Israeli experts uncover AI scam but tech giants shirk responsibility

Israeli cybersecurity researchers have uncovered a sophisticated AI scam where hackers contaminate databases to direct consumers to fraudulent call centers. The attack exploits Generative Engine Optimization (GEO) to embed fake phone numbers in search results. Tech giants Google and OpenAI have refused to treat the issue as a security vulnerability, leaving consumers exposed. The researchers detected active attacks targeting 374 well-known brands, including major airlines, banks, and travel platforms, with thousands of new malicious posts appearing daily.

Israeli cybersecurity researchers Dan Lasker, Ariel Simon, and Naor Haziz, veterans of elite Israeli army intelligence units, have uncovered a sophisticated AI scam. Hackers are running automated campaigns that contaminate the databases relied upon by search engines and chatbots like ChatGPT, Gemini, and Google AI Overview. Using advanced marketing techniques known as Generative Engine Optimization (GEO), they embed phone numbers with emojis and special Unicode characters that AI engines interpret as reliable information. Innocent searches for flight cancellations or branch operating hours lead customers to professional-sounding call centers that charge inflated fees. The researchers detected active attacks targeting 374 well-known brands, including Delta Airlines, Lufthansa, United Airlines, Emirates, Qatar Airways, Airbnb, TripAdvisor, Chase, Citi, and Wells Fargo. Thousands of new malicious posts appear daily on government and academic websites. When researchers contacted affected companies, most claimed the issue was outside their responsibility since their internal systems were not breached. Google classified the reports as 'out of scope' for its Vulnerability Reward Program, while OpenAI closed the report claiming the findings were 'not reproducible' despite documented evidence. The researchers describe a global 'security vacuum' where tech giants refuse to acknowledge AI-generated disinformation as a genuine security vulnerability.