Scammers Exploit Site Search Boxes to Fool AI Summaries Into Endorsing Fraud

·1 views

Japan's Metropolitan Police recently revealed a scam where fraudsters manipulate website search boxes to generate fake legitimacy for investment schemes. Attackers craft URLs on trusted domains — such as 'acme.com/search?q=XX+is+not+a+scam' — which search engines like Google then crawl and index as real page content. Because AI-powered search summaries pull from these indexed results, they can surface fabricated endorsements like 'XX is not a scam' under reputable domain names. The targeted websites are never hacked or compromised; the attack requires nothing more than building a URL and linking to it from attacker-controlled sites. Developers can defend against this by applying noindex tags, X-Robots-Tag headers, or returning 404 responses on zero-result searches to prevent these pages from being indexed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EYG: New Programming Language Designed With Human Usability in Mind

A developer has introduced EYG, a programming language built with a focus on human-centered design. The project was shared on June 8, 2026, via a personal blog post by its creator. EYG aims to address common pain points programmers face with existing languages by prioritizing usability and accessibility. The announcement was posted to Hacker News, where it attracted early community attention. Details about the language's syntax and features are available on the author's website.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why Enterprise AI Agents Need Runtime Policy Gates, Not Just Prompt Rules

Relying on system prompt instructions to restrict AI agent behavior is insufficient, as probabilistic language models can bypass such guidance under adversarial or complex reasoning conditions. Security experts recommend moving policy enforcement out of the prompt window and into deterministic runtime execution gateways to address the OWASP LLM08 excessive agency risk. A four-tier action classification framework categorizes agent tasks by risk and reversibility, ranging from autonomous read-only queries to high-risk irreversible operations like database deletions or wire transfers that require mandatory human approval. Technical controls such as JSON Schema validation on tool parameters and sidecar policy engines like Open Policy Agent ensure decisions are evaluated independently of the model's internal reasoning. For critical actions, state-preserving circuit breakers pause agent execution and route a dry-run preview to a human approval queue before any irreversible operation proceeds.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Low-Cost RL Fine-Tuning of 9B Model Reportedly Rivals Frontier AI on Catalog Tasks

A report claims that a small open-source 9-billion-parameter language model, fine-tuned using reinforcement learning at a cost of approximately $500, outperformed larger frontier models on a catalog review task. The findings were published on the Fermisense blog. The claim highlights growing interest in cost-efficient fine-tuning techniques as alternatives to expensive large-scale model training. However, the limited engagement on Hacker News — just 3 points and no comments — suggests the results have not yet received broad peer scrutiny. Full methodology and benchmark details would need to be reviewed to assess the validity of the comparison.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Seeks Best OCR Tool to Grade Handwritten Gaokao Math Answers

A developer building an English-language Gaokao math exam platform is searching for a reliable OCR solution to automatically grade handwritten student responses. The challenge is complex because answers often span half a page and include fractions, square roots, crossed-out formulas, and geometry diagrams written under time pressure. Tools under consideration include Mathpix, MyScript iink, Google Cloud Vision, Azure Document Intelligence, and the open-source model TrOCR, each with distinct trade-offs between accuracy and implementation effort. The developer plans to use separate recognizers for formulas and plain handwriting, retain positional and confidence data for each recognized element, and flag unreadable lines as provisional rather than defaulting to a zero score. A real-world test set using authentic Gaokao-style handwriting, including messy and crossed-out samples, is yet to be built before any tool is adopted.

0 comments Read more at DEV Community