
- User Generated Content (UGC)
- Content originating from social media and forum platforms like Reddit and Quora.
This analysis is based on Search Engine Journal’s Analysis: Google Is Poisoning Search Results For Rank Trackers via @sejournal, @martinibuster.