There is a technical problem unfolding in rank tracking that has consequences well beyond the tools themselves. Search Engine Journal reports that enterprise rank tracker Nozzle has documented what it calls SERP poisoning: Google appears to be serving misleading search results to rank trackers and AI scrapers, with poisoned results making up between 5% and 11% of queries since 1 October.

The poisoned SERPs retain only 20.7% of the same websites across successive searches for identical keywords, against 88.5% for normal results. They show more user generated content from Facebook, Instagram, LinkedIn, Quora and Reddit. In 80% of cases the poisoning lasts for just one search result before reverting. If rank tracking tools are now seeing results that do not represent what real users experience, the question becomes whether we are measuring the right thing at all, or just a decoy version of the index.

What Nozzle documented

The non-standard search results began appearing on 20 September, reached as high as 25% of results at their peak, and have settled at between 5% and 11% per day since 1 October. Nozzle characterises them as poisoned rather than refused because Google is answering these requests with a complete page whose results are wrong, and nothing on the page indicates the problem. A refused request tells a scraper to try again. A poisoned one gets stored as legitimate data.

The analysis suggests this is Google's response to AI scraping and grounding, the bulk collection of search results to feed AI answers, and rank trackers are caught in the same net because they collect SERPs in the same way. It may also confound spammers attempting to reverse engineer how pages are ranked, though Nozzle did not state that explicitly.

The misleading results are widespread but vary across countries, industries and search types. What they have in common is artificial volatility, more user generated content, fewer AI Overviews, and relatively stable advertising and shopping results.

The signature of a poisoned SERP

Normal search results retain 88.5% of the same websites when you repeat a search for the same keyword. Poisoned results retain only 20.7%. That means successive searches for identical phrases are returning dramatically different sets of websites, creating the appearance of extreme ranking volatility where there is none for actual users.

The duration is mostly brief. In 80% of cases the poisoning lasted for one search result before reverting to normal. In 15% of cases it lasted for two successive results. In only 5% of cases did it persist for three or more searches. That pattern, one wrong result followed by a correct one, makes the data difficult to spot in aggregate and difficult to filter out retrospectively.

Google also appears to be showing more user generated content from social media and forum platforms in poisoned SERPs. Facebook, Instagram, LinkedIn, Quora and Reddit all appear more frequently. MapQuest, Yelp and YouTube appear less frequently, though there is no clear explanation as to why. Local targeting makes no difference: city and postal-code SERPs show slightly higher poisoning rates, but only because they lean toward mobile and near-me searches. The same phrase tracked nationally and locally in the same country on the same device produces the same poisoning rate.

What gets stripped out

Poisoned SERPs are less likely to show AI Overviews. AI Overviews appear 34.9% of the time in poisoned results versus 54.2% in the baseline. That makes sense if the goal is to reduce the cost and usefulness of scraping: the LLM inference necessary to generate an AI Overview costs more than displaying ten blue links, and the same logic presumably applies to other computationally expensive features.

The people also search for feature appears 52.7% of the time in poisoned SERPs versus 87.2% in baseline. Image packs appear nearly twice as often in poisoned results, 44.2% versus 23.0%, and forum blocks show more often, 27.0% versus 20.5%. Whether those changes are designed to minimise actionable data or simply reflect that text is more valuable to rank trackers than images is open to interpretation.

Advertising and shopping results remain fairly stable across both poisoned and normal SERPs, which is consistent with Google protecting the parts of the results page that generate revenue while disrupting the parts that do not.

What this means for rank tracking

If your rank tracking tool is ingesting poisoned results at a rate of 5% to 11% per day, and those results show completely different ranking patterns for the same keywords, your volatility reports are contaminated. A keyword that appears to have dropped five positions and then recovered the next day may not have moved at all for real users. A competitor that appears in position three one day and vanishes the next may have been entirely stable.

The challenge is that you cannot tell from the data itself whether a given result was poisoned. There is no flag, no HTTP response code, no signal in the HTML. The only reliable way to confirm whether a ranking change is real is to cross-reference it with actual traffic and user behaviour. If your rank tracker shows a significant movement and your analytics show no corresponding change in impressions, clicks or conversions for that term, the movement is likely an artefact.

This is not an argument to stop tracking rankings. It is an argument to treat ranking data as one input among several, not as ground truth. A keyword audit built entirely on rank tracker data without reference to Search Console, analytics or conversion paths was already incomplete. Now it is also potentially misleading.

What this means for AI grounding

The same poisoning that disrupts rank trackers also disrupts AI companies that ground their answers in Google's search results. If an LLM is pulling from Google to verify facts or provide citations, and a meaningful percentage of those results are poisoned, the answers it generates become less reliable. That creates a compounding problem: the AI does not know the data is wrong, so it cannot flag uncertainty or seek alternative sources.

For businesses preparing for agentic AI and trying to ensure their content is cited correctly by AI systems, this adds another variable. It is not enough to optimise for visibility in normal search results. You also need to account for the possibility that the AI is seeing a different version of those results, one that may not include your content at all or may include it in a context that distorts its meaning.

What to do about it

First, audit your reporting. If you are seeing ranking volatility that does not correspond to traffic changes, document the gap. Compare your rank tracking data to Search Console performance reports for the same keywords over the same period. Where they diverge significantly, treat the rank tracker data as provisional.

Second, expand your measurement framework. Ranking position is a proxy for visibility, and visibility is a proxy for traffic and conversions. If the proxy is unreliable, measure the thing it was standing in for. Track impressions, clicks, click-through rate, landing page sessions and goal completions by keyword group. Those metrics are harder to poison because they reflect actual user behaviour, not automated scraping.

Third, if you are running a technical SEO audit or a competitor analysis that relies heavily on rank tracking data, build in cross-validation. Do not assume that a competitor ranking in position one for a high-value term is actually receiving the traffic that position would normally deliver. Check their estimated traffic in third-party tools, look for corroborating signals in backlink growth or content freshness, and be cautious about drawing strategic conclusions from ranking data alone.

Fourth, if you are responsible for AI visibility and trying to ensure your content is cited by LLMs, do not assume that optimising for Google's normal search results is sufficient. Test whether AI systems are actually surfacing your content when asked relevant questions, and if they are not, investigate whether the grounding data they are using matches what you see in your own searches.

The wider implication

If Google is deliberately serving different results to automated systems than it shows to real users, the gap between what SEO tools report and what actually happens in the market widens. That gap has always existed to some degree, because tools sample data and users experience the full thing, but this is a different order of problem. This is the index owner actively working to make automated measurement less accurate.

That does not make SEO impossible. It makes it more dependent on first-party data, on instrumentation that sits inside your own analytics rather than outside it, and on the kind of forensic cross-referencing that a proper SEO audit has always required. It also makes it harder to rely on competitive intelligence tools that scrape rankings, because the rankings they scrape may not be the ones your competitors are actually benefiting from.

The long-term question is whether this is a temporary defensive measure or a permanent feature of how Google manages automated access to its index. If it is permanent, the tools adapt or they become less useful. If it is temporary, we are in a transitional period where ranking data needs to be handled with more scepticism than usual. Either way, the answer is the same: measure what matters, not what is easy to scrape, and treat ranking position as one signal in a larger picture rather than the picture itself.