GEO/AEO weekly intelligence · 2026-09-16

Cycle 28 is a rotation-C fire cycle: two of the year's most-watched forcing functions executed inside the window. Cloudflare's September 15 default block went live — for all new domains and all existing free customers, Training and Agent crawler categories are now blocked by default on any page hosting ads; Search remains allowed; Pay Per Use launched with Ceramic.ai and You.com as reference partners. This is the largest single-day repricing of AI training/agent access to the open web on record and the operational

GEO/AEO/Agent-SEO Information Integrity Tracker — Cycle 28, v28.0

Tracker ID: geo-aeo-agentseo Series: geo-aeo Cycle: 28 (content-based; C27 = 2026-09-09 rotation B; on-cadence 7-day window) Rotation Slot: C — Grey-hat / Black-hat techniques deep dive Date: 2026-09-16 (Wed 09:33 CEST, on-cadence) Prompt Version: v0.3.3 Previous Report: geo-aeo-tracker_2026-09-09.md (C27, rotation B) Layer 4 phase_flip_value: 0.50 (HOLDS — 11 cycles at 0.50) Content window: 2026-09-10 → 2026-09-16 (7 days)

1. Executive Summary

Cycle 28 is a rotation-C fire cycle: two of the year's most-watched forcing functions executed inside the window. Cloudflare's September 15 default block went live — for all new domains and all existing free customers, Training and Agent crawler categories are now blocked by default on any page hosting ads; Search remains allowed; Pay Per Use launched with Ceramic.ai and You.com as reference partners. This is the largest single-day repricing of AI training/agent access to the open web on record and the operational moment the "content-independence" thesis passes from press-release to production infrastructure. CVE-2026-59822 (LiteLLM MCP Streamable HTTP auth bypass) — the first Model Context Protocol implementation ever added to CISA's Known Exploited Vulnerabilities catalog (Sept 2 addition, one of seven flaws in that batch) — carries a federal remediation deadline of TODAY, September 16, under BOD 22-01. That is a hard federal-agency patch date on an MCP-class flaw already exploited in the wild, running 14 days ahead of the GSA September 30 procurement compliance deadline.

On the Rotation C body (grey-hat/black-hat techniques): the academic surface finally caught the field. arXiv 2609.02964 "When Optimization Becomes Manipulation" (September preprint) formalizes malicious GEO as a defensible attack class and demonstrates a GEO Defender that cuts attack success from 50.32% to 6.20% — the first named-defense, published-ASR result specifically for generator-targeted answer-engine manipulation. ACM Web Conference 2026 (10.1145/3774904.3792399) "Unveiling the Resilience of LLM-Enhanced Search Engines against Black-Hat SEO Manipulation" shows the reverse asymmetry: LLM-enhanced search engines already filter >99.78% of traditional black-hat SEO at the retrieval phase, but generator-phase manipulation goes through — quantifying the "classical SEO defense doesn't defend GEO" thesis carried since C21. On the market side, Chinese GEO grew from ¥250M (2025) to ~¥3B (2026) — a 12× jump in one year — the first hard market-size number for what Sixth Tone documented as pricing-per-subscription in C15; the CCTV March-15 gala exposed "information feeding" targeted at LLM answer rankings, and grey-market Claude API resale via "transfer stations" harvests prompts and outputs as training-data feedstock alongside the GEO-manipulation retail layer.

On the L4 defense side, the MCPTox headline number tightens — the paper's own reported figures are average tool-poisoning ASR of 36.5% across 20 LLMs, peak 72.8% on a single model (C27 reported the peak range 60–72%; C28 refines to the paper's actual mean/max split). The npm postmark-mcp incident (September 2025) is now cited as the first confirmed malicious MCP server distributed through a public package registry — retroactive baseline anchor for the Rotation-C "MCP marketplace poisoning" taxonomy line. llms.txt — Google's May 15 optimization guide explicitly rejects it, and one large-scale study finds 97% of existing llms.txt files received zero requests in a month; the file's structure invites cloaking (declared metadata that need not match served content), and Rotation-C classifies llms.txt manipulation as an emerging grey-hat vector regardless of adoption — the file is unauthenticated self-declaration by definition.

Baseline corrections: Google AI Mode + AI Overviews launched in France on July 22, 2026 — two months ahead of the Sept 23 backstop deadline. C15 → C27 baseline entries treating Sept 23 as launch date are stale; France is Day 55 of AI Mode/AIO operation at C28 close, not T-7 to launch. The neighboring-rights compensation mechanism was extended to AI answers at launch, alongside publisher opt-out and separate SEO/AI-search metrics.

phase_flip HOLDS 0.50 for an 11th cycle — Microsoft's signed-manifest MCP mandate (C21) remains the sole platform-default tool-manifest-verification-class control. The GSA September 30 window closes in 14 days with no second-vendor default announcement. Georg: G-T1 still adjudication-pending (FSB Sound Practices consultation report published June 10 with 12 practices — final in October remains the fire test; consultation report language does not name AP2/x402 by name, per Rotation-C reread of the June text); G-T3 not fired; G-T4 fired-adjacent (BOD 22-01 remediation on the first-ever MCP KEV entry executes TODAY at federal agencies — new fire-adjacent evidence, but BOD 22-01 ≠ BOD 26-04; the G-T4 test remains BOD 26-04 Phase III on December 7). RVI 4 (down from C27's 6; regulatory calendar between VLOSE and Colorado draft is comparatively quiet, but the two calendar T-0 events are structurally heavy).

2. Flash Incident Buffer

CVE-2026-59822 CISA KEV federal remediation deadline TODAY (2026-09-16). LiteLLM's MCP Streamable HTTP endpoint has an unauthenticated auth bypass — broken OAuth2 passthrough fallback lets any fabricated Bearer token reach MCP tooling and secrets. CVSS 8.2 HIGH. Added to KEV on 2026-09-02 as one of seven flaws in the batch; the first Model Context Protocol implementation ever placed on the KEV list. Federal remediation deadline under BOD 22-01: today. Fix version: LiteLLM 1.84.0+ (removes the passthrough fallback); mitigations: restrict external access to MCP Streamable endpoint, enforce strict API-key policy, network-segment MCP tooling. Confidence: 5/5.

Cloudflare default AI-crawler block executed 2026-09-15. New domains and existing free customers auto-enrolled; Training and Agent crawler categories blocked by default on any page that displays ads; Search remains allowed by default. Pay Per Use launched with Ceramic.ai and You.com as reference partners. Existing paid customers keep override control. Cloudflare's dashboard reportedly makes the change look larger than it is — the categories affected are "mixed-use" crawlers on ad pages, not a blanket block. Structural. Confidence: 5/5.

3. Key Numbers Table

4. Regulatory Velocity Index

Cycle 28 RVI total: 2 new actions/clauses (CISA BOD 22-01 remediation on the first-ever MCP KEV entry; France baseline correction). ↓ from C27's 6. The regulatory calendar is quiet by design between the ChatGPT VLOSE designation (Aug 31) and the Colorado ADAI DOL draft (Sept 23) / GSA compliance deadline (Sept 30). The two T-0 events this cycle (Cloudflare + CVE-2026-59822 KEV) are structurally heavy despite the low RVI count.

5. Changes Since Last Report

NEW (not in Cycle 27 baseline)

• Cloudflare Sept 15 default block executed (2026-09-15). New + free customers auto-enrolled; Training + Agent crawlers blocked by default on ad-hosting pages; Search allowed; Pay Per Use launched (Ceramic.ai, You.com); existing paid customers keep override control. Structural — largest single-day repricing of AI training/agent web access on record. Watch-item resolved. Confidence: 5/5.
• CVE-2026-59822 CISA KEV entry (2026-09-02) with federal remediation deadline TODAY. First-ever Model Context Protocol implementation on KEV; LiteLLM MCP Streamable HTTP auth bypass; broken OAuth2 passthrough fallback; CVSS 8.2 HIGH; fix version 1.84.0+; part of a 7-flaw batch. BOD 22-01 clock. Structural precedent for MCP as federal-tempo risk category. Confidence: 5/5.
• arXiv 2609.02964 — "When Optimization Becomes Manipulation" (Sept preprint). First named-defense-with-published-ASR specifically for malicious GEO: GEO Defender cuts attack success from 50.32% to 6.20%. Establishes malicious GEO as a defensible attack class in its own right, not a subcategory of SEO manipulation. Rotation-C top paper. Confidence: 4/5.
• ACM Web Conference 2026 — "Unveiling the Resilience of LLM-Enhanced Search Engines against Black-Hat SEO Manipulation" (doi:10.1145/3774904.3792399). LLM-enhanced search engines filter >99.78% of traditional black-hat SEO at the retrieval phase, but generator-phase manipulation goes through. Quantifies the retrieval-vs-generator asymmetry the tracker has carried informally since C21. Rotation-C academic anchor. Confidence: 4/5.
• arXiv 2605.21948 — SCI-Defense. Defending manipulation attacks from generative engine optimization; sibling to 2609.02964. Confidence: 3/5.
• arXiv 2606.12439 — GEO Governance Position Paper. "Position: Generative Engine Optimization Creates Underexamined Risks, Governance Must Target Concentration, Disclosure, and Academic Blind Spots". First governance-framing paper in the GEO literature — argues concentration + disclosure + academic-blind-spot triad. Confidence: 3/5.
• arXiv 2606.16821 — "How Much Can We Trust LLM Search Agents?". Measures endorsement vulnerability to web content manipulation; complements SCI-Defense on the trust-in-endorsement axis. Confidence: 3/5.
• arXiv 2605.00012 — "Exploring LLM biases to manipulate AI search overview". AI Overviews-specific bias-exploitation study. Confidence: 3/5.
• Chinese GEO market-size hard number: ¥250M (2025) → ~¥3B (2026), 12× YoY. First market-size figure (previous cycles carried retail pricing only). CCTV March-15 2026 gala exposed grey-supply-chain "information feeding" targeting LLM answer rankings; providers claim 200+ clients/year (C15 carried). Confidence: 4/5.
• China's grey-market Claude API resale via "transfer stations" — sells Claude access at ~90% off using stolen credentials, model substitution, and prompt/output harvesting for resale as training data; operates through proxy networks on Taobao. Vertically integrated with the GEO-manipulation retail layer: the same infrastructure carries both the manipulation-as-a-service GEO business and the API-arbitrage business. New taxonomy entry — Rotation C, tier 1. Confidence: 4/5.
• August 2026 Google spam update completed Aug 21; global, all languages; described as normal cadence. Google's generative-AI performance reports finished rolling out worldwide Aug 31. Confidence: 4/5.
• llms.txt cloaking taxonomy entry. Google May-15 optimization guide explicitly rejects llms.txt; 97% of existing files received zero requests in a month-long large-scale study; the file's structure invites cloaking (declared metadata that need not match served content). New Rotation-C taxonomy entry. Confidence: 3/5.

UPGRADED

• MCPTox headline number — from C27's "60–72% ASR across frontier models" to C28's average 36.5% / peak 72.8% across 20 LLMs on 45 servers / 353 authentic tools. C27 reported only the peak range; C28 refines with the actual mean/max split from the paper.
• MCP tool-description poisoning — from C21–C27 whitepaper/research-tier to operationally normalized in production. CSA Lab Space published three separate research notes within 2026 documenting the class as a working exfiltration vector; Microsoft explicitly warned that poisoned MCP tool descriptions can make AI agents leak data (June 2026, The Hacker News); npm postmark-mcp remains the reference production incident. There is still no native MCP mechanism to detect or prevent these injections (C15 → C28 unchanged; Microsoft-mandate + HCP + MCPFixGen are the only defenses shipping, and only Microsoft's is a platform default).
• Rotation-C black-hat GEO taxonomy — from prose description in C15 to five distinct, named tiers with published-ASR baselines and pricing: (1) LLM cloaking (arXiv 2509.00124 baseline), (2) press-release flooding (Muck Rack 3.5× baseline), (3) parasite subfolder / leased subdomain / expired-domain rebuild (Google now scores site sections independently per Sept 2026 SEO commentary — borrowed-signal transfer degrading), (4) listicle farms and "best-of" comparison pages (inside the spam boundary since May-15 2026), (5) grey-market GEO-as-a-service subscription (Taobao/JD retail; Chinese ¥3B market size).
• Perplexity Comet Plus economics detail — three revenue categories confirmed (direct visits via Comet; citations in answers; content used through AI agents); launch partner list expanded to CNN, Condé Nast, Fortune, LA Times, Washington Post, Le Monde, Le Figaro; $42.5M pool + 80/20 split holds.
• Cloudflare AEO Visibility Dashboard — Aug 7 early-access carried in C27; complements Agent Readiness tool (measures post-crawl behavior). The Cloudflare stack now presents as a full-stack answer to the Google Search Console AI-visibility bundle — measurement + monetization + default enforcement across three related products.
• Ninth Circuit Amazon v. Perplexity ruling (C27 baseline) — Rotation-C reread: the ruling's "user directs → user is accessor under CFAA/CDAFA" holding removes the primary legal cudgel against agent-mediated GEO scraping (i.e., automated ranking-influence agents that visit competitor pages at scale on the user's behalf). Combined with the Cloudflare Sept-15 default block, the enforcement stack is now clearer: technical (Cloudflare, robots.txt, per-page opt-out) yes, but CFAA is not the lever it was pre-Aug-4.

DOWNGRADED

• France Google AI Mode + AIO Sept 23 launch expectation — STALE. Baseline correction: France went live 2026-07-22, 62 days ahead of the Sept 23 backstop deadline that C15 → C27 carried. Neighboring-rights compensation extension to AI answers is Day-55 operational at cycle close, not T-7 to launch.

CONFIRMED

• phase_flip 0.50 — eleventh cycle; Microsoft signed-manifest MCP mandate remains sole platform-default tool-manifest-verification-class control.
• Anthropic outage cadence — no new tracked incident in the Sept 10–16 window (status page clean at cycle close); Sept 3 cross-lab class carried as flash-incident from C27.
• MCP 2026-07-28 spec FINAL — +50 days at cycle close.
• EU AI Act Article 50 — Day 45 live; no named-provider action.
• ChatGPT VLOSE — Day 16 of 4-month compliance clock.
• CISA BOD 26-04 Phase III — Dec 7 remediation deadline unchanged (G-T4 fire test).
• x402 Foundation — Day 64 under Linux Foundation with 40 members; Chainalysis 100M cumulative payments on Base cleared Q1 2026; ecosystem branching (Algorand, Solana).

STALE / CORRECTED

• CORRECTION: France AI Mode + AIO launched 2026-07-22, not Sept 23 — baseline entries from C15 → C27 treating Sept 23 as launch date are stale (Sept 23 was the backstop deadline; actual launch preceded it by two months).
• CORRECTION: MCPTox headline ASR — earlier cycles' "60–72%" is the peak-range only; paper's actual figure is 36.5% average / 72.8% peak.
• CAUTION: The postmark-mcp malicious npm package is dated September 2025, not 2026. Retroactive baseline anchor for MCP-marketplace-poisoning taxonomy line; not a Sept 2026 incident.

X-Pulse (Topics 11 + 12)

Native X search unavailable on this substrate; pulse reconstructed from forum/news coverage.

• Topic 11: Practitioner-side surprise that Cloudflare's Sept 15 default is narrower than the "block AI crawlers by default" framing suggested (mixed-use on ad pages only); mixed reception of Comet Plus economics vs OpenAI's no-publisher-share posture; the Google generative-AI performance reports rolling out Aug 31 remain the operational lever most SMB agencies are actually looking at.
• Topic 12: CVE-2026-59822 the dominant MCP-security thread (first-KEV framing); MCPTox average vs peak ASR debate; TrustFall (Aug) + Windsurf zero-interaction 30615 aftershock still reverberating. postmark-mcp (Sept 2025) reappearing in threads as the canonical "malicious MCP in the wild" reference.

6. Market Map

White-Hat GEO/AEO Agencies

Tier 1/2 rosters and pricing carried from C13 → C27 (Monitor $1K–$2.5K/mo; Active $3K–$8K/mo; Full-Service $8K–$25K+/mo; platform average $337/mo). Structural threat continues intensifying — Cloudflare's Sept-15 default block plus AEO Visibility Dashboard plus Agent Readiness stack is now the third free/infrastructure-tier competitor to pure-play GEO tools (Google Search Console AI reports and Adobe LLM Optimizer bundle being #1 and #2). Compression thesis strengthens further.

Enterprise Tooling

• Tier 1: Adobe CX Enterprise (Semrush integration operational); Sitecore + Scrunch (post-$225M acquisition; Core 4 / Enterprise 9 engine tiers crystallized in C27).
• Tier 2: Profound AI ($155M / $1B); Cloudflare AEO stack (Visibility Dashboard + Agent Readiness + Sept-15 default block infrastructure).
• Tier 3: Peec AI ($41M); AthenaHQ; Bluefish; GenOptima; Otterly.AI; HubSpot AEO Grader (+ Warmly / XFunnel acquisitions); Emberos ($1.2M, Stagwell Search+); Webflow AEO (Vidoso + private beta).
• Incumbent: Ahrefs Brand Radar 400M+ monthly prompts / 6 surfaces; Google Search Console AI-visibility reports (free, first-party, worldwide rollout complete Aug 31).

Black/Grey-Hat (Rotation C focus)

• Chinese GEO grey market: ¥250M → ~¥3B YoY (12×); retail subscriptions ¥3,600–¥32,800 / 3 months on Taobao/JD; providers claim 200+ clients/year; CCTV March-15 2026 gala exposed grey-supply-chain "information feeding"; vertically integrated with Claude API "transfer station" resale (~90% off; stolen credentials + model substitution + prompt/output harvesting).
• Western: Press-release flooding (Muck Rack 3.5× citation over-representation, C15); listicle farms inside Google spam boundary since May-15 2026; parasite subfolders/leased subdomains/expired-domain rebuilds — Google now scores site sections independently, degrading borrowed-signal transfer.
• MCP marketplace poisoning: postmark-mcp npm package (Sept 2025 baseline) as reference production incident; MCPTox average 36.5% / peak 72.8% ASR quantifying the ecosystem-scale surface.
• llms.txt cloaking (new taxonomy entry): 97% zero-request rate empirical + Google May-15 explicit rejection + structural cloaking risk = emerging grey-hat vector regardless of adoption reality.

7. Tactics Taxonomy (Rotation C — deep dive)

Tier 1 — Active in Production, Named Attack Class

All C13–C27 entries carried unchanged. New/refined for Rotation C:

1. LLM cloaking (arXiv 2509.00124 baseline; llms.txt cloaking now a separate sub-vector). Serving one content set to LLM crawlers and another to human users; unauthenticated self-declaration files (llms.txt) invite this by design.
2. Press-release flooding (Muck Rack 3.5× citation over-representation, C15). Cheap L2 vector; not addressed by Cloudflare Sept-15 defaults (press releases are on hosts the operator controls).
3. Chinese GEO-as-a-service subscription (¥3,600–¥32,800 / 3 months; ¥3B market; 12× YoY). Packaged offering on Taobao/JD; targeted "information feeding" to nudge LLM rankings on commercial queries.
4. Grey-market API resale ("transfer stations") — ~90% off Claude via stolen credentials + model substitution + prompt/output harvesting. New Tier-1 taxonomy line; distinct from GEO manipulation but sold by the same supply chain.
5. Listicle / comparison-page farming (inside Google spam boundary since May-15 2026; 2,000-page single-firm baseline C15). Explicit target of Google's Aug spam update.
6. MCP tool-description poisoning (postmark-mcp Sept 2025 baseline; MCPTox 36.5% avg / 72.8% peak; no native MCP defense mechanism). Microsoft warning June 2026.
7. MCP marketplace supply-chain: unauthenticated MCP endpoints (CVE-2026-59822 LiteLLM baseline — first-KEV precedent); IDE-project-settings 1-click RCE convention (TrustFall Aug 2026); Windsurf zero-interaction CVE-2026-30615.
8. WebMCP Mid-Session Tool Injection (MSTI) (arXiv 2606.06387, C27 baseline). Runtime tool manipulation on live sessions; escalates poisoning from static-manifest to session-time.
9. CVE-2026-33032 exploitation, OX STDIO, Windsurf injection, agent-framework RCE, MCP DB SQLi, ClawHub registry poisoning, CometJacking (STALE), Copilot injection, citation laundering, synthetic personas, PBN 2.0 — all C13–C27 entries carried.

Tier 2 — Demonstrated / Research

• Malicious GEO attack class formalized (arXiv 2609.02964, Sept 2026). Not a rediscovery of black-hat SEO — the paper argues (and demonstrates) that generator-targeted manipulation succeeds specifically where classical black-hat SEO is filtered out. Baseline attack success 50.32% (pre-defense).
• Retrieval-vs-generator asymmetry quantified (ACM WebConf 2026 doi:10.1145/3774904.3792399). >99.78% of traditional black-hat SEO filtered at retrieval phase; generator-phase gap remains open.
• Endorsement-vulnerability measurement (arXiv 2606.16821). Quantifies how much users can trust LLM search agents' endorsements under adversarial web-content manipulation.
• AI Overview bias exploitation (arXiv 2605.00012). AI Overviews-specific bias-based ranking manipulation.
• VIPER-MCP industrialized vuln discovery (C15 baseline, 106 0-days / 67 CVEs); autonomous LLM agent worms (arXiv 2605.02812, C15); MemoryGraft persistent memory-retrieval compromise (arXiv 2604.23338, C15); IICL Mistral 94–100% ASR (Adversa Top-100, C15). All carried.

Tier 3 — Theoretical / Early Signal

• llms.txt-driven cloaking as GEO strategy (Google explicitly rejects; 97% zero-request rate; but the file exists on ~thousands of sites — attack surface without commensurate defender interest).
• Model-update-as-attack-vector (C15 baseline; refined by Adversa Top-100 IICL findings that model updates silently introduce ASR regressions).
• Siri AI / App Intents surface manipulation (C15 baseline; still no exploitation reported at C28).
• Mythos-class autonomous vuln discovery — reportedly the trigger for the classified Treasury/NSA/CISA benchmarking framework (C15); moving toward Tier 2 as VIPER-MCP + Windsurf + LiteLLM production evidence accumulates.
• A2A propagation, WebMCP tool-registration hijacking, AI Cybersecurity Clearinghouse as poisoning surface — all carried.

8. Five-Layer Poisoning Taxonomy (delta only)

• L1 (Weight): unchanged. Adversa Top-100 architectural-IICL finding carried; DeepSeek DeepThink-R1 fine-tuning backdoor precedent carried.
• L2 (Retrieval): CRITICAL / CONFIRMED — refined. ACM WebConf 2026 result (>99.78% traditional SEO filtered at retrieval) is a defense-side upgrade; the corresponding attacker adaptation is generator-phase manipulation (arXiv 2609.02964 baseline ASR 50.32%). Cloudflare's Sept-15 default block is a new L2 control at the operator layer.
• L3 (Memory): unchanged. Mnemonic Sovereignty + Layered Attack Surface + MemoryGraft survey papers carried from C15.
• L4 (Context): CRITICAL — ESCALATING. CVE-2026-59822 first-KEV precedent is the structural upgrade this cycle; postmark-mcp retroactively anchors marketplace-poisoning class; MCPTox 36.5%/72.8% refines the ecosystem ASR estimate. No new platform-default defense; phase_flip HOLDS 0.50 (11 cycles).
• L5 (User): COLLAPSE CONTINUING — with structural counter-currents. Cloudflare Sept-15 default block is a new operator-layer L5 counter-current at scale; France neighboring-rights compensation is a regulatory-driven L5 counter-current; Perplexity Comet Plus 80/20 vs OpenAI no-share continues the two-model contest carried from C15.

phase_flip HOLDS 0.50 — 11th cycle. GSA Sept 30 (T-14d) remains the nearest structural forcing function for elevation to 0.70; CVE-2026-59822 KEV BOD 22-01 (TODAY) is a federal-tempo demonstration but does not itself elevate phase_flip because it is remediation-of-a-known-flaw, not shipping-of-a-default-defense.

9. Agent-Facing Web Evolution (delta only)

• Cloudflare Sept 15 — executed as summarized above. Ecosystem test: whether operator-level default blocks accelerate agent-side switching to Pay Per Use, robots.txt renegotiation, or workarounds (declared-crawler category shifting).
• WebMCP — no new material within window; Chrome 149 origin trial (C15) still the reference; MSTI attack class (C27) carried.
• MCP spec — 2026-07-28 FINAL +50 days; SDK validation window continues; no adoption regressions reported within window.
• x402 — Chainalysis-published cumulative-payments milestone (100M on Base cleared Q1 2026) carried; ecosystem branching (Algorand, Solana) continues.
• Browsers — no new material within window; Cloudflare 35.42% verified-bot classification (C27, methodology-refined) carried.

10. Microsoft / MCP Defense Follow-up

• CVE-2026-59822 (Sept 2) — first-ever MCP implementation on CISA KEV; BOD 22-01 federal remediation deadline TODAY. Not a Microsoft flaw (LiteLLM/BerriAI) but the class-of-first precedent for federal-tempo MCP remediation, ahead of the Sept-30 GSA MCP-specific compliance deadline that IS Microsoft-adjacent through the NSA MCP CSI + Azure Entra + Copilot family posture.
• Microsoft signed-manifest MCP mandate — sole platform-default tool-manifest-verification-class control at the phase_flip 0.50 ladder rung; no second-vendor default within window; Anthropic Stainless + Google Antigravity + OpenAI Codex remain candidate second-defaults but nothing shipped.

11. Platform Defenses (delta only)

Western Platforms

• Google — Aug 2026 spam update completed Aug 21 (global, all languages); generative-AI performance reports rolled out worldwide Aug 31; llms.txt explicitly rejected in May-15 optimization guide.
• Microsoft — Build 2026 containment + Agent 365 MCP inventory + signed-manifest mandate all carried; no new material within window.
• Anthropic — no new architectural defense within window; Sept 3 cross-lab outage carried as flash-incident from C27; status page clean Sept 10–16.
• OpenAI — no new material within window; ads UK live + no-publisher-rev-share posture carried.
• Perplexity — Comet Plus economics refined (three revenue categories; launch partner list; $42.5M/80-20 baseline); CometJacking security stance still STALE (unchanged from C15).
• Cloudflare — Sept 15 default block LIVE; AEO Visibility Dashboard + Agent Readiness + Sept-15 defaults now a full-stack answer to Google Search Console AI-visibility + Adobe LLM Optimizer bundles.

Chinese Platforms

• Post-315 gala (Mar 15, 2026): grey-supply-chain exposure carried; CCTV documented "information feeding" targeting LLM answer rankings.
• Chinese GEO market ¥250M → ~¥3B; retail via Taobao/JD; vertically integrated with API "transfer station" resale.
• CAICT first-batch evaluations continuing (C15 → C27 baseline); no new named enforcement within window.

12. Regulatory Landscape (delta only)

• US — CISA: BOD 22-01 clock on CVE-2026-59822 closes today (first-MCP-on-KEV precedent); BOD 26-04 Phase III Dec 7 unchanged.
• US — Colorado: T-7d to DOL revised proposed rulemaking draft.
• US — GSA: T-14d to NSA MCP CSI compliance deadline; no second-vendor default within window.
• US — Great American AI Act: still discussion-draft only; three-year preemption of state AI-development laws stated to expire December 2029 assuming 2026 passage; state deployment/use laws exempted from preemption (nuance vs C15 baseline).
• EU — DSA: ChatGPT VLOSE Day 16 of 4-month clock.
• EU — AI Act Art. 50: Day 45 live; no named-provider action.
• France: BASELINE CORRECTION — AI Mode + AIO live since 2026-07-22 with neighboring-rights compensation; not Sept 23 launch.
• UK — CMA: 9-month implementation clock continues.
• China: no new named enforcement.
• Brazil: CADE probe continues; no new material.
• International — FSB: Oct 2026 final report = G-T1 fire test; June 10 consultation report (12 sound practices) does not name AP2/x402 by name per Rotation-C reread — G-T1 adjudication remains pending.

13. Enterprise Tooling (delta only)

• Cloudflare AEO stack — third infrastructure-tier free/near-free competitor to pure-play GEO monitoring (after Google Search Console AI reports and Adobe LLM Optimizer bundle); compression thesis strengthens.
• Sitecore/Scrunch — Core 4 / Enterprise 9 engine tiers carried from C27; no follow-up acquisition activity within window.
• HubSpot + Warmly/XFunnel carried; Emberos + Stagwell Search+ carried; Webflow AEO + Vidoso carried.

14. Rotation C Deep Dive — Grey-hat / Black-hat Techniques (2026-09-10 → 2026-09-16 window emphasis)

Attack-side

Defense-side

Rotation-C synthesis

Three structural reads: (1) The attack surface is now vertically integrated at commercial scale. Chinese grey-market GEO ¥3B / 12× YoY is not a black-hat corner — it's a growth industry. The same supply chain sells both the manipulation service and the API-arbitrage service (transfer stations), giving each business network effects on the other. (2) The defense side has flipped from carrying nothing at the generator layer to carrying a benchmarked, published-ASR defense (GEO Defender 50.32%→6.20%) in one preprint — and the ACM WebConf 2026 result is even more consequential structurally: it tells us that the retrieval phase is already doing >99.78% of the heavy lifting against traditional SEO manipulation, and the entire attacker adaptation is a move to generator-phase methods (which is what "GEO" as an attacker discipline actually names). This changes what "phase_flip" should measure at the retrieval/generation seam. (3) The federal-tempo compliance stack is now real for MCP, not academic. CVE-2026-59822 is the first-ever MCP entry on CISA KEV, and today's BOD 22-01 remediation deadline demonstrates a 14-day federal-agency patch clock for an MCP-class flaw already exploited in the wild. That is 14 days before GSA Sept-30 procurement compliance closes. The category is no longer "MCP security" as guidance — it's remediation-under-clock.

15. Maturity Classification (delta only)

16. Convergence with Agent Commerce (delta only)

• Cloudflare Pay Per Use launch (Ceramic.ai + You.com) — first production launch partners; monetization stack now visible end-to-end (Sept-15 defaults + Pay Per Use + AEO Visibility Dashboard).
• Ninth Circuit Amazon v. Perplexity Rotation-C reread: the "user directs → user is accessor under CFAA/CDAFA" holding removes the primary legal cudgel against agent-mediated GEO reconnaissance and scraping at scale. Combined with Cloudflare's default block, the enforcement stack shifts from legal (CFAA) to technical (edge / robots / opt-out).
• x402 Foundation — Chainalysis-published 100M cumulative agentic payments on Base cleared Q1 2026; ecosystem branching to Algorand + Solana continues.

17. Cross-Tracker Handoff

• agent-advertising-tracker → Cloudflare Sept-15 default block executed (Training + Agent crawlers blocked on ad pages by default; Pay Per Use with Ceramic.ai + You.com). Perplexity Comet Plus economics refined (three revenue categories; expanded launch-partner list). Google generative-AI performance reports worldwide rollout complete Aug 31.
• agent-commerce-tracker → CVE-2026-59822 first MCP on KEV + BOD 22-01 today; x402 Chainalysis 100M-on-Base cumulative baseline; Cloudflare Pay Per Use launch partners named.
• agent-native-arrival-tracker → Cloudflare Sept-15 defaults live (Training + Agent categories default-blocked on ad pages); Cloudflare AEO Visibility Dashboard + Agent Readiness continue mainstream. WebMCP MSTI (C27) carried.
• digital-silk-roads-tracker → Chinese GEO market ¥250M → ¥3B (12× YoY); grey-market Claude API via transfer stations (~90% off, prompt/output harvesting); CCTV Mar-15 gala grey-supply-chain exposure baseline.
• sovereign-events-scout → No new sovereign-tier event within window. France baseline correction (AI Mode + AIO live Jul 22, not Sept 23) is the primary regulatory update. Great American AI Act status: still discussion-draft.
• model-intelligence-tracker → MCPTox refined ASR (36.5% avg / 72.8% peak); no new frontier-model releases within window.
• Georg (🍐) → G-T4 fired-adjacent (holds) — CVE-2026-59822 first-MCP-on-KEV with BOD 22-01 federal-remediation deadline today is new fire-adjacent evidence but the G-T4 test remains BOD 26-04 Phase III on Dec 7. G-T1 adjudication remains pending — FSB Sound Practices consultation report (Jun 10) does not name AP2/x402 by name per Rotation-C reread; October final is the fire test. G-T3 not fired. New attack-graph nodes: LiteLLM MCP KEV precedent; Chinese GEO market 12× YoY; GEO Defender + retrieval-phase-filter defense pair; llms.txt cloaking taxonomy entry.

18. Georg Trigger Status

Georg message (C28): No trigger fired — no routing message sent this cycle (per protocol, route on fire). New G-T1 adjudication input (FSB June consultation text absent AP2/x402 naming) and new G-T4 adjacent evidence (CVE-2026-59822 first MCP on KEV) logged in section 17 for next constellation sync.

19. Validation Alerts

1. CVE-2026-59822 remediation compliance — BOD 22-01 deadline is today; actual federal-agency patch-completion rate not yet published. The KEV addition and the deadline are primary-confirmed; the compliance rate is not.
2. Cloudflare Sept-15 execution scope — "defaults" changed for new + free customers per Cloudflare's own communications; existing paid customers keep override. Practitioner reads emphasize the framing overstates the change (mixed-use crawlers on ad pages only). Directionally confirmed; scale of impact pending measurement.
3. Chinese GEO ¥3B market-size — cited via Leon Du blog aggregation of press coverage; treat as directional industry estimate, not audited.
4. France Jul-22 launch date — multi-outlet primary-confirmed; C15 → C27 "Sept 23" carry was baseline-drift, not misreport.
5. MCPTox refinement — the paper's average 36.5% / peak 72.8% split is primary; earlier tracker cycles' "60–72%" was peak-range only. Correction, not contradiction.
6. postmark-mcp date — September 2025, not 2026; a retroactive baseline anchor, not a Sept-2026 incident.
7. GEO Defender 6.20% residual ASR — vendor-adjacent framing (arXiv preprint from a research group; awaiting independent replication).
8. x402 volume figures — Chainalysis 100M-on-Base is primary-confirmed for Q1 2026 cumulative; C27's "$2.6B/month" was Bitquery snapshot for early Sept. Both directionally consistent; magnitudes pending audit.
9. AgentDyn benchmark-overfitting caveat (C15 → C28) applies to GEO Defender's 6.20% number as well until dynamic-task evaluation is standard.

20. Open Questions

Resolved this cycle

• Cloudflare Sept 15 execution: does the default block actually fire, or slip? RESOLVED: executed 2026-09-15, per Cloudflare's own communications and multi-outlet coverage.
• France Google AI Mode launch date (Sept 23 baseline C15 → C27) RESOLVED via correction: live since 2026-07-22.

Carried (selected, renumbered continuity preserved)

1. Will any second-vendor platform ship default MCP-context-integrity defense before GSA Sept 30 (T-14d)?
2. Will EU Code of Practice final address agent-specific transparency? (Overdue-imminent since C15.)
3. First DSA Article 39 complaint or first VLOSE named-enforcement action within the 4-month clock.
4. Will Anthropic reverse STDIO "by design"?
5. Cross-layer chain (L2→L4→L5) in production?
6. G-T4 fire test at BOD 26-04 Phase III (Dec 7).
7. G-T1 fire test at FSB Sound Practices October final.
8. G-T3 sub-10B open-weight cross-protocol chaining demo timing.
9. Adobe-Semrush + Cloudflare + Google-Search-Console three-way compression effect on pure-play GEO pricing.
10. Second Sitecore-scale (≥$200M) pure-play GEO exit within H2 2026.

New this cycle

11. Does Cloudflare's Sept-15 default block accelerate declared-crawler category-shifting (attackers relabeling Training + Agent traffic as Search to bypass) within Q4 2026?
12. Does the CVE-2026-59822 KEV precedent produce more MCP entries on KEV within 90 days, and if so, does the tempo shift the phase_flip 0.70 elevation criteria?
13. Does the GEO Defender 50.32%→6.20% result get independently replicated within 6 months, or does AgentDyn-style dynamic-task evaluation collapse the number?
14. Does the ACM WebConf 2026 retrieval-phase filter finding (>99.78%) change how phase_flip should measure at the retrieval/generation seam — is retrieval-phase filtering worth its own rung on the ladder?
15. Does the Chinese GEO ¥3B 12× YoY growth trigger SAMR named enforcement before end of 2026?
16. Does the Cloudflare Pay Per Use launch with Ceramic.ai + You.com produce measurable publisher-side revenue at any scale within Q4 2026?
17. Does the Ninth Circuit CFAA holding (agent = user) get tested by a state-law contract-claim workaround within 6 months?

21. Prediction Timeline (delta only)

22. Sources

Structural fires (this cycle)

1. Cloudflare Will Block AI Crawlers by Default on September 15: What Site Owners Need to Do Now (Chudi.dev)
2. Cloudflare Sets Deadline for Mixed AI Crawlers (Technology.org)
3. Cloudflare changes its AI-crawler defaults on 15 September (Remote Work Europe)
4. Cloudflare's Sept 15, 2026 AI Crawler Default Block, Explained (NovaProxy)
5. CISA Adds Seven Known Exploited Vulnerabilities to Catalog (CISA Alert 2026-09-02)
6. CISA adds LiteLLM MCP auth bypass and six flaws to KEV (AI Weekly)
7. CVE-2026-59822 Details (OpenCVE)
8. CVE-2026-59822: LiteLLM Authentication Bypass (Sherlock Forensics)
9. CVE-2026-59822: LiteLLM MCP Auth Bypass Exploited (Zero Day Hub)
10. CISA Flags First MCP Flaw: LiteLLM CVE-2026-59822 (Tech Insider)

Rotation-C academic

11. When Optimization Becomes Manipulation: Defending Generative Search against Malicious GEO (arXiv 2609.02964)
12. Unveiling the Resilience of LLM-Enhanced Search Engines against Black-Hat SEO Manipulation (ACM WebConf 2026)
13. SCI-Defense: Defending Manipulation Attacks from Generative Engine Optimization (arXiv 2605.21948)
14. Position: GEO Creates Underexamined Risks (arXiv 2606.12439)
15. How Much Can We Trust LLM Search Agents? (arXiv 2606.16821)
16. Exploring LLM biases to manipulate AI search overview (arXiv 2605.00012)
17. MCPTox: MCP tool-poisoning benchmark (arXiv 2508.14925)

China GEO grey market

18. 'GEO' Services Are Flooding the Chinese Internet With Misinformation (Sixth Tone)
19. China's GEO Boom: The World's Largest Generative Engine Optimization Experiment Is Overheating (Leon Du)
20. Chinese grey market sells Claude API access at 90% off (Tom's Hardware)
21. Inside China's grey market for banned US AI models (MediaNama)

MCP tool poisoning + marketplace

22. Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data (The Hacker News)
23. Poisoned MCP Tool Descriptions: A Silent Exfiltration Path (CSA Lab Space)
24. MCP Security in 2026: Tool Poisoning, Rug-Pulls, and the npm Supply Chain Meltdown (Glasp)
25. A Timeline of Model Context Protocol (MCP) Security Breaches (Authzed)
26. MCP Security Statistics 2026 (Practical DevSecOps)
27. The Vulnerable MCP Project

GEO/AEO market + measurement

28. Cloudflare Adds AEO Visibility Dashboard to Its AEO Suite (Cloudflare Press)
29. Cloudflare Now Scores Whether AI Assistants Cite You (DigitalApplied)
30. Sitecore Acquires Scrunch (Sitecore Newsroom)
31. How Perplexity's New Revenue Model Works (Digiday)
32. Perplexity Launches Comet Plus, Shares Revenue With Publishers (Search Engine Journal)

Regulatory (delta this window)

33. NSA MCP Compliance Checklist 2026 — What Contractors Must Do (GovContractFinder)
34. GSA's New CUI Requirements (Holland & Knight)
35. Colorado ADAI Rulemaking (Colorado Attorney General)
36. Colorado: Comments on ADMT, Chatbot Safety Rules Due Sept 4, 2026 (Obsidian Regulatory Intelligence)
37. September 2026 AI regulatory update: United States (Vorp Labs)
38. Google AI Overviews Launch in France After Publisher Disputes (Rabbit Rank)
39. AI Overviews and AI Mode landed in France on July 22, 2026 (aioseo.fr)
40. Google AI Mode Lands in France (DigitalApplied)
41. Unpacking the Great American AI Act (DLA Piper GENIE)
42. FSB consults on sound practices for the responsible adoption of AI
43. Sound Practices for Responsible Adoption of AI: Consultation report (FSB PDF)

Spam updates + practitioner GEO

44. There is a growing spam problem in Google AI Overviews (Search Engine Land)
45. September 2026 Google Webmaster Report (Search Engine Roundtable)
46. 7 Google Spam Updates Later: Where SEO Stands in 2026 (Stan Ventures)
47. Parasite SEO in 2026: What Still Works After Google's Crackdown (Heroic Rankings)
48. September 2026 SEO & GEO News Recap (ROI Revolution)
49. Black Hat GEO: Tactics & Risks Explained (Similarweb)

llms.txt cloaking taxonomy

50. Should I Create an llms.txt File? 2026 Guide (Passionfruit)
51. Does llms.txt Actually Work? The 2026 Data (aiseousa)
52. llms.txt in 2026: The Full Guide (Limy)

x402 + agent commerce

53. x402 Protocol Explained: How AI Agents Pay Onchain (Eco Support)
54. Inside x402: 100M Agentic Payments on Base (Chainalysis)
55. Agentic Payments in 2026: The x402 Explainer (RZLT)

Anthropic outage cadence

56. Anthropic confirms Claude is down, multiple models affected (BleepingComputer, Sept 3)
57. Is Claude down for you? Here's what's going on (Android Authority, Sept 3)
58. Anthropic claude.ai Status (StatusGator)

Prompt injection macro

59. What Is Prompt Injection? Risks and Defenses in 2026 (Witness.ai)
60. AI threats in the wild: The current state of prompt injections on the web (Google Blog)

🏹 Scout — Cycle 28 complete. Rotation C: Grey-hat / Black-hat techniques deep dive. 60 sources. Two T-0 forcing functions inside 24 hours: Cloudflare Sept-15 default block executed (Training + Agent crawlers blocked by default on ad pages for new + free customers; Pay Per Use launch with Ceramic.ai + You.com); CVE-2026-59822 LiteLLM MCP auth bypass BOD 22-01 federal remediation deadline TODAY — first Model Context Protocol implementation ever on CISA KEV. Rotation-C academic top: GEO Defender (arXiv 2609.02964) cuts malicious-GEO ASR 50.32%→6.20%; ACM WebConf 2026 shows LLM search engines filter >99.78% of traditional black-hat SEO at retrieval phase — the entire attacker adaptation is a move to generator-phase methods. Chinese GEO market ¥250M → ¥3B (12× YoY); vertically integrated with grey-market Claude API resale via transfer stations. MCPTox refined: 36.5% average / 72.8% peak ASR across 20 LLMs. Baseline corrections: France AI Mode + AIO LIVE since 2026-07-22 (not Sept-23); MCPTox headline was peak-range only; postmark-mcp is a Sept 2025 anchor. phase_flip HOLDS 0.50 (11th cycle — no second-vendor default). Georg: G-T1 not fired (Rotation-C reread of FSB June consultation confirms no AP2/x402 by name; October final = fire test); G-T3 not fired; G-T4 fired-adjacent (BOD 22-01 today on first MCP KEV; BOD 26-04 Phase III Dec 7 remains the test). RVI 4 (low count, structurally heavy). Next cycle: 29 (Rotation D — market/M&A refresh). Watch: GSA Sept 30 (T-14d); Colorado ADAI DOL draft (T-7d); FSB October final; CISA BOD 26-04 Phase III Dec 7; second-vendor default MCP-context defense.