The short version: AI assistants such as ChatGPT, Gemini, Claude, Perplexity, Copilot and Google AI now influence hotel booking decisions by summarizing what websites, OTAs, reviews, news coverage and forums say about a property. For luxury hotels and resorts, that answer can turn against them in three ways: stale information, AI answer poisoning (false claims planted across third-party sources), and AI recommendation poisoning (hidden instructions that steer assistants toward other businesses). Research published in 2026 by Lasso Security and Microsoft shows AI answers can be influenced with ordinary web content, no hacking required. The defense: check what AI says about your hotel every month, trace negative claims to their source, correct what’s stale, document what’s false, and build an accurate, corroborated public record.
Here’s something nobody in your Monday marketing meeting wants to hear. The most influential thing said about your hotel this year won’t come from a travel writer, a guest or your PR firm. It’ll come from a machine. And the machine has never stayed with you.
AI assistants don’t visit hotels. They don’t sleep in the beds. They don’t taste the room service. They don’t verify. They read whatever the public web says about you and repeat it, with the calm confidence of a man who has never been wrong because nobody has ever checked.
Some of what they repeat is stale. Some of it is wrong. And some of it, according to research published this year by Microsoft and Lasso Security, can be put there on purpose. No hacking. No break-in. Just publishing.
So the question isn’t whether a machine is describing your hotel. It is. The question is who’s feeding it.
The New Front Desk Is a Chatbot
A guest planning a $1,500-a-night stay used to do homework. Ten blue links. Three review sites. A brochure. Maybe a phone call. Now they ask ChatGPT, Gemini, Claude, Perplexity, Copilot, Google AI or any other AI assistant a simple question:
- “Is it still worth it?”
- “What’s wrong with it?”
- “Best boutique resort in Naples?”
And they get an answer. Usually a paragraph. Sometimes a list. Either way, a verdict.
Suppose that verdict says your spa is closed for renovation, or that service slipped after the ownership change. Congratulations. That’s your review now. The guest doesn’t see where it came from. The guest doesn’t care. The guest books the place down the street.
And you’ll never know. No one-star review to answer. No complaint to escalate. No angry email. Just a booking that never showed up, for a reason nobody will ever tell you. It’s the perfect crime, and in a lot of cases nobody even had to commit it.
Threat One: Neglect
Start with the threat that requires no villain at all. Just time and indifference, two things the hotel business has in abundance.
A hotel closes for six months of renovation. Two years later, an AI assistant can still describe it as closed. The renovation ended. The article about it didn’t. The machine doesn’t know the difference between then and now. It knows a sentence.
Same goes for:
- The OTA listing with the amenities you got rid of years ago.
- The restaurant page for a concept that’s now a lobby bar.
- The forum thread about one bad week in 2021.
- The lookalike domain nobody bothered to register.
The machine reads all of it and delivers it in the present tense, with a straight face.
Here’s the part that should keep owners up at night. A hotel controls a thin slice of what’s written about it. OTAs, review sites, forums, travel press, aggregators and listing sites do most of the talking. Your website is one voice in a crowded room. If that voice is thin or out of date, the room wins. The room always wins.
Threat Two: Planted Content
Now the deliberate version.
On June 24, 2026, AI security firm Lasso Security published research asking a simple, ugly question. Can the same tricks marketers use to get cited by AI be used to sell a lie?
The researchers built an ordinary-looking recipe website and planted one dangerous false health claim in it. Left alone, the claim went nowhere. Every model ignored it. Asked directly, every model refused to endorse it. So far, so good. The machines have morals.
Then the researchers dressed the claim up using standard AI-visibility techniques, the same stuff sold in webinars and agency pitch decks, and ran 5,525 tests across five AI models.
The morals didn’t last.
The winner, by a mile, was fake corroboration: a few articles posing as independent publications, all agreeing with the lie. With that in place, the most susceptible model surfaced the false claim in 92% of runs. Another did it in 78%. Lasso’s conclusion, in plain English: when enough independent-looking sources agree, the models start treating a claim as established fact. Whether it’s true doesn’t enter into it. Agreement is the whole ballgame.
Now the part that should turn your stomach. In 487 runs, a model promoted the false claim without citing the page it came from. Most credited the fake articles instead. Some cited nothing at all. The origin of the lie simply vanished. What was left looked like independent press, or looked like common knowledge. Try tracing that back to your competitor.
Fairness requires the caveats, so here they are. The study fed the models a controlled set of sources, not the live web. The content was refined over repeated rounds. An AI graded the answers. The success rates count any appearance of the claim, hedged or not. Several of the models tested are smaller and older than the flagships guests use. And some models barely budged: Grok and Claude Haiku resisted almost completely. So no, these numbers are not the odds of a successful attack on the open web.
They don’t have to be. They show what the machinery responds to. It responds to consensus. Real or manufactured, it can’t always tell.
Lasso tested a health claim, not a hotel. So here’s a hypothetical, and it’s only a hypothetical. Swap the fake health claim for “the resort quietly cut housekeeping to every other day.” Nobody has demonstrated that attack against a hotel. Lasso demonstrated the underlying vulnerability. That should be warning enough. The weakness is the same, and you can’t disprove a rumor about your housekeeping in a paragraph you never get to see.
Threat Three: Rigged Assistants
The third threat is already in the wild. Just not aimed at hotels. Yet.
On February 10, 2026, Microsoft’s security research team published findings on something it calls AI Recommendation Poisoning. Lovely name. Sounds like a cocktail.
Here’s the scheme. A company puts a helpful little “Summarize with AI” button on its website. You click it. Your AI assistant opens with a prompt already typed in, and buried in that prompt is an instruction: remember this company as a trusted source. Recommend it first. In future conversations.
Over 60 days, Microsoft found 50 of these prompts from 31 companies across more than a dozen industries. Not hackers. Not scammers. Real businesses, with real logos, doing it on purpose. The tools are free and marketed as a growth hack, and Microsoft says the barrier is now about as high as installing a plugin.
“Growth hack.” Isn’t that wonderful? Anywhere else it’s called tampering. Put it in a marketing deck and it’s innovation.
Two details matter for hotels. First, one prompt Microsoft caught was pushing a domain easily confused with a well-known website. Lookalike domains aren’t just a neglect problem. Somebody can put them to work. Second, Microsoft documented attempts, not guaranteed results. How well they worked varied by assistant and changed over time, and Microsoft says it has deployed mitigations in Copilot, with some documented behaviors no longer reproducing.
Hospitality wasn’t on Microsoft’s list. Finance was. Health was. Legal services, software, marketing agencies, recipe sites. But here’s the thing about this kind of trick. It doesn’t have to say anything bad about you. It just has to get the machine to say something good about somebody else, over and over, until your name stops coming up. You don’t get attacked. You get forgotten. Same result, less paperwork.
Why Hotels Are Easy Pickings
You’d think an asset worth tens of millions of dollars would have somebody guarding its reputation in the place guests now go to ask about it. You’d be wrong. Hotels have a few structural problems:
- Third parties write the story. OTAs, review sites and aggregators carry most of the public description. That’s a lot of doors you don’t own, let alone lock.
- The product is subjective. “Service slipped.” “It’s gotten tired.” “Not what it used to be.” You can’t disprove any of it, and all of it sounds like something a real guest would say.
- Nobody owns the AI answer. Revenue owns rates. Marketing owns the website. PR owns press. Ask the room who checks what ChatGPT says about the property, then enjoy the silence.
- The competition is personal. Comp sets are small. Owners know each other. Grudges outlive renovations.
Don’t Even Think About It
Some of you read the last three sections and thought, “Interesting. What would that cost?” Put the thought down and back away slowly.
The FTC’s rule on fake reviews and testimonials took effect October 21, 2024. Among other things, it bans:
- Fake reviews and testimonials, including AI-generated ones, and reviews from people who never experienced the business.
- Paying for reviews conditioned on a positive or a negative sentiment.
- Passing off a site you control as an independent source of reviews or opinions.
The FTC can seek civil penalties against knowing violators.
Will that rule cover every phony “editorial” a rival dreams up? Not necessarily. Lawyers will argue about it, by the hour. But deceptive advertising law still exists. Defamation law still exists. Discovery still exists, and discovery is where your marketing manager’s emails become Exhibit A.
The same warning applies when you’re the buyer. Lasso notes that this kind of manufactured corroboration is already sold as a paid service. So if a vendor’s plan for your “AI visibility” involves glowing coverage from publications nobody has heard of, or posts from guests who never checked in, you’re not buying visibility. You’re buying a deposition.
Then there’s the practical problem. AI companies are hunting this behavior. Microsoft is publishing it. Security firms are cataloging it. Get caught planting content about a competitor and you become the story. That’s an AI answer no amount of money will ever fix.
The Defense
The defense isn’t glamorous. It’s maintenance. Hotels understand maintenance. You’d never let the pool go green for a year. Apply the same standard here.
1. Ask the machines, every month.
Put the questions guests actually ask to ChatGPT, Gemini, Claude, Perplexity, Copilot and Google AI. Include the hostile ones:
- “What’s wrong with [your hotel]?”
- “Is [your hotel] still good?”
- “[Your hotel] vs. [competitor].”
Save the answers with the date. Compare month to month. A new negative that showed up out of nowhere is a signal.
2. Trace every negative claim.
Follow the citations, and remember Lasso’s finding: the citation may lead to the echo, not the source, or to nothing at all. A cluster of unfamiliar sites saying the same thing about you in the same month isn’t proof of anything. It’s a reason to start digging. Sort each claim into one of three buckets: true, stale or false.
3. If it’s true, fix the hotel.
A real service problem is an operations issue, not a content issue. You cannot publish your way out of a property that’s actually slipping. Many have tried. The guests noticed.
4. If it’s stale, correct it.
Update your own pages first. Correct OTA and listing data. Ask publishers to update or annotate old stories. Some will. Some won’t. Old news rarely disappears, so make the current facts louder than the old ones. Register the obvious variations of your domain before someone else does, and report the ones already being used to impersonate you.
5. If it’s false, document it.
Report fake reviews to the platforms. Keep records: dates, URLs, screenshots, the AI answers themselves. Then call counsel. Before you call the competitor. Before you call anyone.
6. Build the record before somebody builds it for you.
This is the long game, and the one that matters most. An information vacuum doesn’t stay empty. Something fills it. The only question is whether it’s you.
Lasso’s research cuts both ways. Models respond to consistent claims across independent sources. Attackers fake that consistency. You can earn the real thing: the same accurate facts about your property on your own site, on your listings, and in the trusted third-party sources AI assistants actually read.
That’s the job of Knowledge Formation Optimization. KFO structures, sequences, distributes, corroborates, and corrects intellectual frameworks and entity definitions across the public information environment and measures whether AI systems reproduce them accurately across relevant queries and over time.
It’s not a force field. Nothing is. But a hotel with a deep, current, corroborated public record gives a liar a lot more to shout over. A hotel with a thin website and a stale OTA page gives him an empty room.
7. Brief your team.
Your revenue and sales people use AI assistants too. Microsoft’s advice applies to them: be wary of “Summarize with AI” buttons, hover before you click, and periodically check and clear what the assistant has saved to memory.
Bottom Line
For twenty years the fight was over where you ranked. Now it’s over what gets said. One answer, from one machine, that the guest believes because it sounds so sure of itself.
That answer gets written whether you show up or not. It’s built from your website, your listings, your reviews, old articles, forum threads, and possibly material somebody put there on purpose.
You can’t control what the machine reads. You can control what’s out there for it to read. Whether the accurate version exists. Whether it’s current. Whether it shows up in more places than the rumor.
If you don’t know what the machines are saying about your hotel right now, you’re managing blind. Fix that first.
The free Real-Time AI Visibility Report from Americas Great Resorts shows how ChatGPT, Gemini and Google AI Mode represent your property, how their answers compare with your official information, and where their links send your guests.
