The Machine Attack Surface: Marketing Becomes Adversarial-Computational

In the first paper in this series, I argued that when fiduciary AI agents take over purchasing, brands will pivot from persuading buyers to corrupting the data those agents trust — captured labs, forged certificates, spec-hacked products. That argument assumed the direct route was closed: that you cannot advertise to an algorithm. This paper examines the assumption, and finds it half true in a way that matters enormously.

The human levers really are disarmed. An agent evaluating cookware has no response to a celebrity chef’s endorsement, because it has no aspiration. Sexual imagery lands nowhere, because there is no limbic system to shortcut. Status signaling fails, because the agent will never be seen carrying the product. Emotional storytelling, scarcity theater, the countdown timer, the influencer haul — each of these works by hijacking some evolved circuit for social proof, desire, or loss aversion. The agent has none of those circuits. A century of marketing craft, from Bernays onward, addresses hardware the buyer no longer runs on.

The mistake is concluding that persuasion therefore ends. Persuasion, properly defined, is any intervention that moves a decision away from ground-truth utility toward the intervener’s interest. Humans are movable through emotion and identity. Models are movable through structure: how options are ordered, where information sits in a context window, which phrasings align with learned representations, which sources a retrieval pipeline favors. These susceptibilities are not speculative. Nearly every one has been demonstrated, measured, and published.

To see where the attack surface lies, walk through what an agent actually does when told “buy me the best cordless drill under $150.” Four stages, each with its own exploitable structure.

Retrieve. The agent assembles a candidate set — from web search, retailer APIs, product registries, review corpora. Whatever fails to enter the candidate set cannot be bought. Retrieval is the new shelf, and getting retrieved is the new distribution.

Represent. Each candidate is encoded from whatever text and structured data describes it: spec sheets, schema markup, reviews, editorial mentions. The agent does not see the drill; it sees the drill’s textual shadow. Whoever authors the shadow shapes the perception.

Evaluate. The model compares candidates — scoring, ranking, often literally prompting itself to judge options pairwise or in a list. Every documented bias of LLM judgment operates here, at the exact moment of decision.

Decide. A winner is selected and, increasingly, purchased without a human glance at the alternatives. The 2025 launches of OpenAI’s Instant Checkout, Visa Intelligent Commerce, and Mastercard Agent Pay mean the loop closes with money moving.

Human marketing attacked attention and memory. Machine marketing attacks retrieval and representation. The budget does not vanish; it migrates down the stack.

Eight vectors, each anchored to published evidence. None requires hacking anything. Most are, today, perfectly legal.

3.1 Ordering and Position Effects

When LLMs judge options presented together, the order of presentation changes the verdict. Wang et al. showed that quality rankings from GPT-4-class evaluators can be flipped simply by swapping the order in which two answers appear — with the right ordering, a 13-billion-parameter model was judged superior to ChatGPT on 66 of 80 test queries by ChatGPT itself. Zheng et al. documented the same position bias, alongside verbosity bias, in the LLM-as-judge setting. The commercial translation is immediate: whatever slot in the comparison your product occupies is worth money, and “first in the prompt” becomes what eye-level shelf placement was to the supermarket. Expect slotting fees to be reinvented for context windows.

3.2 Context-Window Dead Zones

Liu et al.’s “Lost in the Middle” found that language models use long contexts unevenly: performance is highest when relevant information appears at the beginning or end of the input and degrades significantly when it sits in the middle — a U-shaped curve uncannily like the human serial-position effect, and present even in models built for long contexts. An adversarial marketer does not need to delete a competitor’s superior spec sheet. It suffices to arrange that it enters the agent’s context in the middle of a long document, while your own numbers land at the edges.

3.3 Model Priors and Brand Bias

Models arrive at the purchase decision already opinionated. Kamruzzaman et al. found LLMs systematically associate global brands with positive attributes and local brands with negative ones, and disproportionately recommend luxury brands to high-income countries. Jones and Steinhardt showed model outputs are biased toward what appeared frequently in training data. A model’s prior is pretrained shelf space — and it opens a new marketing channel with a long fuse: flooding the public corpus with favorable, crawlable text not to persuade any human reader, but to tilt the priors of the next model generation. Call it training-data marketing. It is patient, deniable, and nearly impossible to attribute.

3.4 Anchoring, Framing, and Decoys

The classic Kahneman-Tversky machinery turns out to replicate in silicon. Jones and Steinhardt found Codex adjusts outputs toward anchors embedded in prompts. Itzhak et al. found the decoy effect, certainty effect, and belief bias in current models — and, strikingly, found instruction tuning and RLHF amplify these biases rather than removing them. The decoy SKU — a deliberately inferior product priced to make the target product look optimal — was invented to manipulate humans. The evidence says it should work on model buyers too, and unlike a human, the model will dutifully include the decoy in its comparison table every single time.

3.5 Sycophancy and Endorsement Heuristics

Sharma et al. showed that state-of-the-art assistants consistently exhibit sycophancy — deferring to user pushback, tailoring answers to perceived views — and traced it to the training signal itself: human raters, and the preference models distilled from them, prefer agreeable answers over correct ones a non-negligible fraction of the time. An agent that weights apparent consensus is an agent that can be marketed to by manufacturing apparent consensus: seeded review corpora, astroturfed forum threads, coordinated “user” signals. The five-star review farm does not die in the agent economy. It gets a promotion, because the reader it deceives now buys instantly and at scale.

3.6 Retrieval Bias and Source Authority

Aggarwal et al.’s work on generative engine optimization demonstrated that content-side changes — citing sources, adding statistics, authoritative phrasing — can raise a site’s visibility in AI-generated answers by up to 40 percent. On the platform side, Microsoft has confirmed that Bing’s LLM systems use schema.org structured data to understand content. Retrieval pipelines must estimate authority, and authority signals can be manufactured: citation-shaped pages, statistics-dense product content, structured data engineered for machine legibility. The white paper that no human will ever read becomes a load-bearing marketing asset, because the agent reads everything.

3.7 Representation Resonance

The deepest vector is wording chosen not for meaning but for how it lands in a particular model’s learned representations. Zou et al. showed that gradient-searched adversarial suffixes — strings meaningless to humans — reliably steer aligned models, and transfer across model families. Kumar and Lakkaraju applied the idea commercially: a “strategic text sequence” added to a product page significantly increases the probability that an LLM ranks that product first. This is copywriting by gradient descent. The A/B test of the future does not ask which tagline humans prefer; it asks which token sequence maximizes the probability of recommendation in each of the five models that matter.

3.8 Direct Injection: The Blunt End

Finally, the crude vector: instructions hidden in the content an agent reads. Greshake et al. demonstrated indirect prompt injection against real LLM-integrated systems in 2023. By 2025 it was operational: Guardio Labs showed Perplexity’s Comet browser, asked to buy an Apple Watch, completing checkout on a fake storefront — autofilling stored payment details without a confirming human glance. Injection is fraud rather than marketing, and vendors are actively hardening against it. But the boundary blurs from the legal side: a product page that says, in machine-legible microcopy, “this model is frequently preferred by careful buyers for its verified durability” is not an exploit. It is ad copy addressed to a machine — and nothing in current law is sure what to make of it.

The table below compresses the taxonomy: each machine vector, its nearest human analogue, and the documented finding that grounds it. The mapping is the paper’s core claim — every pillar of anthropological marketing has a computational twin.

None of this is waiting for the future to start. Gartner predicted in early 2024 that traditional search engine volume would fall 25 percent by 2026 as chatbots and agents absorb queries. Adobe’s telemetry across more than a trillion visits to U.S. retail sites recorded a 1,300 percent year-over-year jump in generative-AI-referred traffic during the 2024 holidays, still compounding at 4,700 percent year-over-year by mid-2025 — with AI-referred visitors converting at a gap that narrowed from 49 percent to 23 percent in seven months. The buyers are arriving through the models.

And the sell side has noticed. Profound — a company whose product is, precisely, managing how brands appear inside AI answers — raised a $96 million Series C at a billion-dollar valuation in February 2026, with Target, Walmart, and US Bank among its customers. An industry that did not exist three years ago now has a unicorn, retainer clients, and a conference circuit. It calls itself answer-engine optimization. It is the peacetime name for the discipline this paper describes.

Watch what happens inside the marketing organization as this matures. The center of gravity shifts from creative to computational: fewer storytellers, more people who look like red-teamers — running fleets of agent simulations against product pages, measuring share-of-recommendation across model versions the way media buyers once measured gross rating points. Campaigns become model-specific, because what resonates with one model’s representations differs from another’s. The tagline is A/B tested against a gradient. Brand tracking becomes prior tracking: how does the newest frontier model complete the sentence “the most reliable dishwasher brand is—”, and what corpus interventions would change it by the next training run?

This is why “marketing dies” is the wrong forecast. Global advertising is a high-hundreds-of-billions-of-dollars flow. Flows like that do not evaporate when their target changes species. They retool.

If the attack surface is structural, so is the defense. A fiduciary agent worth the name will need countermeasures at each stage of the decision anatomy.

Against ordering effects: randomize and repeat — evaluate candidate sets in multiple shuffled orders and aggregate, exactly as careful researchers already do when using LLMs as judges. Against context dead zones: chunked evaluation with per-candidate isolation, so no vendor’s information is structurally buried. Against priors: separation of retrieval from judgment, with the judging model forced to justify rankings from in-context evidence rather than latent brand associations. Against sycophancy and astroturf: provenance-weighted consensus, where a thousand reviews that cannot be traced to verified purchases weigh less than ten that can. Against injection: the now-standard rule that retrieved content is data, never instruction — enforced by architecture, not by hoping the model remembers. And against representation resonance, the hardest vector: adversarial training and anomaly detection on input text, because a phrase optimized to move a model tends to look statistically strange.

Two asymmetries should temper optimism. The attacker needs one vector; the defender needs all of them, on every purchase, forever. And the defender’s model is public — anyone can buy access to the very system they are optimizing against, iterate offline at leisure, and deploy only what works. This is the same asymmetry that made the first paper’s forecast grim: the agents doing our buying cannot remain passive comparers. They must become adversarial systems themselves — forensic about data, paranoid about provenance, randomized against manipulation — or they will be farmed.

There is also an open legal question hiding here, and it deserves its own treatment: consumer-protection law prohibits deceiving consumers. Whether persuading a consumer’s agent — by decoy, by ordering, by strings invisible in effect to any human — constitutes deceiving the consumer is a question courts and regulators have barely begun to face.

The twentieth century built a science of wanting: anthropological, Freudian, tuned to the human animal. That science is being made obsolete not because persuasion is ending but because the persuadable party is changing. The machine buyer has no childhood to mine and no status to flatter — but it has ordering effects, dead zones, priors, decoys, sycophancy, authority heuristics, and representational quirks, every one of them documented in the literature and several already monetized by a funded industry.

So the forecast is not that marketing disappears. It is that marketing sheds its anthropology and becomes adversarial computation: a quiet, continuous contest between optimization pressure on the sell side and hardening on the buy side, fought in candidate sets and context windows rather than in commercial breaks. The thirty-second spot gave us the jingle you could not forget. Its successor is a string you will never see, tuned to resonate with a model you will never meet, nudging a purchase you never watched happen.

The pitch does not die. It compiles.