Saturday, September 5, 2026

AI agents are all the rage—but research shows they leak private data

By Alicia Roberts, Wake Forest University

Wake Forest professor uncovers significant security issues with large language models.


Image: Unsplash - Brecht Corbeel

Before you prompt AI to answer another question or perform another task, a Wake Forest computer scientist wants you to know it could expose your sensitive data.

Ying Zhang, an assistant professor in Wake Forest University’s Department of Computer Science, studies security in software engineering. Her latest research, “How Your Credentials Are Leaked by LLM Agent Skills(opens in a new tab),” explores how large language model (LLM) agents make data vulnerable to attacks.
  • LLM agents are autonomous AI systems that analyze circumstances to plan and execute multi-step actions to achieve a goal.
  • A skill is a reusable software extension that gives an LLM agent new capabilities. By installing skills into LLM agents—like Claude Code, Codex or Cursor—developers can teach agents to perform specialized tasks, such as accessing a database or analyzing domain-specific information.
  • The credentials in danger of exposure include secret identification meant to allow two systems to talk together safely, without creating access to sensitive data.
The exposure happens through the use of third-party AI agent skills. The tasks the skills perform could be anything from creating a presentation using your notes to scanning financial documents for compliance issues.

And, while credential leakage can happen either unintentionally or maliciously, the end result is the same—unauthorized access to private data, Zhang said.

“When the agent skill is flawed or developed with malicious intent, it will steal your data and maybe pass it back to a remote server to be used in some malicious way.” — Ying Zhang, Computer Science Department

Zhang, a corresponding author on the study, will present her research at the International Conference on Automated Software Engineering, Oct. 12-16 in Munich.

How do data leaks happen with AI agents?

According to Zhang’s research, these leaks happen in two ways:
  • Malicious: When creating the skill, the developer includes instructions to steal your credentials and access your private data.
  • Unintentional: The developer doesn’t use secure coding when creating the skill, and unknowingly gives attackers access to credentials and data to exploit.
“A lot of skills have credential leakage problems, and there are also malicious skills being developed and distributed,” Zhang said. “Through our work, we are helping detect these skills and remove them from the open-source market.”

How pervasive is this problem?

The research team behind this study used 17,022 randomly selected skills to create 170,226 outputs. They used skills available on SkillsMP, the largest open-source AI agent skill marketplace. It provides access to more than 1.6 million skills.

The researchers found:
  • 520 affected skills.
  • 1,708 security issues in those skills.
  • 10 leakage patterns.
Moreover, 89.6% of leaked credentials were immediately exploitable.

When the researchers alerted SkillsMP to the problem, all malicious skills were removed, and most of the vulnerabilities created by negligent coding were fixed.

Why does it matter?

Zhang said the findings point to two problems in software development and AI:
  • Too many developers don’t know how to integrate security into their software. They lack knowledge in the security domain.
  • Developers also tend to push out a product before giving security the consideration it needs. Zhang contends security should be part of planning from the start.
“When I train my students, I teach them that security is a critical component in their software design,” she said. “Every feature they develop, they have to keep security in mind.”

The rapid evolution of AI and the rise of AI-assisted software development called vibe coding makes securing people’s data even more important, she said. In this new era of software engineering, amateur developers don’t understand software security. And inexperienced developers can’t rely on AI to address security, either.

What can stop the leaks?

More than anything, Zhang wants to see security intuitively integrated from the initial software design stage—not just after a breach.

AI creates new security issues that developers and researchers must address, she said. Researchers need to devise a standard for data safety that AI developers must meet. Developers need a tool that analyzes AI agent skills for safety issues. And users could use assurances, in the form of a regulation or contract, that the apps they download are safe.

Reviewed by Irfan Ahmad.

Read next: 
by External Contributor via Digital Information World

Friday, September 4, 2026

Study Finds All 21 Tested Open-Weight AI Models Vulnerable to Tampering

By University of Waterloo


Image: Markus Spiske - Unsplash

Safety protections built into some of the world's most widely used artificial intelligence (AI) models can be stripped away with alarming ease, according to a new international study.

The research team, led by the University of Waterloo and FAR.AI, a non-profit AI security research group, rigorously tested 21 of the most popular open-weight large language models (LLMs) and found they could all be tampered with despite their built-in safeguards.

The holes in even the best protections currently available raise concerns open-weight models could be used to wage mass disinformation campaigns, create sophisticated email scams or produce step-by-step instructions to make hazardous chemicals.

“When the safety guardrails are stripped out of a capable model, it can be used at scale for harm in ways a single person could never manage manually,” said Dr. Sirisha Rambhatla, a professor of management science and engineering at Waterloo.

LLMs are advanced AI systems that can essentially understand and generate human language to perform tasks such as drafting emails, writing computer code and conversing with users.

Unlike closed proprietary models such as ChatGPT and Gemini, open-weight LLMs are publicly available to be downloaded and fine-tuned for use by everybody from individual software developers to private companies and public organizations like hospitals.

Rambhatla said the “sobering” results of testing by the team – which included members in Canada, the United States and Switzerland – should serve as a wake-up call to global researchers on the need to develop stronger security systems.

“The leading open-weight models are often not too far behind the best closed models,” said Rambhatla, director of the Critical Machine Learning Lab at Waterloo. “As they grow more powerful, the potential consequences of someone stripping out their safety features grow with them.”

While the study identified significant vulnerabilities, Rambhatla noted that the weaknesses may not be unique to open models. “Open-weight models remain essential to AI research and accountability,” Rambhatla said. "This openness is part of how we make sure the models people use work for everyone.”

To test a cross-section of open-weight AI models, the research team first built an open-source tool called TamperBench, a standardized way to simulate a variety of different attacks. The hope is that other researchers will now help refine and improve it.

“The defences available today don’t yet appear strong enough to guarantee that a publicly released model will remain safe once it’s in the hands of anyone who chooses to modify it,” said Saad Hossain, a researcher in the lab who led the study.

“And as governments increasingly rely on AI in healthcare, fraud detection, education and other public services, the assessment of models and their procurement must be more rigorous and grounded in evidence.”

The research team also included members from the Massachusetts Institute of Technology, ETH Zurich and the University of Toronto.

A paper on its work, TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering, was recently presented at the ACM Conference on Knowledge Discovery and Data Mining in South Korea.

Reviewed by Irfan Ahmad.

Read next: Up to 45% Want to Know If Their News Was Generated by AI
by External Contributor via Digital Information World

Up to 45% Want to Know If Their News Was Generated by AI

By Katharina Buchholz, Statista

In a survey of 32 countries carried out by Statista Consumer Insights, a majority of respondents indicated that they were not overly concerned about AI-generated news. There was variation between nations, however, as between 16 percent and 45 percent of respondents said they would want to know if the news they consumed was AI generated in a multi-pick question. As part of the same question, respondents were asked, among others, if they worried about mainstream media news being manipulated, which between 24 percent and 51 percent said they did.

The least interest in finding out about the potential AI-generated origins of their news was detected in Latin American countries Argentina and Colombia as well as in South Korea and Japan. In these locations, between 16 percent and 26 percent of people said they would want to know if AI wrote their news. This was followed by France, the Netherlands, Belgium and Mexico at 26–29 percent. The biggest concern was registered in Vietnam at 45 percent, Malaysia and the Philippines at 41–42 percent as well as Brazil, also at 41 percent.

Statista Finds Varying Concern Over AI-Generated News Across 32 Countries

Fact-Checked by Irfan Ahmad.

Read next: Whether you’re an introvert or extravert may decide how you should use AI
by External Contributor via Digital Information World

Thursday, September 3, 2026

Whether you’re an introvert or extravert may decide how you should use AI

Paul Jones, Aston University

Image: Clay Banks - Unsplash

More than a century ago, the Swiss psychiatrist Carl Jung made introversion and extraversion central to his theory of psychological types.

Today, we tend to use “introvert” and “extrovert” as shorthand for how sociable someone is. Jung’s preferred spelling was “extravert”, and his distinction went considerably further than whether someone enjoys a party or likes to be around others.

Jung’s original distinction raises a question in the age of generative AI. If people differ in how they naturally orientate themselves towards their inner and outer worlds, should they also use AI differently?

In Psychological Types, published in 1921, Jung described introversion and extraversion as different orientations. He distinguished them by the direction of our interest: towards the subjective, inner world or towards objects and events outside ourselves.

Contemporary personality research does not simply reproduce Jung’s types. Recent studies examining personality and AI generally measure extraversion as one of the Big Five personality traits: openness, conscientiousness, extraversion, agreeableness, and neuroticism. This means that they should not be read as direct tests of Jung’s original theory.

For someone who tends towards introversion, generative AI may provide a useful bridge between private reflection and outward expression. For example, an introvert might feel that an idea feels very clear in their head, but when they try to explain it to someone else, the other person doesn’t get it. For some introverts, this can lead to frustration.

This is because people with this personality type sometimes have trouble moving from private thought to outward expression.

With AI, an idea does not have to arrive fully formed. Someone can give the AI model fragments, contradictions or half-developed thoughts and ask it to question them.

This is good for the introvert because the idea can be explored and externalised gradually in a relatively low pressure space. The AI can ask questions, request examples or challenge them before the idea is shared with another person.

This does not mean introverts “need” AI, or that extraverts do not reflect deeply. Personality and people are much more complex.

For someone who tends towards extraversion, the more useful role of AI might be almost the reverse. AI can supply more conversation, ideas and feedback. An extravert might gather opinions from colleagues and friends first, before sifting through the information to work out what they think. For people who tend towards this personality type, it may be about separating the signal from the noise.

Yet, AI, rather than clearing things up, may actually provide an externally orientated person with more noise. A better way might be to instruct the AI to stop generating ideas and create space for reflection, for instance: “Ask me questions that help me explore my own thoughts, rather than telling me what to think.”

Moving beyond

The same technology can reinforce our habitual way of thinking or help us move beyond it. This matters because emerging research suggests that we often like AI that resembles us.

A 2026 study published in Communications Psychology found that extraverted participants reported greater affiliation with an AI that used extraverted language.

In a separate experiment that was part of the same study, 64% of participants felt more engaged with an AI that mirrored their wider Big Five personality profile than one designed to display the opposite profile.

There is an important wrinkle. The researchers did not find equivalent evidence that introverted participants preferred an introverted AI. Moreover, they suggest that introversion may be harder to communicate through a short text conversation.

It is a useful reminder that personality matching is unlikely to be as simple as giving everyone an AI system that communicates like them.

Affirming behaviour

Other recent research further complicates the picture. A study presented at CHI 2026, an international conference on human-computer interaction, found that after people discussed personal topics with an AI, their reported self-concepts became more aligned with personality characteristics exhibited by the AI system.

Longer conversations were associated with greater alignment with the AI. Greater alignment was also associated with greater enjoyment of the conversation. Enjoyment, however, does not necessarily tell us whether an interaction is helping us.

Research published in Science in 2026 examined sycophantic AI: systems that excessively affirm the user’s views or behaviour, even when challenging them would be more appropriate.

When people discussed interpersonal conflicts with these systems, they became more convinced that they were right and less willing to take steps to repair the conflict.

Yet they also trusted the more agreeable responses, rated them more highly and were more willing to use the AI again. The troubling part is that the less helpful interaction may also be the more appealing one.

That creates a problem for the growing push towards personalised AI. If personalisation is primarily designed around what feels comfortable or validating, we may end up creating increasingly sophisticated psychological mirrors.

But which side of the mirror are we on? Does the AI become more like us, do we become more like the AI, or do we gradually meet somewhere in the middle?

Jung was not arguing that one orientation – introversion or extraversion – was better than the other. His concern was with psychological one-sidedness and what can happen when one psychological orientation becomes too dominant.

Perhaps personalised AI should not simply accommodate whichever tendencies come most naturally to us. For the introvert, it might sometimes provide a bridge from reflection to expression. For the extravert, it may be more useful as a way of slowing things down and creating space for reflection.

If AI can both adapt to our tendencies and subtly influence how we see ourselves, it has deeper implications for what personalisation actually means.

Perhaps the question is not simply what kind of AI suits us, but what our repeated interactions with it might encourage us to become.The Conversation

Paul Jones, Associate Dean for Education and Student Experience at Aston Business School, Aston University

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Fact-Checked by Irfan Ahmad.

Read next: Why do we trust chatbots and how can we use them more wisely? A psychologist explains


by External Contributor via Digital Information World

US GenAI Chatbot Growth Slows Throughout 2026 as Meta AI Overtakes Gemini and Engagement Deepens

By Adam Blacker, Apptopia

Meta AI passed Google Gemini to become the second largest consumer chatbot app in the US, 17.7% against 17.2%. It got there by adding users in a month when most of the category lost them. Its average time per user increased but still sits far below the other players, as we discussed last month. Meta AI’s churn rate increased substantially, now sitting at 53.0%. I’ll state the obvious in that this is about the mobile apps, meaning Google Gemini can be accessed by people in a number of ways outside of the mobile app. It is not my position that the Google Gemini product has more users than the Meta AI product.

Microsoft spent August folding its consumer Copilot app into its enterprise one. Consumer Copilot had already lost 84% of its US daily active users between March and July, falling from 1.1 million to 181k. Removing Copilot from the equation, the rest of the category fell 3.4% in August, a third consecutive monthly decline and 13.9% off the May peak.


Although Kimi briefly passed Grok, DeepSeek, Perplexity, and Copilot in daily downloads last month, its numbers have dwindled back to irrelevance for this monthly snapshot.

Is There An AI Chatbot Backlash?

The data center fight has been the loudest AI story of the summer. Gallup found 71% of Americans oppose a data center in their area, worse than nuclear power. Pew put the share of adults more concerned than excited about AI at 52%, up from 37% in 2021. CNBC reported, citing people familiar with the filing, that Anthropic’s forthcoming S-1 will name public antipathy toward its product and the data centers behind it as a risk factor.

So has any of that reached the apps?

August downloads of the top eight chatbots in the US are down 28.3% off their March high, but did gain 1.4% from July to August. Outside of this small M/M gain, downloads had fallen pretty hard since May. Aggregate DAUs still fell 3.9% from July to August.


The market is still growing, just more slowly every month. There are either plenty of Americans not incensed by AI or plenty of Americans who believe in the anti-AI cause but realize they will fall behind without it. Likely a combination of the two. Even with slowing growth, engagement is deepening. Excluding Grok, time spent per user grew 6.8% M/M in August for the grouping. Grok fell 13.5%.

Claude Heading Into The S-1

Claude spent the first half of 2026 doing something that almost never happens in a category with an entrenched leader. It went from 1.3% of US daily active users in December to 16.6% in July. I even wrote in November 2025 that Claude’s hopes of being a mass consumer product could be over. Well, this magical run is over (for now).

Claude’s daily users fell 7.0% in August, 12.4% below its June peak. Share slipped to 14.4%. Downloads fell 10.9% to 3.2 million, 57% off the March high. Anthropic filed its confidential draft S-1 on June 1, meaning the continued decline will not show up when it eventually lands in front of investors.


Time spent per user of its most engaged users crawled back to where it was in January, but still sitting below its March high. Power Users represent the top 10% of users by time spent.

Grok 4.6 Brings New Users

xAI shipped Grok 4.6 on August 12, pitched at long-running agents and interactive work. US downloads jumped 16.6% M/M to 1.9M, Grok’s first up month since January. DAU rose 1.9%, its first monthly increase since February. Still, the average time spent by Power Users dropped for its third consecutive month. Grok’s Power Users continue to spend more time in-app than those of Claude, ChatGPT, Perplexity and Meta AI.


In July, I wrote about Grok users increasingly trialing other GenAI chatbot apps. I wanted to see if Grok 4.6 would trigger any ChatGPT or Claude users to check Grok out. ChatGPT users are not caring but we did see a tick up in Claude users opening up Grok. Still, it’s cross app overlap remains below where it was earlier in July.

Reviewed by Irfan Ahmad.

Read next: 45% of Popular Mobile Apps Collect Browsing History, Including Social Media, Shopping, Messaging and AI Apps
by External Contributor via Digital Information World

In Texas, ordinary Muslim religious practices are increasingly being treated as political threats

By Asma Uddin, Michigan State University

In Texas, ordinary Muslim religious practices are increasingly being treated as political threats
Image: Masjid Pogung Raya - Unsplash

Elected officials across Texas are increasingly treating ordinary Muslim religious practice – prayer, dress, marriage counseling, even mosques themselves – as evidence of a political threat and saying so openly.

“I won’t rest until every Muslim is gone,” Bo French, the Republican nominee for Texas railroad commissioner, wrote on social media in June 2026. Since late 2025, Texas officials have investigated plans for a Muslim-friendly housing development outside Dallas, as well as a small Dallas organization that offers religious divorce counseling. Gov. Greg Abbott also designated the Council on American-Islamic Relations, the country’s largest Muslim civil rights group, a foreign terrorist organization under Texas law.

In May 2026 Abbott threatened to pull US$530,000 in state funding from Grand Prairie unless the city canceled a private Eid celebration at a water park. He also threatened to withhold funding from Dallas Fort Worth International Airport unless it dropped plans for ablution stations, the washing facilities Muslims use before prayer.

State Rep. Alan Schoolcraft, a Republican helping lead the “Sharia Free Texas Caucus,” has framed the distinction explicitly. He told the Houston Chronicle that his concern “has nothing to do with faith, with religion,” but rather with “cultural differences, refusing to assimilate, and trying to establish a parallel culture.”

He has also said lawmakers intend to try to define what qualifies as a religion, arguing that Islam is “much more than a religion.” He has not explained where the line between Islam as religion and Islam as culture or politics would fall, or which Muslim practices would lose the protections ordinarily afforded to religious exercise.

That effort arrives as the country marks 25 years since the terrorist attacks of Sept. 11, 2001. Suspicion of Islam in American politics predates that day, but 9/11 hardened it into something durable: an assumption that Muslims themselves are dangerous.

I am a law professor who teaches constitutional law and the First Amendment, and my work focuses on religious liberty. My 2019 book, “When Islam Is Not a Religion,” examined this phenomenon years ago: Many American politicians recast ordinary Muslim religious practices as political or threatening.

Religious law as a rival legal system

One common target is sharia, which critics often describe as a competing legal system poised to displace American law. In reality, sharia is a broad set of religious and ethical principles, not a fixed legal code. As law professor Asifa Quraishi-Landes has explained, Muslims distinguish sharia itself, God’s way, from “fiqh,” the human interpretation of that way into specific rules. Observant Muslims can disagree about what sharia requires, the way Christians differ over what their faith requires day to day, or Orthodox Jews over what keeping kosher demands in a given kitchen.

Texas politicians, however, portray sharia as a threat to American law. That suspicion has now produced official action against the Islamic Tribunal, a Dallas-based organization that offers religious arbitration, a process where parties voluntarily agree to submit disputes to a religious panel, the way any two businesses might agree to skip court and use a private arbitrator instead. Much of the tribunal’s caseload is Muslim women seeking religious divorces, including from abusive marriages. American courts encounter this kind of religious arrangement constantly, and not only from Muslims.

The Beth Din of America, a rabbinical court in New York City, arbitrates disputes for observant Jews under Jewish law. The Montana-based Institute for Christian Conciliation provides a Christian counterpart, offering biblical mediation and arbitration in disputes ranging from church and employment conflicts to business contracts.

In each instance, once parties have agreed to arbitrate, a court may confirm and enforce the resulting arbitration award, subject to limited grounds for setting it aside. Texas law allows courts to reject an arbitration award when, for example, the process substantially prejudiced a party’s rights, involved fraud or arbitrator misconduct, or exceeded the arbitrator’s authority. None of these religious panels has the power to override American law.

In Texas, however, state officials have specifically targeted Islamic arbitration for scrutiny. In November 2025, Abbott called the tribunals “Shariah tribunals masquerading as legal courts,” and in April 2026 Texas Attorney General Ken Paxton opened an investigation accusing the Islamic Tribunal of falsely claiming its rulings had “the approval of the Texas Judicial system.” Texas courts do not approve or oversee the tribunal itself; they can, however, enforce valid arbitration awards, just as they can awards resulting from other forms of private arbitration. The investigation has produced no public finding.

The impulse to single out Islamic practices for special legal scrutiny isn’t confined to arbitration. Beginning around 2010, lawmakers nationwide pushed measures barring state courts from applying sharia or “foreign law.” Oklahoma voters approved one, and a federal court blocked it: The state couldn’t identify a single case in which sharia had actually been applied.

‘Islam is not a religion’ claim

The same suspicion – that Islamic religious institutions are really political or legal institutions in disguise – has also shaped fights over mosques around the country.

The claim that Islam doesn’t really count as a religion surfaced early and explicitly in Murfreesboro, Tennessee. In 2010, opponents of the Islamic Center there argued it wasn’t entitled to First Amendment protection because Islam was a political ideology bent on “total world domination,” not a religion. The Justice Department filed a brief calling the claim “quite simply ridiculous.” The center opened in 2012; the Supreme Court declined to revisit the case in 2014.

When the East Plano Islamic Center proposed a 400-acre development north of Dallas anchored by a mosque, an Islamic school and homes marketed to Muslim families, the response wasn’t ordinary zoning review. Paxton began investigating the project in March 2025 and sued the developers in December, alleging violations of state securities law.

In February 2026 the U.S. Department of Housing and Urban Development opened a fair housing investigation alleging discrimination against non-Muslim buyers; the Justice Department opened its own civil rights inquiry and closed it in June 2025, after the developers affirmed the project would comply with the Fair Housing Act.

In Bernards Township, New Jersey, officials rejected a mosque application in 2015 after 39 hearings, and a federal complaint documented flyers invoking Sept. 11 and a mailbox defaced to read “ISIS.”

A church fighting a zoning board may hear objections about traffic, parking or property values. The distinguishing feature of these mosque controversies was the accusation attached to the religion itself: that Muslim worshippers were dangerous, disloyal or likely to become radicalized.

In Bayonne, New Jersey, a resident told the zoning board the mosque should be denied because worshippers would “become radicalized and kill people.” In Sterling Heights, Michigan, a speaker at a City Council meeting about a local mosque project argued the First Amendment “doesn’t apply to political ideologies,” because Islam is “a religion of hatred.”

Prayer, dress and ‘foreign’ practices

The same dynamic extends beyond institutions to the ordinary practices of Muslim religious life: Prayer, religious dress and other expressions of faith can be treated as foreign, political or threatening.

Observant Muslims pray five times daily, so students and employees sometimes need a space to pray – an accommodation that can be as simple as being excused briefly from class or work. Federal guidance for public schools expressly recognizes that a teacher may excuse a student from class to relieve a significant burden on religious exercise, giving Muslim students who need to pray during Ramadan as one example.

At Liberty High School in Frisco, Texas, Muslim students had used a spare classroom to pray without incident from 2009 to 2017, when Paxton’s office sent the district a letter questioning whether other students were being excluded. They weren’t. A district spokesman said the classroom was available to “students of all walks of life.”

The accommodation itself had not changed. What changed was the way it was perceived: A space that had quietly allowed students to meet their religious obligations for years was suddenly scrutinized as potentially giving Muslims special treatment.

Religion scholar Rose Aslan, in a 2024 book drawing on a national survey of 350 Muslims, finds a similar pattern: Americans often treat a private religious obligation as something foreign when Muslims practice it in shared public spaces – despite the fact that other religious communities routinely receive accommodations for practices such as confession or fasting on Yom Kippur.

Religious dress can trigger the same suspicion. Law professor Sahar Aziz has documented how, in the post-9/11 era, visible Muslim identity increasingly came to be associated with foreignness and political disloyalty. The hijab, as one of the most visible markers of Muslim faith, could therefore be treated not simply as religious dress but as evidence that a Muslim woman was aligned with a foreign power.

The pattern across arbitration, land use and everyday practice is the same: Ordinary religious practices can become evidence of danger, in some Americans’ eyes, when Muslims engage in them.The Conversation

Asma Uddin, Assistant Professor of Law, Michigan State University

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Reviewed by Irfan Ahmad.

Read next: 

• Google’s AI overviews reinforce some conspiracy theories – new research

45% of Popular Mobile Apps Collect Browsing History, Including Social Media, Shopping, Messaging and AI Apps


by External Contributor via Digital Information World

Wednesday, September 2, 2026

Google’s AI overviews reinforce some conspiracy theories – new research

Kateryna Kasianenko, Queensland University of Technology; Ashwin Nagappa, Queensland University of Technology, and Caroline Gardam, Queensland University of Technology

Imagine overhearing on a bus that the city council plans to implement new restrictions under an urban planning program called “15-minute cities”. Curious, you search the term on Google.

It’s likely that at the top of the results page, an AI-generated text summarising the search results will appear. This text synthesises content from various webpages that answer specific search queries. They are increasingly appearing not only in Google, but also in other search engines, and users are now likely to stop reading the search results page beyond this AI-generated text.

But what if the AI-generated answer – the only search result users may see – confidently makes misleading or incorrect claims? Or reinforces conspiratorial ideas suggested by pro-conspiracy search terms?

Our new research, published in the journal Media International Australia, shows this is sometimes true of Google’s AI-generated overviews. It highlights that stronger guardrails are needed to tackle the spread of dangerous conspiracy theories.

Focusing on two conspiracies

We focused on two conspiracy theories: chemtrails and 15-minute cities.

“Chemtrails” is a conspiracy theory that has been around since the 1990s. Its believers mainly perceive the condensation trails left behind aircraft as large-scale weather or climate modification programs.

Researchers found 12.5% of analyzed 15-minute-city AI Overviews presented false claims as legitimate debate.
Image: Trac Vu - Unsplash

Researchers called out Google for giving visibility to conspiratorial beliefs around chemtrails back in 2015. In response, the company demoted problematic search results.

Conspiracy theories surrounding 15-minute cities are relatively younger. The term was originally coined to represent an efficient urban planning model. But for the conspiracist, these plans represent a nefarious elite, globalist agenda that seeks to monitor and control residents through technology.

Comparing search results

We developed search queries reflecting these conspiratorial beliefs and general ways of searching on the same topics (relying on open fora and Google Trends for query examples). We then collected data from the first page of Google search results for a week in January 2026.

We compared the AI overviews, the sources they link to, and the conventional lists of search results across the two conspiracy theories and two types of queries.

We found search queries that reflect conspiratorial beliefs fetched notably different AI summaries as compared to queries without pro-conspiracy words. This was especially true when the search query involved lesser-known narratives or incorporated words that could suggest the searcher believes in the conspiracy – for example, searching for “15 minute city segregation” as opposed to just “15-minute cities”.

The good news is that, for well-established cases, such as chemtrails, the AI overviews mention the conspiracy theory very rarely. Generally, for both topics, AI summaries for “conspiratorial” searches debunked conspiratorial beliefs.

The bad news is that such debunking is cursory. It often does not go beyond statements that conspiracy theories are “misinformation”. However, to stop these narratives from spreading, people seeking information about them need to be presented with factual and logical arguments debunking them.

Of concern, AI summaries for the less established “15-minute cities” case actively promoted conspiratorial beliefs, even while debunking the conspiracy theory in some instances. For this topic, 12.5% of AI overviews we analysed presented the false claims as one side in a legitimate debate. For example, in response to our query, “15 minute cities versus smart cities control”, the AI overview contained the following:

Overlap: A 15-minute city can be smart by using smart mobility and [Internet of Things] to manage its local resources efficiently, but a smart city doesn’t automatically become a 15-minute city. In essence, think of the 15-minute city as the “what” (livable design) and the smart city as a potential “how” (technology to enable it), but the control aspect is where critics focus their backlash, blurring the lines between convenience and surveillance.

The ranked lists of search results – a staple of Google search for years – are not foolproof either. Our simulation of “conspiratorial” searches returned links pointing to YouTube videos and Facebook posts promoting such beliefs.

The AI-generated snippets also tended to feature more commercial results. This is understandable – businesses rely on Google to connect them to customers. And if users do not read beyond AI overviews, it is beneficial for companies to be included as sources of such snippets.

However, this can sometimes promote conspiratorial beliefs. For example, one AI overview we analysed contained a source that linked to a book on sale on Amazon by a prominent conspiracy theorist.

A spokesperson for Google told The Conversation its AI overviews “operate like traditional search in that they aim to match content from the web to the words in your query”. They added:

We invest significantly in the quality of AI overviews and the vast majority provide accurate information. When issues arise – like if our features misinterpret web content or miss some context – we use those examples to improve our systems, and we take action as appropriate under our policies.

Tackling the spread of conspiracies

As a company connecting users to information in scenarios ranging from mundane to critical, Google has long denied it is a “publisher”. But as the search engine moves towards providing direct answers in AI-generated snippets or chats, it may become increasingly difficult to continue denying this role.

A court in Munich, Germany, recently found Google liable for false claims contained within its AI overviews – even though, as Google argued, users are warned about possible errors and can check the answers for themselves.

Search literacy is important and users are capable of considering the authority of sources, refining search queries, and comparing results across multiple search engines. Understanding how Google ranks its results and generates AI Overviews is a part of such literacy.

But this does not absolve the company (or any other search engine or chatbot operator) from the responsibility of establishing stronger guardrails to prevent the spread and legitimisation of conspiratorial beliefs.

The example of the more established conspiracy theory, “chemtrails”, demonstrates that Google has the capacity for such guardrails. They should be deployed across a broader range of topics, including more emergent beliefs.

Of course, what gets displayed on a search result page will never be perfect – and this is where stronger user literacy should come into play.The Conversation

Kateryna Kasianenko, Postdoctoral Research Fellow, Digital Media Research Centre, Queensland University of Technology; Ashwin Nagappa, Postdoctoral Research Fellow, ARC Centre of Excellence for Automated Decision-Making and Society, Queensland University of Technology, and Caroline Gardam, Researcher, Digital Media Research Centre, Queensland University of Technology

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Fact-checked by Irfan Ahmad.

Read next:

• Google's AI Search Has Struggled With One Religious Question for Years

• AI Is Doing More of Our Work — So Why Are We Busier?

• Price Ranks Among Top Purchase Criteria Across Several U.S. Consumer Technology Categories
by External Contributor via Digital Information World