A report circulating on Hacker News describes a small number of websites generating hundreds of thousands of near-identical “best software” listicles, and an AI search engine citing them. It illustrates how content farms adapt to answer engines.
Key takeaways
- A widely discussed Hacker News post claims that three websites collectively published more than 200,000 formulaic “best software” pages apparently aimed at being harvested by AI systems, and that an AI answer engine cited them.
- The specific figures, site names and citation examples come from an independent write-up rather than from any audited dataset, so the precise numbers cannot be verified from public records.
- The underlying technique is not new: programmatic search engine optimisation has long generated large volumes of templated pages, but the target audience has shifted from human searchers to retrieval systems that feed AI answers.
- AI answer engines summarise and cite web pages in real time, which means a page does not need human readers or inbound links to influence what a chatbot tells a user.
- For security teams, the practical risk is that software recommendations of unknown provenance can steer users towards download pages, licence resellers or tools that nobody has vetted.
What is actually being described?
The claim at the centre of the discussion is straightforward. A researcher examined a cluster of websites that publish software recommendation pages — the sort headed “best invoicing software for small law firms” or “best time-tracking app for remote teams” — and found that the pages appeared to be generated at scale from templates, with the topic slot filled in by combining a software category with an industry, a company size or a country. Multiplied out, that combinatorial approach yields hundreds of thousands of URLs from a modest amount of underlying writing.
The second half of the claim is what made it circulate: an AI answer engine was observed citing these pages when asked for software recommendations. In other words, machine-generated pages written for machines were being surfaced to people as sourced answers.
Two caveats belong up front. The page counts, the identity of the sites and the specific citation examples come from one independent analysis, not from a regulator, an audit or a published dataset that others have reproduced. Individual figures should be treated as that author’s measurements. And the behaviour of any given AI search product changes frequently, so a citation observed at one moment is not evidence of a permanent state.
Why is this surfacing now?
Two developments converged. AI answer engines have moved from novelty to routine use for exactly the kind of query — comparing tools, shortlisting vendors — that used to send people to review sites. At the same time, the economics of publishing changed: generating a plausible 1,500-word comparison article now costs very little, so the marginal cost of covering every conceivable niche approaches zero.
The result is an arms race the search industry has seen before, running faster. Where a spam operation once needed to rank in a list of ten blue links against established competitors, it now needs only to be retrievable and superficially credible at the moment a model assembles an answer. That is a lower bar, and the discussion on Hacker News largely centred on whether AI search products are currently equipped to clear it.
What background does a newcomer need?
Programmatic SEO is a legitimate technique with a long history. Job boards, travel sites and price comparison services have always generated pages from databases — one page per city, per route, per product — because the underlying data genuinely differs between them. The abuse case is the same mechanism applied to pages where the content does not meaningfully differ, producing thin variations designed to catch long-tail queries.
Search engines spent two decades building defences against this: link analysis, spam classifiers, manual actions and repeated ranking updates aimed at low-value mass-produced content. Those defences are imperfect but mature.
AI answer engines work differently. Most use retrieval-augmented generation: the system searches an index for pages relevant to the question, feeds excerpts to a language model, and asks it to write an answer with citations. The model does not independently know whether a source is reputable. It receives text and treats it as evidence. If a retrieval layer surfaces a templated page because that page matches the query wording closely, the citation follows.
The commercial motive is usually affiliate revenue. Software recommendation content pays well because vendors offer commissions on sign-ups, so a page that steers a reader towards a particular tool has direct value regardless of whether the recommendation is considered.
Who is affected, and how?
Ordinary users are the most exposed. Someone asking a chatbot which accounting package suits a small business receives a confident answer with links attached, and the citations create an impression of verification that may not exist. The failure mode is rarely dramatic; more often it is a recommendation shaped by commission rates rather than fit.
Software vendors are affected in both directions. Some benefit from appearing in generated listings they never solicited. Others find themselves misrepresented — wrong pricing, features they do not offer, or omission in favour of whoever pays more.
Legitimate review publishers face the sharpest squeeze. Sites that test products and employ editors compete for the same retrieval slots as operations with no testing costs at all.
For security professionals, the concern is the download and procurement path. Recommendation pages of unclear provenance are a plausible vector for directing users to unofficial installers, grey-market licence keys or lookalike vendor sites. There is no verified evidence that the sites in this particular report did any of that — the point is structural: a channel that delivers unvetted software recommendations at scale, with the credibility of an AI assistant attached, is worth treating as part of the software supply chain rather than as marketing noise.
Where do informed people disagree?
The Hacker News thread divided along several lines.
One argument holds that this is an ordinary spam problem with an ordinary solution: answer engines will build the same classifiers search engines did, the arms race will continue, and quality will settle at roughly its historical level.
A competing view is that retrieval-based systems are structurally more vulnerable, because a search engine only has to avoid ranking a bad page first, whereas a generative system may quote a bad page and launder its claims into fluent prose that shows no sign of its origin.
There is also disagreement about responsibility. Some argue the burden falls on AI companies, which choose what to retrieve and what to present as a citation. Others point to affiliate programmes as the funding source, and to the absence of any general obligation for a website to disclose that its content was machine-generated.
Finally, some participants questioned whether volume is the right metric at all. A very large number of pages that are almost never retrieved may matter less than a small number that consistently surface for high-value commercial queries.
What are the practical implications?
For individuals, the workable habit is to treat AI software recommendations as a starting shortlist rather than a verdict, and to open the citations. A page with no named author, no testing methodology, no dates and an obviously templated structure is a signal. Downloads and licences should come from the vendor’s own domain.
For organisations, procurement processes that already require vetting for new software should note that the discovery stage has changed. Staff increasingly arrive with a shortlist produced by a chatbot, and asset-management and allowlisting controls matter more when the recommendation channel is this easily influenced.
For publishers and platform operators, the episode is a reminder that provenance signals — author identity, disclosed methodology, disclosed affiliate relationships — are becoming machine-readable trust markers rather than reader-facing courtesies.
What should be watched next?
Several things are worth tracking, none of them settled.
Whether AI search providers publish anything concrete about source quality — how retrieval sources are filtered, whether mass-generated content is demoted, whether citation practices change — will be the clearest signal. So far, disclosure in this area has been limited.
Whether search engines’ existing spam policies are enforced against this pattern is a second indicator, since most of these sites depend on conventional indexing to be retrievable at all.
Regulatory attention is a slower variable. Rules on advertising disclosure and, in some jurisdictions, on labelling AI-generated content could apply to undisclosed affiliate listicles, but enforcement against high-volume, low-value publishing is difficult.
Finally, watch whether independent measurement improves. Much of what is known about how answer engines choose sources comes from ad hoc investigations by individuals. Reproducible, ongoing measurement would move the discussion from anecdote to evidence.
Frequently asked questions
What is programmatic SEO?
Programmatic SEO is the practice of generating large numbers of web pages automatically from a template and a data source, so that each page targets a slightly different search query. It is legitimate when the underlying data genuinely differs between pages, such as flight routes or job listings. It becomes spam when the pages are near-identical filler created only to capture search traffic.
How do AI answer engines choose which sites to cite?
Most use retrieval-augmented generation. The system runs a search against a web index, selects passages that appear relevant to the question, and passes them to a language model that composes an answer and attributes claims to the retrieved pages. Selection is driven largely by textual relevance and the underlying index’s ranking, not by an independent assessment of whether the publisher is trustworthy.
Does a citation from an AI assistant mean the source is reliable?
No. A citation indicates that the system used that page while composing its answer. It is not a quality judgement, and it does not mean the content was checked against other sources. Citations are useful mainly because they let you inspect the original page yourself and judge whether it has an identifiable author, a stated methodology and any disclosed commercial relationships.
Is publishing AI-generated content against search engine rules?
Major search engines generally say they judge content by usefulness rather than by how it was produced, while treating mass-generated pages made primarily to manipulate rankings as spam. That distinction is difficult to apply in practice. Enforcement tends to be uneven, and policies are revised often, so anyone relying on this should consult the current published guidelines rather than summaries.
What is the actual security risk here?
The direct risk is not malware in the articles themselves but the destination they steer people towards. Unvetted recommendation pages can point users to unofficial download mirrors, resold licence keys or vendor lookalikes, and they can promote tools that nobody has assessed for security. Treating chatbot-sourced software shortlists as an input to procurement, rather than as a decision, mitigates most of it.
How can I tell whether a review site is genuine?
Look for named authors with verifiable backgrounds, an explicit testing methodology, dates on reviews and updates, and clear disclosure of affiliate arrangements. Warning signs include coverage of implausibly many niches, pages that differ only in the industry named in the title, generic praise for every product listed, and no evidence that anyone actually used the software.
Sources and further reading
- Hacker News — the discussion thread where the original analysis was submitted and debated, useful mainly for the range of practitioner views rather than as a verified account.
- Independent researchers and technical bloggers publishing measurements of AI search citation behaviour, which is currently the main source of data on which sites answer engines draw from.
- Published search engine webmaster and spam policies, which set out how mass-generated content is classified and what enforcement is available.
- Consumer protection and advertising standards regulators, for the general rules on disclosing affiliate and paid relationships in product recommendations.
Surfaced from the hackernews signal “mass-generated pages in AI search”. AI-assisted draft, editorially reviewed.
