搜索增强型大语言模型（LLM）正越来越多地通过检索实时网页内容来介入日常消费推荐。这带来了一种新的风险：LLM 推荐系统可能会消费被生成式引擎优化（GEO）运营者污染的网络内容，从而被误导。我们要问：它们在多大程度上会成为虚假产品的无意推广者？我们推出了 FORGE（生成式环境中的虚假在线推荐）基准，该基准在固定的检索网页集合中，将真实产品本地改写为虚假产品，并衡量 LLM 推荐虚假产品的频率，覆盖 15 个类别、5 个消费场景下的 225 个真实产品。在 12 个商业及开源权重 LLM 中，所有模型均存在脆弱性：单个被污染的页面即可导致高达 27% 的被欺骗率，而完全替换前 3 个结果则可将该比例提升至 73.8%。脆弱性因类别而异，当模型缺乏对产品的稳定先验知识时，脆弱性会增加。推理并不能缓解这种脆弱性；相反，它常常生成虚假的社会认同来为错误推荐辩护。四种防御措施均不充分：怀疑提示（skepticism prompt）可能像推理一样加剧脆弱性，两种共识过滤器有压制合法产品的风险，而可信度重排序虽对所有模型都有帮助，但只能清除六分之一的虚假内容。我们在 https://github.com/leoluolol/forge-benchmark 发布了 FORGE 基准和评估代码。
Search-augmented LLMs increasingly mediate everyday consumer recommendations by retrieving live web content. This creates a new risk: LLM recommenders may consume web content that Generative Engine Optimization (GEO) operators have polluted to mislead them. We ask: to what extent do they become unwitting promoters of fake products? We introduce FORGE (Fake Online Recommendations in Generative Environments), which locally rewrites real products in a frozen set of retrieved web pages into fake ones and measures how often the LLM recommends the fake product, across 225 real products in 15 categories and 5 consumer scenarios. Across 12 commercial and open-weights LLMs, all models are vulnerable: a single polluted page yields fooled rates of up to 27%, while the full top-3 replacement raises this to 73.8%. Vulnerability varies across categories, increasing when models lack stable prior knowledge of the products. Reasoning does not mitigate this vulnerability; instead, it often generates spurious social proof to justify false recommendations. None of the four defenses is adequate: the skepticism prompt can exacerbate vulnerability much like reasoning, the two consensus filters risk suppressing legitimate products, and credibility re-ranking helps every model but removes only a sixth of the fakes. We release the FORGE benchmark and the evaluation code at https://github.com/leoluolol/forge-benchmark.