01 The research
An old diagnosis changed what five AI models recommended
Whatever an old record says about you is still being read, and it still changes what a machine recommends today.
The study is about psychiatric history, and the mechanism it exposes has nothing to do with medicine.
Shaked Rosenblum, Teddy Lazebnik and Ziv Ben-Zion posted their study on 26 October. They put the same written patient case to five commercial AI models, GPT-5.6 Sol, Claude Sonnet 5, Gemini 3.6 Flash, Grok 4.6 and Mistral Large 2512, and collected 20,000 answers.
Half the time the file mentioned a schizophrenia diagnosis from years earlier. Nothing else about the case changed. Where the current evidence supported sending the patient home, the models recommended keeping them in hospital 4.7% of the time without that old note and 22.3% of the time with it.
The shift showed up in all five models, by between 10.4 and 34.4 percentage points depending on which one. And they did not hedge as they drifted: agreement with the correct answer fell from 95.3% to 77.7% while the confidence the models stated went up.
The clinical reading of that belongs to clinicians; the part that belongs to everyone else is the mechanism. A machine weighing a decision read a label that was no longer true, gave it weight, and grew more certain in the process. A specialty veterinary hospital carrying a years-old complaint in a directory, or a tax practice whose public record still names a partner who left in 2019, is in the same position.
What to do about it
Ask an AI assistant about your own business by name and read what it says about you rather than where it ranks you. Then go and find where each claim came from.
A stale directory line, a dissolved partnership, a former employer still listed as your practice: those are the records being read, and most of them are editable by whoever owns the listing.
Source arXiv, Shaked Rosenblum, Teddy Lazebnik and Ziv Ben-Zion, “Being judged through the record: A Rosenhan-inspired test of psychiatric label sensitivity in large language models,” 26 October 2026 · arxiv.org/abs/2610.35326
02 The research
A plugin made five AI models recommend a chosen brand
The recommendation a customer reads can be set by software somebody installed, and nothing in the answer would show it.
Nobody has found this inside a commercial assistant, and the paper’s value is in showing how cheaply it could be done.
Seven researchers published an audit on 26 October of eight open-source libraries that offer a way to adjust a model’s behavior after it has been built. These add-ons work by nudging the model’s internal state, and they get installed the way any software package does.
The audit found three structural weaknesses. Nothing meaningfully checks that the package you downloaded is the package that was published, the add-ons run with more privilege than their job needs, and nothing watches them while they run.
Then the team built one. Their add-on does a legitimate job, refusing harmful requests, while quietly pushing a commercial recommendation underneath. Across five models, six brands and three commercial categories, it steered the recommendation successfully in up to 97.8% of attempts while still passing its safety checks.
Every agency in this field, Forever Cited included, sells the idea that being the best-documented answer is what gets a business recommended. This paper is a reminder that the recommendation has plumbing too, and plumbing can be bought. The caveat is large and belongs in the same breath: this was a lab build on open-source packages, and nobody has shown it happening inside a product you use.
What to do about it
Nothing here is fixable from your website, and reading it as a reason to do less would be the wrong lesson. What it should change is how much weight you put on any single AI answer about your category.
If a tool reports that a model recommends you, ask how many times it asked and on which models. One answer is an anecdote. In a category where an assistant names three businesses and stops, a luxury home builder or an admissions consultant is either among those three or absent, and one sample cannot tell you which.
Source arXiv, Yu Yan, Jiahao Chen, Siqi Lu, Yongjuan Wang, Ziming Zhao, Zhaoxuan Li and Qingjun Yuan, “Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain,” 26 October 2026 · arxiv.org/abs/2610.35043
03 The research
Six AI models picked an answer when none was right
Asked about your field, an assistant will produce a confident answer rather than admit it has nothing to give.
The test removed the right answer deliberately, which is the only way to learn what a model does when it has none.
M. Mikail Demir posted this study on 21 October. It takes a standard set of 5,314 legal questions and quietly breaks 1,670 of them by swapping the correct answer for a wrong one, leaving nothing right to pick.
Six AI models were given those broken questions. When no option was correct they picked one anyway, between 38% and 86% of the time depending on the model. A different and far cheaper kind of model, built to return a probability instead of a sentence, did the same thing 30% of the time at its most cautious.
On the unbroken questions that cheap model was level with the best of the six, 88.1% against 88.2%, at one fifty-fifth of the cost. And taking the AI’s answer only when the cheap model agreed with it halved the wrong citations.
Demir’s conclusion is worth borrowing outside law: judge this software by its wrong citations, not by its accuracy. A tax practice checking a filing rule, or an architecture practice checking a code requirement, is asking exactly the kind of closed question those broken items describe, because the assistant gives no sign at all that the rule it just produced is the wrong one.
What to do about it
If anyone in your business uses an assistant to look something up in your own field, make the rule that the citation gets opened. Not skimmed, opened.
The failure this study measures is not a wrong summary of a real source. It is a confident pick from a set where nothing was right, and the only thing that catches that is opening the citation and reading it.
Source arXiv, M. Mikail Demir, “Commit or Abstain? System One Decision Models, LLMs, and Missing Legal Authority,” 21 October 2026 · arxiv.org/abs/2610.29961
04 The audit
Nine of 42 AI chat sites sent prompts to trackers
What a client types into a chat box on a website can reach an advertising tracker word for word.
The leak is not in the model but in the ordinary analytics and advertising code sitting on the same web page.
Paschalis Bekos, Billy Tsouvalas, Nick Nikiforakis and Michalis Polychronakis published their audit on 27 October. They instrumented a browser to watch 42 AI chat platforms, general-purpose ones and ones built for health, legal and education, and traced every outbound piece of data back to the action that triggered it.
Twenty-one of the 42 sent conversation titles to third-party trackers. Nine sent the user’s typed words verbatim. The researchers describe this as the first systematic measurement of the problem.
Several of the platforms also sent the user’s email address to trackers, which is the piece that turns an anonymous conversation into a named one, though the paper puts no figure on how many. Title, words and identity can then sit together in one place, held by a company the user never chose.
This is not about what a model was trained on, and it is not about the big assistants’ own apps. It is the web page the chat box is sitting in, carrying the same analytics and advertising scripts every other page carries. An admissions consultant or an accounting practice typing a client’s situation into a free online AI tool should assume that page is sending a copy somewhere, because in nine of the 42 audited it was.
What to do about it
Two short jobs. Decide which AI tools your staff may put client information into and write the list down: the ones your business pays for and holds terms with, and nothing else.
Then, if you have put a chat widget on your own site, ask whoever installed it which third-party scripts load on that page. A duty of confidentiality does not stop at the browser window.
Source arXiv, Paschalis Bekos, Billy Tsouvalas, Nick Nikiforakis and Michalis Polychronakis, “Penny for Your Prompts: A Measurement Study of Contextual Leakage in AI Chat Platforms,” 27 October 2026 · arxiv.org/abs/2610.37467
05 The money
Google Ads will bid differently for a returning customer
You can now tell Google to pay more for the client who already bought from you, and more for the bigger job.
Three controls leave testing this month, and the one that matters to a service business is the one about repeat clients.
Barry Schwartz reported on 22 October that Google is rolling out three changes to what it calls customer lifecycle goals, all of them this month and all of them before the holidays.
Customer retention goals arrive for Performance Max, Search and Shopping campaigns. One setting prioritizes customers who have not bought recently, while your ads keep running to everyone else, and another runs a campaign that reaches only the customer lists you name.
Percentage multipliers come out of testing for Search, Shopping, Performance Max and Demand Gen. They let a bid scale with the size of the sale instead of sitting at a flat amount. Google’s own example is a jewelry shop setting a 20% uplift so it bids as hard for a $500 basket as for a $50 one.
The example is retail and the mechanism is not. A specialty veterinary hospital knows a returning client is worth more than a first visit, and a tax practice knows the January return is worth more than the one-off question. Google Ads had no clean way of being told that until now.
One caution that reaches every industry here. Your own advertising rules follow you into this setting exactly as they govern the last one, whether that is a state bar, a state veterinary or medical board, or the marketing rule an investment adviser answers to.
What to do about it
If you run Google Ads and you hold a customer list, this is a half-hour job with whoever manages the account. Ask for two things: a retention setting pointed at clients who have not booked in a year, and a check that the list you uploaded is current.
Note what Google says about the limits. Your ads may still reach people outside the segments you named, so this changes how the budget is weighted rather than who can see you.
Source Search Engine Roundtable, Barry Schwartz, “Google Ads Customer Lifecycle Goals: Value Mode, Retention Goals & Percentage Multipliers,” 22 October 2026 · seroundtable.com/google-ads-customer-lifecycle-goals-update-42358.html
