Google DeepMind is worried about what happens when millions of agents start to interact

<div data-chronoton-summary="

  • A new class of risk is emerging: As millions of AI agents begin working together online without human oversight, Google DeepMind warns we could hit a tipping point where today’s hypothetical dangers become tomorrow’s real ones.
  • $10 million to build a field from scratch: Google DeepMind has joined forces with Schmidt Sciences, the UK government, and others to fund research into multi-agent safety—a field that, right now, barely exists.
  • Think scams and cyberattacks, but supercharged: The risks aren’t science fiction—they’re turbocharged versions of what already happens online, from prompt injections that turn agents into self-guided malware to coordinated attacks on the digital infrastructure society depends on.
  • The future is arriving faster than expected: Risks that seemed hypothetical just a few years ago are already materializing, and researchers caution that no single lab should be writing the safety rulebook everyone else has to live by.

” data-chronoton-post-id=”1138794″ data-chronoton-expand-collapse=”1″ data-chronoton-analytics-enabled=”1″>

Google DeepMind is funding research into the potential dangers of situations where millions of different AI agents interact with each other online.

According to Rohin Shah, who directs the company’s AGI safety and alignment research, the mass-market arrival of agents that can carry out tasks without human oversight and follow instructions given to them by other agents creates a whole new class of risk.

In an effort to address this, Google DeepMind—which made agent-based tools a centerpiece of Google I/O last month—has teamed up with several other organizations to announce a $10 million funding pot for researchers to study the behavior of multi-agent systems and come up with ways to prevent unsafe scenarios. Joining Google DeepMind are Schmidt Sciences, a philanthropic foundation set up by Eric and Wendy Schmidt; ARIA, the UK government’s moonshot agency; the Cooperative AI foundation, a UK-based nonprofit research outfit; and Google’s charitable arm, Google.org.

I asked Shah and James Fox, who leads the Science of Trustworthy AI program at Schmidt Sciences, what they hope to achieve with that $10 million. It’s no small sum, but it’s dwarfed by the budgets commanded by Google DeepMind’s own research teams.

The aim is to kick-start research outside tech companies, says Shah: “The strength of academia is that it can look really quite far into the future and do the kind of work that isn’t top of mind at industry labs.”

“The main issue is that there just isn’t really a field of research for multi-agent safety yet,” he adds. “And we would like there to be.”

The concern is that as more and more AI agents get deployed and begin working together, we could hit a tipping point where imagined scenarios become real. “We see this with humanity, too,” says Shah. “Our institutions can accomplish things that no individual human can.”

Shah thinks we have a few more months to go before agents are deployed throughout the economy in numbers that make potential risks a real concern. He wants to get ahead of that moment.

Risky business

What risks are we talking about, exactly? The possibilities that Shah and Fox have in mind mostly boil down to supercharged versions of bad things that happen on the internet already: scams, prompt injections (where an AI agent is fed malicious instructions, turning it into a self-guiding piece of malware), other forms of cyberattack. We look at what humans do now and ask what the agent version of that would be, says Shah.  

“We’ve got this digital commons that is integral to how society works, and you really want to ensure that this doesn’t descend into just absolute anarchy,” says Fox.

(I asked Shah if they were considering any worst-case scenarios more on the doomer end of the spectrum, such as widespread economic collapse. “Certainly not if we’re talking by the end of the year,” he said. That’s only six months away! He laughed. “Okay, a while after that.”)

Shah and Fox both think that the only way to understand what might happen when large numbers of multi-agent systems interact with each other is to run realistic simulations. They want researchers to drop AI agents into sandboxes and study what they do.

You can’t predict what’s going to happen by studying single agents, or even small groups of agents, in isolation. You can’t assume that AI agents underpinned by LLMs will always act rationally, says Fox. And the complexity comes from having huge numbers of interactions at once.

Some researchers, including a team at Google DeepMind, have argued that artificial general intelligence (if possible at all) could come not from a single super-smart model but from a kind of agent hive mind, where the capabilities of the whole add up to more than the sum of its parts.  

Lack of trust

Google DeepMind is not the only top AI firm warning about the risks of the technology it is building. A couple of weeks ago, Anthropic published guidelines for deploying AI agents based on an approach to cybersecurity known as zero trust, which starts with the assumption that a computer system is vulnerable, an agent is an attacker, and a breach will happen.

Refael Angel, cofounder and CTO of Akeyless, a cybersecurity firm based in Tel Aviv, agrees that understanding the new risks introduced by agent-based systems is crucial.  

Every approach to security in the past has assumed that the machine in question was software written by a human, doing fixed things on fixed paths, says Angel: “An agent breaks all of those assumptions. It reasons, it improvises, and it can be hijacked by a single sentence buried in a document it was asked to read.”

Angel welcomes this new funding. “No single lab should author the safety standards everyone else has to trust,” he says. But he cautions that safety researchers can overlook boring problems that are already here in favor of more exotic hypothetical ones.

And yet, Fox notes, risks that were hypothetical a few years ago are now very real: “The future’s come more quickly than perhaps expected.”

The Download: soccer’s data renaissance and China’s big nuclear plans

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology.

Inside soccer’s data renaissance

Imagine tuning in to the opening kickoff of a World Cup match and seeing a player intentionally kick the ball out of bounds. You may question the logic of surrendering possession seconds into a game. If you were Jesse Davis, though, you’d know that this play could be a prime setup to score.

Davis is a professor of computer science at KU Leuven in Belgium and head of its Sports Analytics Lab, which has been at the vanguard of a data awakening in soccer.

Using AI and data analytics, his team has uncovered hidden tactical patterns and challenged long-held assumptions about how the game should be played. Many of the insights hitting soccer pitches today trace back to the lab’s work.

Read the full story on how computer scientists are changing the world’s most popular sport.

—Andrew Zaleski

This story is from the next edition of our magazine. Subscribe now to get a copy when it lands! 

Why China is betting on big nuclear reactors

In China, large reactors are coming together at a stunning pace. The country has nearly doubled its nuclear fleet since 2016, reaching nearly 60 gigawatts of total power capacity. Construction started on six new reactors in 2025, and two more have begun in 2026.

It’s incredibly difficult to build the massive projects that dominate the nuclear industry today. Up-front investment can run well into the billions, and designs are complex. Yet China is moving ahead rapidly. By 2030, the country is on course to overtake both the US and the EU in installed nuclear capacity.

Find out why bigger might be better when it comes to nuclear power.

—Casey Crownhart

This story is from The Spark, our weekly newsletter giving you the inside track on all things climate. Sign upto receive it in your inbox every Wednesday.

The must-reads

I’ve combed the internet to find you today’s most fun/important/scary/fascinating stories about technology.

1 Autonomous drones may have killed soldiers for the first time
A drone-maker said Russian troops were killed in a test. (New Scientist $)
+ The US has used a sea drone to rescue a helicopter’s crew. (NYT $)
+ Europe has a drone-filled vision for war. (MIT Technology Review)

2 Solar power has finally surpassed coal in US electricity generation
It’s the leading source of new power. (Guardian)
+ Meanwhile, Trump is increasing coal investments. (BBC)
+ The US is in a power struggle over coal. (MIT Technology Review)

3 Russia’s FSB has taken control of the country’s internet
The KGB successor now determines access. (Financial Times $)
+ Rage over the restrictions is boiling over. (NYT $)

4 OpenAI says China is fomenting dissent over AI on ChatGPT
It claims to have foundinfluence operations on the bot. (Reuters $)
+ The propaganda also targeted data centers and tariffs. (Politico $)

5 SpaceX’s listing price is expected to be revealed today
It could lead to the biggest IPO ever. (NPR)
+ And turn 4,400 employees into millionaires. (NYT $)

6 EPA scientists say they’re pushed to downplay risks of household products
They’re under pressure to alter reviews of chemicals in products. (CNN)

7 Anthropic has walked back a policy that “sabotaged” research
It would have limited Claude’s ability to develop competing AI models. (Wired $)

8 Congress wants in on the data center backlash
Members are jumping on the fervor with new policy plans. (Axios)
+ Should we be moving data centers to space? (MIT Technology Review)

9 Your search results are getting sloptimized
Companies are gaming the chatbot internet. (Atlantic $)

10 Scientists have discovered that humans prefer to walk anticlockwise
It’s a discovery that could improve crowd and evacuation management. (Guardian)

Quote of the day

“We’re the extracted and exploited colony of what is going to be one of the most highly valued entities in the world. People are going to die because of this pollution.” 

—Justin Pearson, who represents portions of Memphis in the Tennessee House of Representatives, tells Wired why his constituents are angry about the SpaceX IPO.

One More Thing

Space is all yours—for a hefty price

Space tourism is now officially a thing. But does it represent a future in which the average person could book a celestial flight and bask in the splendor of Earth from above? Or is this just another way for the ultrawealthy to flash their cash while simultaneously ignoring and exacerbating our existential problems down on the ground? 

For now, such flights remain ridiculously far beyond the financial reach of most people. They also pose risks to both the passengers and the planet. But proponents of private spaceflight argue that it provides great opportunities for science and a sense of transcendence.

Dive into the space tourism debate.

—Margaret O’Mara

We can still have nice things

A place for comfort, fun and distraction to brighten up your day. (Got any ideas? Drop me a line or skeet ’em at me.)

+ A rare antelope species was rediscovered in a remote Kenyan forest.
+ This ingenious camping trailer pops up into a fully heated off-road bathroom.
+ Iconic internet memes are now safely preserved in the British Film Institute’s moving image archive.
+ NASA’s experimental aircraft has successfully broken the sound barrier in a big win for supersonic flight.

AI Turns Ecommerce Design into Reality

Ecommerce websites consist of themes and templates made with HTML, CSS, and JavaScript. Executives typically define the requirements, designers create the layouts, and developers code or implement the components.

AI is upending that process.

Upwards of 97% of developers now use AI to plan software implementations and generate code. Increasingly, generative AI is also impacting website design.

Ecommerce design concepts

AI is upending the traditional process of designing and coding ecommerce sites.

Website Theming

The conventional website workflow exists because people needed a way to convert ideas into HTML, CSS, JavaScript, Liquid (used for Shopify), React (a JavaScript framework), or another programming or templating language.

The workflow goes (went) something like this.

  • An ecommerce owner or manager has an idea for a visual theme and communicates the concept to a designer.
  • The designer translates the concept into a visual for developers.
  • Developers code and assemble the designers’ theme, template, or function.

That handoff from business to design to development creates expense and delay. Once designed, a custom site or component might require weeks of back-and-forth revisions to code responsive layouts, test the interactions, and tweak the visuals.

AI Translates

AI tools can expedite the workflow, translating concepts into designs and designs into functional website themes.

Shopify Magic already helps merchants create product descriptions and other content, and is steadily expanding AI-powered capabilities across the platform. Netlify offers AI-assisted development workflows for creating boilerplate websites. Tools such as GitHub Copilot, Vercel’s v0, Bolt.new, and Replit generate functioning interfaces or application code from natural-language prompts.

The common thread is that executives can describe what they want, and AI generates it.

A merchant might ask for “a minimalist outdoor apparel store with oversized photography, earthy colors, and a streamlined checkout,” and AI produces the initial implementation. The better the instructions, the better the outcome.

AI Infrastructure

Figma’s acquisition of Payload CMS last year exemplifies this trend.

The companies have not revealed their long-term roadmap, yet the combination suggests a future in which a designer or even a business owner uses Figma’s AI to create a website design and convert it into a production website.

Instead of creating mockups for developers, designers could generate interfaces that translate to working websites. The design becomes the site.

The implications go beyond convenience. When AI can automatically translate layouts into production-ready code, the traditional separation between design and development is gone.

All of this is happening now. Many companies are vibe coding their own tools, components, and sites.

Benefits

Enterprise-level businesses will likely have the most AI-enabled theming capabilities, but the entire ecommerce industry benefits in at least four ways.

  • Stakeholder control. The traditional workflow is inefficient. With AI-aided design and deployment, a stakeholder has direct control.
  • Speed. AI-generated web themes are much faster to create. The design and development phases are much shorter.
  • Cost. Human labor comprises most of the cost of ecommerce development. With relatively fewer hours designing and coding layouts, the overall cost drops significantly.
  • Better decisions. Fewer hours also frees up stakeholders to test, iterate, and decide.

Hence the traditional handoff between stakeholders, designers, and developers will continue to shrink.

For merchants, the savings in time and money could be a game-changer.

AI Bots Keep Overloading Servers. Should Website Owners Keep Paying? via @sejournal, @martinibuster

AI bots are increasingly affecting website performance, analytics, infrastructure costs, and content visibility. New research and infrastructure data suggest that the challenge is no longer simply scraping, but managing how automated traffic interacts with websites and the businesses that depend on them.

Scraping Is The Least Of The Problems

Many discussions among SEOs and site owners center on AI bots scraping. It’s a valid concern that AI systems harvest content for LLM training with virtually zero attribution when the content is remixed into an AI answer.

  • Site owners worry about intellectual property.
  • Search marketers worry about how AI systems use their content.

But infrastructure teams are increasingly seeing different and equally consequential problems.

The Banality Of Bots Getting Lost And Scraping Things

The issue is increasingly that many bots are creating unnecessary load, consuming resources, and sometimes becoming trapped in inefficient loops.

According to the report, one recurring pattern involved Meta’s meta-externalagent crawler following URL variations for days on end before mitigation systems caught on.

This kind of behavior is not malicious. It is automation operating with poor coding practices or insufficient guardrails.

Cloudflare’s David Belson illustrated the banality of lost bots draining resources:

“There’s the person who didn’t know what the hell they were doing yesterday, but vibe coded a bot today and let it loose. They’re not even bothering to check robots.txt.”

That observation captures an important reality. Today’s infrastructure problems now derive from poorly designed automation operating at scale.

Bots Are Consuming Resources Without Creating Value

The consequence of this behavior is that websites spend resources serving automated traffic that may provide little or no business value in return.

This is a big problem for ecommerce sites. Unlike requests for static pages, cart-related requests typically bypass caching and require the server to use resources. Depending on the site’s architecture, those requests can trigger PHP execution, database queries, session handling, and other resource-intensive processes.

Seen in this light, scraping is the least of a website’s problems. A crawler that repeatedly triggers expensive application logic and consumes server resources degrades performance for legitimate visitors.

The economic impact should not be ignored. According to the report, roughly 80% of AI crawling activity is associated with model training, eclipsing search or user-driven crawls.

For many businesses, the question is: Is there value returned by that traffic to justify the resources being consumed?

Businesses Are Trapped Between Visibility And Cost

If the solution were simply blocking bots, the problem would be solved. Unfortunately, many automated systems consuming resources are also connected to discoverability and visibility.

Some bots help search engines discover content. Some may contribute to AI citations and visibility in AI-generated answers. Others may simply consume content and resources without producing directly measurable business benefits.

Businesses are being asked to absorb the costs of automated traffic while simultaneously evaluating whether that traffic contributes enough visibility to justify those costs.

The Question Now: Which Bots Are Worth Paying For?

The report argues that site owners should ask this question:

Which bots, on which parts of my site, under what conditions?

Bot management affects visibility, infrastructure costs, and site performance. The goal is aligning automated traffic with business objectives.

Traffic Numbers May Already Be Affected

Automated traffic also affects website analytics. According to the report, AI bot traffic increased 300% over the past year. By the end of 2025, approximately one in every 31 visits on TollBit’s network originated from an AI bot.

As automated traffic grows, traffic volume alone becomes a less reliable indicator of audience growth.

A site can show rising visit counts while experiencing no corresponding increase in customers, subscribers, conversions, or revenue. In some cases, the additional traffic may be automated.

The report argues that the most meaningful signals come from metrics tied to actual business outcomes, including branded search demand, direct traffic, engagement quality, and revenue.

As automated systems account for a larger share of overall traffic, raw visit counts become less useful as a standalone measure of success.

Solutions And Mitigation Tactics

The report advocates a deliberate approach to bot management.

The first step is visibility.

Before making changes, site owners should understand what automated traffic is actually doing. The goal is not identifying every individual bot but identifying patterns such as repeated requests, loops, and activity focused on dynamic endpoints.

The second step is protecting high-cost site functions.

Cart URLs, checkout paths, internal search pages, filtered product pages, and parameter-heavy URLs often consume significantly more resources than standard content pages. Restricting unnecessary crawler access to those areas can reduce waste without affecting important content.

The report also recommends separating search crawlers from AI crawlers.

Not every bot provides the same value. Search crawlers contribute directly to discoverability and deserve broader access than AI training crawlers or unknown scrapers.

A single policy applied to every automated system can no longer be justified as the ecosystem grows more complex. That’s why the report advocates targeted changes rather than broad restrictions.

The goal is not eliminating automated traffic. The goal is managing it in a way that supports business objectives while reducing unnecessary costs. One way is to decide which bots can access specific parts of a site and under what circumstances.

Takeaways

Bot traffic is no longer primarily a scraping issue. The data suggests it has become an infrastructure, visibility, analytics, and business-management issue.

The biggest challenge is that many bots are consuming resources, triggering expensive functionality, inflating traffic metrics, and creating costs that site owners must absorb.

Bot management is not about blocking the most bots. It’s about managing bots according to what the site is optimizing for by distinguishing between valuable and wasteful automated traffic.

Read Kinsta’s data-backed report:

The AI & bot traffic reality check

Featured Image by Shutterstock/DC Studio

5 AI Search Shifts Marketers Can’t Afford to Miss Before Q3 via @sejournal, @hethr_campbell

Impressions are up. Clicks are down.

Rankings haven’t moved.

If that describes your last Search Console export, you don’t have a content problem or a technical problem. You have a SERP that no longer sends you the clicks your positions used to earn, and the playbook you’re running was built for one that did.

Five shifts are restructuring how search visibility works right now. Each one builds on the one before it, and each one comes with work you can start before Q3 planning is finalized.

1. Don’t Treat Organic CTR Decline as a Seasonal Dip

AI Overviews and zero-click results are absorbing clicks on queries where your positions are stable. If you’re reporting blended CTR, one metric is combining two different losses: clicks lost to AI Overviews on queries you still rank for, and clicks lost to competitors who now outrank you. Each requires a different fix.

How to Find Out If AI Overviews or Competitors Are Taking Your Clicks

The diagnosis starts in data you already have. Segmented correctly, your query data splits into two groups with very different jobs: one shows you where competitors are winning clicks you can fight to take back, and the other shows you where the SERP itself changed and your effort belongs somewhere new. Knowing which group is driving your decline determines what your team spends Q3 fixing.

In our upcoming SEJ Live, 6 experts will spend 3 hours helping you identify, repair, and expand your AI Search strategy for Q3.

2. Optimize for Being Surfaced, Not Just Ranked

Position one on SERPs no longer guarantees visibility.

LLMs and AI Overviews extract passages, synthesize across sources, and cite, which means your pages need to be extraction-ready, not just rank-ready.

A page AI systems can lift a clear answer from becomes a citation asset, and a page that ranks well but can’t be extracted stays invisible at the answer layer no matter its position.

Knowing which group your best pages fall into is the first thing to settle before rewriting anything, and it starts with understanding what “discoverable content” actually means when AI is doing the surfacing.

3. Build Presence on the Platforms Feeding AI Models

Reddit and LinkedIn have become citation sources, not just social channels.

In studies of AI outputs, Reddit threads keep showing up. So do LinkedIn posts from practitioners whose job titles, posting history, and engagement signal verifiable expertise.

Both now influence which brands get cited, and you don’t control either property.

Start by finding out whether the sources AI answers trust in your category mention your brand, your competitors, or neither.

4. Plan Paid & Organic in the Same Room

AI Mode ads are rolling out. ChatGPT ad testing is in flux. The same AI surfaces now blend organic citations and paid placements, and if you’re only watching the organic half, you’re missing where paid placements are taking visibility you thought your rankings secured.

5. Report Citations Alongside Clicks

Search Console clicks no longer measure your full search visibility. Being cited in AI answers is a second visibility metric that captures brand exposure clicks never record, and your leadership report almost certainly doesn’t include it yet.

Where to Take This Work Next

Shifts 3, 4, and 5 are exactly what SEJ Live covers on June 17: a free, virtual event with three sessions built to connect AI search, social, paid, and attribution into one strategy.

  • A fireside chat answering the AI visibility and traffic questions you submit
  • Reddit and LinkedIn experts on earning the citation signals AI models trust
  • A multi-channel session on building attribution you can actually act on

You shape these sessions: when you register, you can submit the question you most need answered, whether that’s AI citation tracking, AI Overview displacement, PPC overlap, or content extractability. The sharpest questions shape the conversation on stage, and yours could be one of them.

Register free for SEJ Live, June 17, 12–3 PM ET. Recordings included, so you can share every session with your team after the event.

YouTube Brings In-App Sharing & Messaging To The U.S. via @sejournal, @MattGSouthern

YouTube is expanding its in-app video sharing and messaging feature to the U.S., U.K., Brazil, Singapore, and several U.S. territories, per the availability list on its help page.

The rollout, announced in a blog post, lets users 18 and older share videos and chat about them without leaving the YouTube app.

It brings back a version of messaging YouTube removed in 2019, when it told users to share videos through other apps. Sharing a YouTube video has usually meant sending a link through a messaging app ever since. This update brings some of that activity back onto the platform.

How The Feature Works

Messaging on YouTube runs on invites. You send an invite link from the new messaging icon, and the recipient can allow or decline. Per YouTube’s help documentation, invite links expire after seven days.

Once connected, people can share long-form videos, Shorts, and live streams, then chat about them in the app. Messages can be unsent, and users can block or report each other.

The feature requires being signed in to a YouTube channel with a verified age of 18 or older. It’s currently unavailable for Brand Accounts.

YouTube’s Community Guidelines apply to shared content and messages, and its systems may scan messages for policy violations. The help page notes that message content won’t be used for ad targeting.

Messaging Returns After A 2019 Removal

YouTube launched its original Messages feature in 2017 and removed it in September 2019. At the time, the company said it would “focus on improving public conversations” through comments, posts, and stories.

The revived version began as an experiment in Ireland and Poland in November 2025, which YouTube described as a “top feature request.” It expanded to 31 European countries in March before this week’s announcement.

Why This Matters

Shares are an engagement action you can see in YouTube Analytics, but the conversations around them have happened in other apps. In-app messaging moves some of that activity to where you publish.

YouTube hasn’t said whether shares sent through messaging will show up differently in analytics or influence recommendations. The Brand Account restriction also means you can’t use the feature from a brand channel for now.

Looking Ahead

YouTube says it plans to expand the feature further but hasn’t named the next markets or given a timeline.

The rollout appears staged. YouTube’s blog post says the feature is “starting to expand,” while the help page says video sharing and messaging is available only in select countries and is not available to everyone at this time.

AI Search Runs On Two Memory Systems. The Platforms Don’t Use Them The Same Way via @sejournal, @DuaneForrester

Ask the same question about your brand on four different AI engines, and you will likely get four different answers back. One answer is current and cites your latest page. Another describes a positioning you retired 18 months ago and cites nothing at all. A third routes the whole thing through a competitor’s comparison post. Same brand, same question, four representations, and the gaps between them are not random noise you can wave away as a model quirk. They are structural, and once you can see the structure, you can plan around it.

I made the case in “When the Training Data Cutoff Becomes a Ranking Factor” that your brand now lives in two different memory systems at once. One is parametric memory, the knowledge baked into a model during training and then frozen until the next training run. The other is retrieval, the content pulled in fresh at the moment someone asks. That piece was about what the distinction means for timing. This one is about the part I deliberately left for its own treatment, which is that the engines do not lean on those two memories the same way, and that difference is what actually shapes where your brand shows up and how it reads when it gets there.

Every Engine Has A Memory Posture

Let me give the thing a name, because naming it makes it easier to plan against. An LLM’s memory posture is its default lean: When you ask it something, does it reach for live retrieval, or does it answer from what it already holds in its parameters? The platforms sort into two broad camps, and which camp an engine sits in determines almost everything about how your content reaches a user through that surface.

On one side are the engines that retrieve on nearly every query. Perplexity is the clearest case; it runs a live web search on essentially every question and shows its sources by design rather than as an exception. Google’s AI Overviews and AI Mode also lean on retrieval, but with a wrinkle worth understanding: Those surfaces are served by the same crawler that powers organic results, drawing from the core Search index rather than from Gemini’s parametric memory. The token Google offers to control model training, Google-Extended, has no effect on what appears in Search or its AI features. So on the always-retrieve engines, your visibility is a retrieval question first and a parametric question barely at all.

On the other side are the engines that decide per query. ChatGPT, Claude, Microsoft Copilot, and the Gemini app all make a judgment call on each question: answer from parameters, or go fetch. Claude’s web search runs as a tool the model chooses to invoke when it decides the question needs it. Copilot grounds against the web only when it is enabled and the prompt benefits, and when an administrator switches web grounding off, it falls back to the model’s internal training entirely. That last detail is the bridge back to “Stop Treating AI Visibility as One Problem,” where retrieval was one of three layers a team has to govern. Here is that layer from the inside: on a model-decided engine, whether retrieval even happens can be a setting in someone’s admin console, not a property of your content.

And the posture is not even stable inside a single engine. One clickstream study of ChatGPT found the share of sessions that triggered a web search swinging between roughly 15 and 66% across the study window, moving as the underlying models were updated. The same question you asked in March might answer from memory, and in April, reach for the live web, with nothing changed on your end. Posture is a moving target, which is exactly why you have to measure it rather than assume it.

Retrieval Stopped Being A Single Step

Even when an engine does retrieve, getting retrieved is no longer one clean action, and this is where a lot of older optimization instinct quietly breaks. The single-pass model, where a system embeds your query, grabs the top handful of matching pages, and generates, has given way to agentic retrieval that plans and runs many sub-queries before it answers. One question the user typed becomes a fan of questions the system asks on their behalf, anywhere from a couple to dozens. You are no longer optimizing only for the question in the search box. You are optimizing for the invisible questions the engine generates to satisfy it.

There is a second-order problem layered on top, and it is worth stating plainly even if it deserves its own piece someday. Being pulled into the context is not the same as being used well. The research that first documented how models use long context unevenly is most of a decade old now, and current models have largely solved the simple version, finding one fact buried in a long document. What stays unreliable is the harder thing: integrating several scattered signals into one coherent picture. Your brand is never a single fact. Its representation depends on the engine gathering your pages, your reviews, and third-party coverage that sit in different places in the retrieved material, then assembling them correctly. That assembly step is still lossy, which means “we are getting retrieved” and “we are being represented accurately” can both be measured, and can disagree.

Timing Became A Lever You Did Not Used To Have

Parametric memory introduces a variable that simply did not exist in the traditional SEO era: the training window. You cannot edit what a model already holds in its parameters. Publishing a correction today does nothing to the version of your brand encoded in a model that finished training last summer. The only thing that changes parametric memory is a new training run, which means the useful question is not how to fix what the model already believes, but what the model will learn about you the next time it trains, and whether the right version of your story is the one it will find.

This is less hopeless than it sounds, for two reasons. First, parametric memory is not a black box you have no influence over. Models learn the version of a fact that shows up consistently and corroborated across many sources, so the work is to make the accurate version of your story the redundant one, the version that is hard to miss when the crawlers come through. That is a long game measured in model generations rather than page edits, but it is a game you can play. Second, the training cadence is no longer one slow annual event. The major providers now ship frequent point releases, each carrying its own cutoff, so the parametric layer refreshes in steps you can actually aim at rather than a single far-off horizon. Some of the inconsistencies teams keep flagging, the same engine giving different answers on different days, is this in action: one day the question pulled from parameters, the next it triggered retrieval, and the two layers were not telling the same story.

A Workflow To Find Out Where You Actually Stand

You can run this by hand, today, with no special tooling, which is rather the point. If you understand the two memories, you can read what any engine is doing with your brand. Call it the memory posture audit.

  • Pick the queries that pay. Not your brand name on its own, but the questions a buyer actually asks where you need to appear: the category questions, the comparisons, the problem-framed ones. A handful, tied to revenue.
  • Run each one across a deliberate spread. At least one always-retrieve engine and at least two model-decided ones, using identical wording every time, so the only variable is the platform.
  • Read the posture, not just the answer. Citations are the tell. Live cited sources mean retrieval fired; a confident answer with no sources came from parametric memory. On the model-decided engines, ask each question twice, once in plain evergreen phrasing and once with a recency cue like “latest” or “current,” and watch whether the second version flips the engine into retrieval. That flip is the posture revealing itself.
  • Sort what is wrong by which memory produced it. Stale facts with no citation point to a parametric problem. Absent entirely, or represented through a competitor’s page on an engine that clearly did retrieve, points to a retrieval-selection problem. In the output, the two can look almost identical. They are not the same defect.
  • Fix the layer that is actually broken, because the fixes do not transfer:
    • A parametric problem cannot be edited directly. You influence the next training window by getting consistent, corroborated, crawlable content in place now, so the correct version of your story is the one that gets learned.
    • A retrieval problem is findability and selection work: answer the fan-out sub-questions directly, structure your pages for clean extraction, and strengthen corroboration across third-party sources so your version is the one that gets assembled into the answer.
  • Date it and repeat. Posture is not stable, so a one-time audit is a snapshot, not a finding. Put it on a cadence, quarterly at the least.

Which Leaves The Question Worth Considering

Most teams optimizing for AI visibility are working hard on one memory system and treating the other as though it does not exist, usually without ever having decided which one they picked. The discipline this asks for is small to describe and uncomfortable to practice: For each engine that matters to you, know its posture, know which memory is carrying your brand there, and know whether that is the layer you would have chosen on purpose.

That is the memory-layer question, and most teams cannot answer it yet, which is itself the diagnosis. It also exposes why a single AI visibility score is a category error. A number that collapses parametric standing and retrieval standing into one figure is averaging two things that move independently, reward different work, and fail in different ways. You cannot manage what you have flattened. The literacy that matters now is the ability to hold the two layers apart in your head, and to ask, every time, which one you are actually looking at.

If you have run a version of this across your own brand, I would like to hear what you found, especially where a platform surprised you. Leave a comment or reach out.

And if you want the longer argument for why visibility, trust, and machine-readability are becoming the same problem, that is the subject of my book, The Machine Layer.

More Resources:


This post was originally published on Duane Forrester Decodes.


Featured Image: Summit Art Creations/Shutterstock

Google Is Building An Audience Loyalty Ecosystem

I’m far from Google’s biggest fan. In fact, I have a well-earned reputation as an outspoken critic. But I believe my criticism comes from a position of fairness and balance.

When Google does something right, I want to highlight that as well. This is one such occasion. I see what Google is trying to do for news and publishing, and I’m almost perfectly aligned with their vision.

Amidst the AI upheaval and the barrage of announcements coming out of Google these last few years, you may have missed a common thread among many of the search giant’s new features.

Let’s take a look at some of the shiny new toys that Google is giving to publishers, and see if you can spot the trend:

1. Preferred Sources

First announced in August 2025 and rolled out globally in April 2026, this mechanism enables users to pick specific publishers that they want to see more of in Google’s results.

When a user then performs a Google search that shows a Top Stories box, and their preferred publisher has a story relevant to this query, the user will see that publisher’s story in the Top Stories box.

Since May 2026, Preferred Sources has also spread across AI Overviews and AI Mode, providing more visibility to a user’s preferred publishers in all search surfaces.

Button that publishers can add to their site that says. ‘Add as a preferred source on Google.’
Preferred source CTA (Image Credit: Barry Adams)

2. Search Profiles

The newest toy in the arsenal, Search Profiles are dedicated profile pages for publishers and creators with sizable followings (more than 100,000 followers).

Through this profile page, a user can choose to follow the publisher or creator, and is more likely to see their content in the Discover feed.

Follow on Google call to action on search profile pages
Follow on Google CTA (Image Credit: Barry Adams)

3. Subscription Linking

With Subscription Linking, a publisher can link their subscription data to their subscribers’ Google accounts.

When linked, a user will see their subscription content more prominently in Google’s search results and the Discover feed in a “From your subscriptions” panel.

This increased visibility of a user’s subscribed content also applies to AI Overviews and AI Mode.

Subscription linking dialog box
Subscription linking CTA (Image Credit: Barry Adams)

Not Traffic. Loyalty

The common theme among these new features is obvious: Google is building an audience loyalty ecosystem.

There is no denying the hard truth: Google traffic is harder to come by. While Google Zero is a myth, there is most definitely less traffic to go around.

However, despite the publishing industry’s convulsions, AI didn’t cause the traffic collapse – it merely accelerated it.

Google has been clear about its intent for the better part of two decades. You should not chase clicks. You should not write content purely to acquire traffic. You should not produce cheap journalism to get a few more high-bounce, low-engagement visits on your website.

Over the past 20 years, Google has been replacing that type of cheap content in its search results with direct answers. Sport match information is directly on Google’s SERPs. Basic facts are provided in featured snippets and knowledge panels. Address details are shown in map packs.

None of this is new. The writing has been on the wall for all this time. Generative AI merely enabled Google to put the final nail in churnalism’s coffin. AI summaries make churnalism obsolete.

These new features Google gives us aren’t meant to replace that traffic. None of these toys will give us back those cheap visits.

What they will provide is greater visibility to an already loyal audience. Google is opening up its ecosystem for publishers that already have highly engaged readers.

Features For Engaged Readers

Think about the kind of user that will set you as a preferred source in Top Stories. The kind of user that will click that Follow button on your search profile. The kind of user that will subscribe to your site.

Those are not cheap visits. Those aren’t high-bounce clicks.

Those are users that buy into your product, that want to read your journalism, that want to consume what you publish.

These features are meant for users that are already sold on your output. They already understand and appreciate your value as a publisher.

The path forward is clearer than ever. Don’t chase clicks – chase loyalty. Don’t produce cheap churnalism – produce high-quality, original content. Don’t use traffic as your core KPI – focus on engagement and retention.

Do all that, and Google is your ally. It’ll help you retain your loyal readers. It’ll give you the tools to maximize engagement and retention. It’ll show your content to your subscribers everywhere it can.

There is no confusion at all about what publishers need to do to survive, and even thrive, in the era of AI. If you are still unsure, you’re either wilfully ignorant or so entrenched in your ‘traffic-first’ mentality that you probably deserve to lose.

Original Sin

None of this devalues the “original sin,” as AG Sulzberger stated it in his excellent speech at the 2026 WAN-IFRA World News Media Congress. AI is built on the greatest theft humankind has ever seen.

But we cannot put the genie back in its bottle. AI is here to stay. We’re going to have to live with it.

And the survival strategy for a post-AI publishing world has never been more obvious.

More Resources:


This post was originally published on SEO For Google News.


Featured Image: hmorena/Shutterstock

UpdraftPlus WordPress Vulnerability Puts 3 Million Sites At Risk via @sejournal, @martinibuster

A vulnerability in the UpdraftPlus: WP Backup & Migration Plugin affects more than 3 million WordPress websites and enables unauthenticated attackers to execute commands as an administrator. The flaw makes it possible for attackers to upload and activate malicious plugins, which can ultimately lead to remote code execution.

UpdraftPlus Backup & Migration Plugin

The UpdraftPlus Backup & Migration Plugin is one of the most widely used WordPress backup solutions. Website owners use it to create backups, restore websites after problems, and migrate WordPress sites between hosts, servers, and domains.

The plugin is actively installed on more than 3 million websites and supports backup storage on a wide range of cloud and remote services.

Vulnerable To Unauthenticated Attackers

What makes this vulnerability especially concerning is that it does not require an attacker to log in and no WordPress account is needed to exploit the flaw.  However, not every site with UpdraftPlus installed is necessarily exploitable in the same way. The plugin changelog describes the affected condition as sites with an active Migrator key or UpdraftCentral key.

According to the advisory, all versions up to and including version 1.26.4 are affected. The vulnerability exists in the UpdraftPlus_Remote_Communications_V2::wp_loaded function.

The issue is classified as an authentication bypass vulnerability. Authentication bypass is a security flaw that enables completely unauthenticated attackers to skip the plugin’s identity-verification and login credential checks. This gives them the ability to take administrator-level actions without ever needing to log in, provide a password, or provide valid website credentials.

Authentication controls are supposed to verify that commands received by the plugin are legitimate and come from an authorized source. In this case, weaknesses in the way remote communications messages are validated make it possible to bypass those protections.

How The Security Failure Works

The vulnerability stems from insufficient validation of the remote communications message format.

According to Wordfence:

“The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function.

This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key.

This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.”

The plugin is supposed to verify that remote commands are authentic before executing them. The validation process can be bypassed, allowing attackers to create forged commands that the plugin treats as legitimate administrator instructions. Because those commands run with administrator-level privileges, attackers can perform actions that would normally require full administrative access.

Also, this part of Wordfence’s description needs explaining:

“This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key.”

What it means is that the plugin has a critical coding flaw where a failed encryption check defaults to an open door instead of locking the system down.

Remote Code Execution

In this specific context, Remote Code Execution means an attacker can run malicious code on the website’s hosting server over the internet.

The vulnerability enables an unauthenticated attacker to bypass authentication and forge remote commands that run as the connected administrator.

That means an attacker can send a command to upload and activate a malicious WordPress plugin, essentially creating a backdoor into the site.

Once the malicious plugin is installed and activated, the server can execute the code inside that plugin. That can enable actions such as stealing data, adding malware, changing site files, or taking control of the WordPress installation.

RCE turns the authentication bypass into a site takeover risk. Once an attacker can execute arbitrary code on the server, they can control the affected website. This can potentially lead to malware infections, website defacement, unauthorized administrator access, theft of sensitive information, or the use of the compromised site for further attacks

The advisory specifically notes that attackers can upload and activate malicious plugins, so this is a very real outcome.

Evidence Of Active Attacks

Wordfence reported that it blocked 8,172 attacks targeting this vulnerability during a 24-hour period.

While attack activity alone does not indicate how many sites were successfully compromised, it shows that attackers are actively attempting to exploit the flaw.

Patch Available

UpdraftPlus has made a patch available for users to update their installations and secure their websites.

The plugin changelog for version 1.26.5 describes the issue as:

“Previous versions contained a defect allowing sites with an active Migrator key (paid versions only) or UpdraftCentral key (free and paid versions) to have unauthorised operations carried out on them. All users should update immediately.”

Users of the UpdraftPlus: WP Backup & Migration Plugin should update to version 1.26.5 or a newer version as soon as possible.

Featured Image by Shutterstock/Toey Andante

Anthropic Asks The AI Industry To Hit The Brakes – Here’s What It Means For SEO & Search Marketers via @sejournal, @gregjarboe

On June 4, 2026, Anthropic published one of the most consequential blog posts in the short history of artificial intelligence. The piece, titled “When AI Builds Itself” and co-authored by Anthropic co-founder Jack Clark and Marina Favaro, lead at the Anthropic Institute, carried a striking message: AI is advancing so fast that humans risk losing meaningful control over it, and the world needs a coordinated mechanism to slow or temporarily pause frontier AI development.

The post went viral. LinkedIn News Editor Andrew Barker covered it and gathered perspectives from more than 20 business and technology leaders. Reactions ranged from alarm to admiration to outright skepticism. For SEO professionals, digital marketers, entrepreneurs, and content creators, the more useful question is: what does this actually change for the tools and practices you use every day?

What Anthropic Is Actually Saying (And What It Isn’t)

Anthropic’s proposal is conditional and collaborative, not a unilateral halt. The company is not shutting down Claude tomorrow. What Clark and Favaro argued is that the industry needs the option to pause, a “brake pedal,” as Clark said in media appearances, including BBC Newsnight and CNN, if and when certain thresholds are crossed.

The specific threshold they’re worried about is recursive self-improvement: the point at which an AI system can autonomously design and train its own successor without meaningful human intervention. They are clear that this hasn’t happened yet and isn’t inevitable, but warn it “could come sooner than most institutions are prepared for.”

The supporting data is sobering. As of May 2026, more than 80% of code merged into Anthropic’s own codebase was written by Claude, not by human engineers. Engineers are shipping roughly eight times as much code per day as they were in 2024. External benchmarks corroborate the trend: METR, an AI evaluation organization, found that the length of tasks AI can handle autonomously has been doubling roughly every seven months.

Any credible pause would require multiple well-resourced AI labs across multiple countries to stop under the same verifiable conditions. Anthropic compared the verification challenge to Cold War nuclear arms control, and acknowledged it would be harder.

The Skeptic’s Case (And Why It Deserves To Be Heard)

LinkedIn and the broader commentariat quickly raised a pointed question: Why is a company on the verge of a trillion-dollar IPO calling for the industry to slow down?

“The Wall Street Journal” noted that critics view Anthropic’s warnings as a marketing play. Analysts at SiliconAngle called the post “more about strategic marketing than any concrete initiative.” Holger Mueller of Constellation Research asked whether Anthropic is simply trying to freeze the competitive landscape at a moment when it already leads in enterprise AI, noting that a pause would lock out new entrants and cement incumbents’ advantages.

The timing is genuinely awkward. Days before this post, Anthropic confidentially filed IPO paperwork that could value it at nearly $1 trillion. Earlier in 2026, it walked back a key commitment in its own Responsible Scaling Policy, the pledge to avoid training more capable models without proven safety measures in place, citing competitive pressure.

These contradictions don’t necessarily invalidate the substance of the warning. The International AI Safety Report 2026, a multi-institution publication, separately documented that leading AI models now perform at or above human expert level across a growing range of professional evaluations, independent of anything Anthropic said. The underlying trajectory is real, whatever the motivation behind the announcement.

What A Slowdown Would Actually Mean For SEO Professionals

A coordinated pause in frontier AI development would reshape the digital marketing landscape in several concrete ways.

The Pace Of AI-Powered Search Evolution Would Slow

Google’s AI Mode, expected to become the default search experience, is built on frontier model capabilities. AI Overviews already appear in roughly 25% of Google searches. The pace at which SEO best practices must evolve is a direct function of how fast the underlying models improve and a pause would buy time. For practitioners who have barely kept pace with the last 18 months of change, that is a relief. For early adopters who have built competitive advantages on the latest tools, it narrows the gap between leaders and followers.

Content Quality Signals Would Become More Durable

One of the most destabilizing aspects of the current moment for SEO professionals is that the rules keep changing faster than strategies can be validated. If model development slowed, the content quality signals that Google and other search engines currently value would remain stable for longer. Practitioners who have invested in genuine expertise, original research, and authoritative human-authored content would benefit most from that stability.

The Human Expertise Premium Would Reassert Itself

If AI capability growth slows, the differentiating factor in content quality shifts back toward human judgment, domain expertise, and creative originality. The content that currently stands out in AI-saturated search results, original reporting, expert analysis, and genuine first-person experience, becomes even more valuable.

3 Things You Should Do Right Now

Whether a coordinated AI pause happens or not, and global coordination among OpenAI, Google DeepMind, xAI, Meta, and Chinese frontier labs is, to put it charitably, uncertain, the underlying dynamics Anthropic describes are real and accelerating. Here’s what to do.

  1. Build your authority on things AI cannot replicate. Original data, proprietary research, genuine expertise, and first-person experience hold their value regardless of what AI generates. Google’s systems are increasingly calibrated to surface content that demonstrates real expertise and lived experience. That is the response to an AI content flood, and it is not going away.
  2. Understand the tools you’re using at a deeper level. Whether you use Claude, ChatGPT, Gemini, or AI-powered SEO tools, understand not just what they do but how they work and where their limitations lie. Practitioners who fare best through continued AI advancement are those who use these tools as force multipliers for their own judgment, not replacements for it.
  3. Watch the regulatory and policy environment more closely. Anthropic’s proposal is the most prominent recent signal that AI governance is becoming a real business factor, not just an abstract policy debate. The outcome will affect how AI-generated content is treated in search rankings, how AI tools are regulated, and what disclosures will be required. The organizations setting these rules will shape the environment your work exists in.

The Bottom Line

Jack Clark’s framing on BBC Newsnight and CNN that the industry has an accelerator but no brake, is accurate regardless of who says it. Anthropic’s history is genuinely complicated: founded by researchers who left OpenAI over safety concerns, then forced by competitive pressure to walk back its own safety commitments, and now calling for a global pause while preparing for a near-trillion-dollar IPO. That tension is real. It does not make the warning wrong.

For our community, the lesson is not to dismiss the warning because of the messenger’s imperfections. It is to think clearly about what we know, what we don’t know, and how to build practices resilient to a future that is arriving faster than anyone expected. The AI industry has a gas pedal. Whether it gets a brake is one of the most consequential policy questions of our time, and the answer will shape the landscape every SEO professional, marketer, and content creator operates in for years to come.

More Resources:


Featured Image: Master1305/Shutterstock