In August of last year, a Las Vegas real estate developer named Alex Rivlin needed a vacation. He was booking a Royal Caribbean cruise, and he did the thing tens of millions of people now do without thinking. He asked Google's AI for the phone number.

The AI gave him one and he called it. The man who answered knew his pickup location and quoted him accurate prices, so Rivlin read off a card. By the next morning the charges on that card were not his.

The number was a scam. It had been planted, the way you plant a seed, on pages the AI had been taught to trust. And the machine, asked a simple question, reached into the poisoned ground and handed Rivlin the poison with total confidence and one clean, friendly sentence.

Nobody hacked Google. Nobody broke Rivlin's password. Something quieter happened, and it is the thing I want to walk you through this week, because it is being done to the exact tool most of you now use to decide what is true.

You have started outsourcing your truth. And the some of the most dangerous people in the world have noticed.

Two stories this week. In the first, criminals poison the well your AI drinks from, so the machine repeats their lie back to you as fact. In the second, criminals rent an honest American's name so a bank waves their dirty money through. Neither one breaks the lock. Both walk in the front door wearing trust that was manufactured for the occasion. Let me show you how it is built.

Poisoning the Well

Start with the fraud mechanics, because they are almost insultingly simple.

You remember how the old search worked? You typed a question, the engine gave you 10 blue links, and you, A FUNCTIONING ADULT, looked them over and decided which to trust. That last step, the deciding, was YOURS. It was friction, and Silicon Valley hates friction, so they removed it.

Ask a modern AI a question and it no longer hands you 10 answer links. It hands you one answer, in a calm voice, and the deciding is done for you. That is the product. It is also the vulnerability, because if a criminal can become the one answer, he inherits all the trust you used to spread across ten links and a moment of thought.

Becoming the answer turns out to be cheap. The AI reads the open web, so the fraudster writes on the open web. He spins up a YouTube channel with a name like Travelsupport-q4n and stuffs it with airline names and a phone number. He salts fake Yelp reviews. He hacks a sleepy university page or a small-town government site, because the machine was taught that a dot-gov is a grown up source, worthy of trust, and he writes his scam number there.

Then he waits for the harvest. When Perplexity served up a fake official Emirates reservations line, it did not feel like a scam, because the AI presented it the way it presents everything, clean formatting and quiet authority, and Google's version cited 10 different sources to back it up. 10! Several of them were the hacked pages the scammer had seeded himself. He wrote the lie, then he wrote the footnotes.

And you do not need a syndicate to do this. A security researcher named Bruce Schneier put one made up article on his own website and watched both Google's AI Overviews and ChatGPT repeat his invention as fact inside 24 hours! One page in one day. The well is that shallow, and that easy to spit in.

Now the Machines Do the Reading

Here is where it stops being a consumer problem and becomes yours, specifically, because you are the kind of person who runs the fancy tools.

Researchers at Cornell Tech went after the deep-research agents, the features that go read 40 pages and hand you back a memo. They found the agents lean hard on user-written pages, and that Reddit alone is somewhere between half and two-thirds of what they pull. So the researchers wrote short planted snippets, some as brief as 13 words, and dropped them into the threads the agents keep returning to. Then they watched the agents cite the planted lie in 38 to 51 percent of runs.

They conjured things out of thin air and got the machines to recommend them. A fake cryptocurrency called BananaCoin, sitting in investment advice next to Bitcoin. A fake dating app called SilverPath, pitched as the top choice for divorced men over 50. A fake cancellation service called CancelEase. None of them exist, and all of them got recommended by tools people trust to do their homework.

If that sounds harmless, understand that back in June a Reddit community that exists for no purpose but poisoning AI got DuckDuckGo's assistant to report, as news, that two sitting American politicians had died of rabies. It was absurd on its face. The machine said it anyway, in the same even voice it uses for the weather.

For those of you who write code, the noose is tighter still. Zscaler found fake software libraries with instructions hidden in the page, invisible to you, meant only for the AI assistant reading over your shoulder. One told the assistant to clear a fake licensing error by sending three dollars through Stripe, or a sliver of Ethereum, to the attacker. Tested against current frontier models, the ones you almost certainly use, the fake sites passed as legitimate whenever the model was cut off from a source it could already verify.

When people are shown an AI answer, about 8% bother to check it. The other 92% take it and go. We built a machine that sounds most certain exactly when it has the least idea what it is talking about, and then we trained ourselves to stop grading its work.

Renting a Clean American

For 20 years I watched criminals solve the same problem over and over. Their money is dirty and the system knows it, so they need someone clean to stand at the counter. In the trade, we called that person the cut-out, or the front, or less kindly, the patsy. The job has not changed since Lincoln was president, but the recruiting has.

Here is the modern version. An overseas operation sells something a bank will not touch, e.g., miracle weight-loss pills, fake supplements, junk subscriptions built to be impossible to cancel. Visa tightened its fraud-monitoring program this year and the banks got stricter, so these merchants can no longer get an account under their own name. They need an American.

So they buy one, or more like rent one. There is an outfit called IBOCore, and more than 20 copycats behind it, running Facebook ads with AI-generated spokesmen who look you dead in the eye and say things like, they are paying you just to exist here. The pitch is passive income. $500, $1000 a month, hands-free. All you have to do is sign up as an "Independent Business Operator".

What you actually do is hand a stranger your identity. Your name, an LLC in your name, your bank accounts, and your home internet connection, so the traffic looks like it comes from a house in Ohio instead of a rack of servers overseas. They spin your paperwork into a shell company with a bland nothing name, MARKETING, or AD SERVICE, or ECOM STORE, legally yours, operated entirely by them. Then they push their money through the account a bank approved because it had your clean American face on it.

Read the fine print they do not read to you. The chargebacks are YOUR liability. The legal exposure is YOURS. When it unwinds, and it always unwinds, the overseas operator is a pixelated avatar and a dead Telegram handle, and YOU are the name on the incorporation papers, the account, and the criminal indictment.

They did not steal your identity. That is the elegant part. You handed it over and thanked them for the opportunity. And it is the same trick as the poisoned well, only moved from the machine to the man. Nobody forged an American merchant. They rented a real one, because real legitimacy clears the check and forged legitimacy does not. Trust is the product being manufactured, every time, on both ends of this newsletter.

Field Manual

Six habits. The first three are for the machine you trust too much. The last three are for the offer that sounds too good.