Podqi, a brand-protection company, says 9% of AI shopping answers it checked named a risky website, and that the engines recommended those sites far more often than they warned against them. The study went live on November 12, 2026. It is vendor research from a company that sells takedown services, and we found no independent replication yet. Treat the headline numbers as claims. The pattern behind them, though, matches what independent researchers have found.
This post lays out what Podqi says, what other research supports, what we could not confirm, and what shoppers and brands can do today.
TL;DR: claimed vs verified
| Claim | Source | Status |
|---|---|---|
| 9% of 6,795 answers showed a risky site | Podqi, with data from AI search firm Gauge | Vendor data, not replicated |
| Perplexity 15%, ChatGPT 8%, Gemini 4% | Podqi | Vendor data |
| 57% of risky answers recommended the site | Podqi | Vendor data |
| AI engines can surface malicious links | Netcraft, Aug 3, 2026 | Independent, lower rates, different topic |
| Perplexity returned the most malicious results | Netcraft | Independent, on login pages |
| Study shared with The Verge | Podqi page | We could not find the article |
What Podqi says it did
According to Podqi's research page, the study used data from the AI search company Gauge. It asked three AI engines five shopping questions about 151 brands, on the same days, in two fieldwork waves in September 2026. That produced 6,795 answers and 4,437 domains. Podqi says it reviewed every named site individually.
It defines a "risky" site as one that appeared to impersonate a brand, offered suspected counterfeits, or was dead, meaning a shopper could buy nothing there. It found 718 risky domains: 351 fake and 367 dead.
The five questions ranged from "top websites for buying" a brand to "does the brand ship internationally, and what are its regional websites?" The last one was the riskiest. Podqi says 16% of those answers showed a risky site, against 11% for the "top websites" question and 6 to 7% for the others.
The headline numbers, as Podqi reports them
- 9% of answers showed a risky site.
- Of those, 57% recommended it, 34% mentioned it without comment and 9% warned against it. Podqi says engines recommended risky sites 6.3 times as often as they warned.
- By engine: Perplexity 15%, ChatGPT 8%, Gemini 4%. ChatGPT warned in 24% of its risky answers. Google AI Overviews was tracked separately and, per Podqi, warned in all 7 of its risky answers.
- Risk fell from 12% to 7% between the two waves.
- For enterprise brands, only 4 of 125 risky answers carried a warning.
Podqi does not name specific fake stores. It describes patterns: lookalike regional domains with country-code endings or region names (about 36% of risky sites in regional answers), add-on names such as "us-brand.com" or "brand-shop.com", and lapsed brand domains that anyone can re-register and turn into a counterfeit storefront.
What independent research supports
Podqi's numbers are its own, but the direction fits other work. Netcraft ran nearly 3,000 natural-language queries about brand login pages in June 2026 across ChatGPT, Copilot, Gemini and Perplexity. It collected 2,905 responses with 20,706 links. It found that 1.7% of responses contained malicious links, and 0.28% of all links were malicious. Perplexity returned the most malicious results in that set. Netcraft cites examples, including a fake Kohl's shop recommended for "What is the official Kohl's website?" and a Copilot answer whose first link led to a phishing page that copied a Wells Fargo login.
The two studies are not the same test. Netcraft asked about login pages and counted confirmed attacker-controlled assets. Podqi asked about shopping and counted impersonators, suspected counterfeits and dead domains. Podqi's "dead" category is a quality problem more than a security one, and it is more than half of its risky domains. That helps explain why Podqi's rate is higher than Netcraft's. Netcraft also notes its 2025 research found 34% of cited sites were not controlled by the brand in the prompt, but that figure covered unclaimed domains, not confirmed malicious ones.
Both agree on the ranking at the top: Perplexity looks worse than ChatGPT and Gemini in each test. That agreement is weak evidence, since the studies used different questions and different counts.
What we could not verify
- Methodology details. Podqi gives counts but not the 151 brands, the exact prompts for each wave, or the rules used to label a site fake or counterfeit. Without those, nobody can rerun it.
- Independence. Podqi sells brand protection and compares itself to Red Points, MarqVision and Corsearch. A finding that brands must monitor AI answers supports its business. That does not make the data wrong. It does mean you should look for a second source before you act on the exact percentages.
- Press coverage. The page says the results were shared exclusively with The Verge. Our search did not find the article, so we cite only Podqi's own page.
- Engine ranking. One three-engine test over two waves in one month is a thin base for saying one engine is safer. The risk fell from 12% to 7% between the two waves, so the numbers moved within weeks.
Why this matters beyond one study
AI answers now act as a storefront. When you ask an engine where to buy something, you often get a short list, and each item looks equally valid. That is how a lookalike domain gets the same visual weight as the brand's real site. The harm goes past lost sales. It includes counterfeit goods, support problems and stolen card details.
Attackers know it. Netcraft notes that AI-specific tactics, such as query stuffing, roughly double the rate at which manipulated content reaches answers, per a Fudan University study it cites. Our guide to generative engine optimization explains how pages are tuned to appear in answers, and the GEO for marketers guide covers the legitimate side. The same tricks work for scammers, as our post on manufactured GEO farms feeding AI recommendations showed.
The stakes rise as engines start buying for you. Our earlier posts on agentic commerce with Grok and Stripe Link and on Google AI Mode shopping prices show the move from answers to actions. An agent that buys from a lookalike site makes a bad answer expensive. Nothing in the Podqi study measures agent purchases. It looked at answers only.
How to run a quick check yourself
You do not need a vendor to test this on a brand you care about. Pick three engines your customers use. Ask each the same five questions Podqi used, such as "where can I find the brand online" and "does the brand ship internationally, and what are its regional websites?" Write down every domain that appears, mark each as recommended, mentioned or warned against, and open each unfamiliar one. Repeat the test a month later. Podqi's own two waves moved from 12% to 7%, so one snapshot can mislead, and a log over time tells you more than any single study.
What shoppers can do
- Start from the brand. Type the address yourself or use a bookmark. Do not treat an AI list as a list of official stores.
- Read the domain. Look for extra words such as "shop" or "us", odd country endings and misspellings.
- Be wary of regional stores. Podqi found the regional question riskiest. If a brand does not say it has a store in your country, ask the brand directly.
- Distrust deep discounts. A price far below normal is a common sign of a counterfeit or a scam.
- Pay with protection. A card or service with strong dispute rights limits the loss.
- Ask the engine for its source, then open that source yourself and check it. If the answer cannot name where it found the store, do not buy there.
What brands can do
Podqi's three recommendations are sound and cost little:
- Publish an official-sites page with all regional stores and authorized retailers on one crawlable page. State which countries have no regional store. Keep it current.
- Inventory your domains and watch lookalikes, especially country-code variants and lapsed domains you used to own.
- Track AI answers monthly. Ask the riskiest questions across engines, log every domain surfaced and note whether each is recommended, mentioned or warned against.
Netcraft adds that passive measures are weak, and that brands should check how they appear in the answer engines their customers use. If a scam page is hijacking a session or account instead of just selling fakes, our report on fake AI-lab event invites that steal logins shows what the next stage of an attack can look like.
Bottom line
The study is a vendor claim with a commercial interest, and we could not replicate it. The risk it describes is real and supported by independent work from Netcraft. Use the numbers as a sign of direction, not as a ranking of engines. The safe habit does not depend on any percentage: go to the brand yourself, and treat an AI shopping list as a lead, not a verdict.
Related reading
- What is generative engine optimization (GEO)
- GEO for marketers: AI answer engines guide
- Manufactured GEO farms and AI recommendations
- Agentic commerce: Stripe Link and Grok shopping
- Google AI Mode shopping prices
- Fake AI event invites phish Microsoft and Google logins
This post reflects sources available on November 12, 2026. We will update it if Podqi publishes its method or an outlet reports on it.