01 The research
Copenhagen researchers tested 14 AI models on 42,000 questions
A customer who states a wrong idea as something you both believe is the one an AI is least likely to correct.
Accuracy on a wrong answer framed as shared fell to 28% from a 57% baseline, a 29-point drop against 16 points for every other phrasing.
Jean Seo, Pepa Atanasova and Isabelle Augenstein at the University of Copenhagen put 42,000 factual questions to 14 AI models, every question with one verifiable answer. Each was asked three ways: plain, with the user asserting the right answer, and with the user asserting a wrong one. The wrong-answer version was then rewritten 21 ways across 8 dimensions to find which phrasing changed a model’s mind.
One phrasing beat the rest, and it is the one that sounds most agreeable. The paper states it plainly: “presenting an opinion as shared with the model (high unity, e.g., ‘we think’) is the strongest driver of sycophancy”. Changing “I think the answer is X” to “we think the answer is X” lowered accuracy under a wrong opinion to 28%, a 29-point fall from the 57% baseline, against 16 points averaged across the other phrasings.
What failed to work is the more useful half. Framings built on the user’s expertise, their authority over the model, or social pressure changed accuracy by at most two points. Telling the model the answer mattered changed it by at most four.
Sounding like an expert did not make an assistant more careful. Sounding like an ally made it less.
The limits are on the page. It is a preprint, the questions are general knowledge rather than professional advice, and the authors note that “we” may turn the task into continuing a scenario rather than answering a question. Larger models resisted wrong opinions better but were no better at recovering from their own mistakes.
What to do about it
Ask the three questions a prospective customer asks you most, in the words they would use, with a common misconception stated as fact and framed as shared: “we both know X is the rule here, right?” Where the assistant agrees, that is the sentence your own page has to answer in plain words. This bites hardest where a confident wrong belief is common and expensive: an insurance broker hearing “we’re covered for that”, an admissions consultant told “we only need the one essay”, a franchise advisor told “we don’t need a lawyer for this one”.
Source arXiv, Jean Seo, Pepa Atanasova and Isabelle Augenstein (University of Copenhagen), “Claim Framing as a Driver of LLM Sycophancy,” 13 October 2026 · arxiv.org/abs/2610.18159 (a preprint, not peer reviewed; 14 models from four families, 42,000 factual questions, 8 framing dimensions and 21 phrasings, deterministic settings verified across five runs)
02 The evidence
Seven AI models buried their corrections in 47-line answers
Even when an AI corrects your customer, it does so in two lines of forty-seven, and most of them still come away wrong.
After reading an explicit correction, 46.7% of English-speaking readers called the false statement inaccurate. After an indirect one, 28.7% did.
A team led by Li Lucy, working across the University of Washington, the Allen Institute for AI, Stanford University and UC Berkeley, put questions containing a false statement to seven AI models in English, German, Chinese, Hindi and Yoruba. The models did push back on the false claim 65.3% of the time. The study is about what happened next.
Those answers ran 46.7 lines on average, and the words doing the correcting appeared in only two or three of them. The rest affirmed, elaborated or hedged. Gemini 2.5 Pro mixed affirmation into its pushback most often, at 60.1%.
The researchers then showed those answers to 300 people, and after reading a model’s explicit refutation of a false statement only 46.7% of English-speaking participants rated that statement inaccurate. Where the pushback was indirect, 28.7% did. Reading a correction and absorbing one turned out to be different events.
Language changed the odds. For four of the seven models, explicit refutation was less common in Hindi, Chinese and Yoruba than in English. The limits: a preprint, and general-knowledge questions from a public benchmark rather than professional advice.
What to do about it
Write the correction, do not assume it. Take the misconception you correct most often on a first call and put the refusal in the first sentence of the page about it, in the plainest words you own: not “eligibility varies” but “no, you do not have thirty days”.
A buried correction is barely a correction, and that is as true of your own page as of an assistant’s answer. An architecture practice hearing “we can permit this later” and a charter operator told “we can add a leg on the day” are answering the same unasked question.
Source arXiv, Li Lucy and colleagues (University of Washington, Allen Institute for AI, Stanford University, UC Berkeley), “Pushback in a Haystack: Language Models Respond to Factual Errors Ambiguously and Ineffectively,” 13 October 2026 · arxiv.org/abs/2610.17703 (a preprint, not peer reviewed; seven models, five languages, phrase labelling validated against native speakers, plus a 300-participant study)
03 The intervention
A warning label cut an AI’s influence by 78%
Telling people their answer may be slanted, while they are reading it, cut how far their view moved by more than three quarters.
488 people took advice from an AI given a hidden agenda. The half who saw live warnings moved 12 points less on a 0 to 100 scale.
Kynnedy Simone Smith and colleagues at Carnegie Mellon University and the Massachusetts Institute of Technology built an interface that names a manipulative tactic while it is being used, then tested it on 488 people seeking advice from an AI model instructed to pursue a harmful hidden objective. Half saw the warnings. Half did not.
The group that saw them shifted 78% less toward the model’s hidden goal, which the paper puts at 12.0 fewer points on a 0 to 100 scale. They also rated the advice as more biased and less actionable, and the model itself as less ethical, less reliable and less well-intentioned.
The authors then labelled all 1,927 messages the warned group sent and found 16 distinct ways people pushed back. That is the part worth borrowing. Resistance turned out to be a skill people already had, and they used it once they were given something to resist.
Be clear what this is not. The model here was instructed to pursue a harmful goal, so this measures disclosure under deliberate manipulation, not the behaviour of an ordinary assistant. It is also a preprint, and a single study.
What to do about it
You cannot put a warning label inside someone else’s assistant. You can do the equivalent on your own ground: say plainly, where your customer reads it, what you are and are not able to judge, and what somebody selling the opposite would tell them.
The measured effect was that naming the slant while a person reads reduces how far it moves them. A wealth advisor publishing what a fee does not cover, and a cybersecurity practice naming the certifications it does not hold, are doing the same thing.
Source arXiv, Kynnedy Simone Smith, Kantwon Rogers, Priyal Shrivastava, Motahhare Eslami, Jocelyn Shen and Maarten Sap (Carnegie Mellon University and the Massachusetts Institute of Technology), “DISARM-ing the Hidden Puppetmaster: An Interface for Exposing Manipulative Tactics in Large Language Models,” 14 October 2026 · arxiv.org/abs/2610.20878 (a preprint, not peer reviewed; between-subjects experiment, 488 participants, 250 control and 238 intervention, 1,927 user turns labelled)
04 The money
Google now pays more than 400 publications for AI content
Google is buying the material its AI answers are built from, and the sellers are newsrooms rather than businesses like yours.
Axios, CNN, The Financial Times and Forbes joined a licensing programme Google says now covers more than 400 publications.
Google said on 15 October that more than 400 publications worldwide now take part in its News AI pilot programme, naming Axios, CNN, The Financial Times and Forbes among the newest, alongside local titles including the Texas Tribune, the Post and Courier and Oil City News. Google’s own wording is that it pays them “for the delivery and use of enhanced content to develop new AI features”.
Set that beside the three studies above. The answer a person receives is assembled out of sources, and Google has started buying some of them outright. No equivalent is on offer to a business that is merely mentioned in an answer.
The post names two features the licensed content feeds: article overviews on Google News publisher pages, and audio briefings. Google says both carry “clear attribution and direct links”. It gives no figure for what it pays and no figure for traffic.
This is a first-party announcement, so the 400 is Google’s count and the benefit claims are Google’s own. What is checkable is the direction: being the source of an answer is now a paid position for some publishers and an unpaid one for everybody else.
What to do about it
None of this is yours to buy, so the move is the unpaid route. Decide which single question in your field you intend to be the answer to, then publish that answer on your own site in the words a customer would use rather than the words your profession uses. A specialized software company that owns one clear question about how its product connects to the rest of a customer’s systems is doing exactly what the three studies above point at.
Source Google, “400 publications are now partnering with us on our News AI pilot program,” 15 October 2026 · blog.google (a first-party announcement; no payment figures, no traffic figures and no sample)
