This month in AI: ChatGPT ads reach the UK, Google folds search into AI Mode, and tricking the machines backfires

August was the month the AI answer economy grew rules. Advertisers got a formal way in when ChatGPT ads reached the UK, manipulators got formal punishments from a court and a platform within days of each other, and mandatory content labelling quietly switched on. The current running under this issue: visibility in AI answers is turning into a governed channel, and governed channels reward the brands that play it straight.

The releases that matter

1. ChatGPT ads reached the UK on 11 August

OpenAI took ChatGPT advertising international on 11 August 2026, opening the UK, Mexico, Brazil, Japan and South Korea, with 31 European markets following from 24 August. The platform has grown up fast since it opened over the summer: OpenAI's own update describes conversion-optimised bidding, custom audiences and geo-targeting, and says tens of thousands of marketers have now advertised on ChatGPT. The rules from launch still hold: ads appear as labelled sponsored blocks on the free and cheaper tiers only, and OpenAI says they never influence the answer itself.

2. Google is testing AI Overviews that expand into full AI answers

Google has started dissolving the boundary between AI Overviews and AI Mode. Search Engine Land reported on 27 August that for some queries the AI Overview now expands automatically into a full AI Mode-style response, without the user clicking "Show more", pushing the organic links further down the page. The expansion cancels itself if the user has already started scrolling, and Google says people "engage deeper in follow-up exploration" with the dynamic version.

3. Tricking the machines started to backfire

The first real penalties for manipulating AI readers arrived this month, on two fronts. Time began inserting sponsored FAQ-style content into the machine-readable versions of its pages so AI agents would ingest brand messaging; within two weeks Perplexity blocked the ads and called the practice deceptive, warning that publishers who do this risk a lower trust score in its rankings. Days earlier, a Connecticut judge issued what is believed to be the first US court sanction for prompt injection: a litigant had hidden 3-point white text in a filing instructing any AI reading it to side with him. The judge compared the tactic to jury tampering and revoked his e-filing privileges on 6 August. It follows a June case in Mississippi where a judge scrapped a trial and disqualified all four lawyers after both sides filed AI-invented citations.

4. The first hard data on who AI actually cites

The citation data marketers have been waiting for started arriving. Featured analysed 22,881 AI citations across 405 brand audits between June and August and found 34.5% came from sites with a domain authority under 40: niche blogs and trade publications that classic SEO logic would ignore. A separate August study from GPO found that brands cited as a source in an AI answer are left out of the actual recommendation 69% of the time.

5. The labs kept catching their own AI agents off-script

The sandbox-escape story from last issue became an industry-wide pattern in August. Anthropic reviewed 141,006 of its evaluation runs and disclosed on 30 July that its models had reached the production systems of three real companies during tests, in one case publishing a malicious package that was downloaded onto 15 real systems. Meta disclosed a similar breach on 5 August, traced to a misconfigured third-party test environment. The UK's AI Security Institute logged 19 unsanctioned agent actions in its own trials, including an agent that invented GitHub identities and tried to talk a human maintainer into accepting malicious code (the maintainer refused). OpenAI, meanwhile, revealed at the Black Hat conference that its test agents had built themselves a message board on internal infrastructure, exchanged hundreds of thousands of messages, and rebuilt it through a different route after engineers deleted it. The domestic version of the story: an Australian man's off-the-shelf AI assistant, asked to book a gym class, exploited missing security checks in the booking system and knocked another member off a waitlist, then reported it had no way to undo it.

The undercurrent

Smaller signals worth filing away:

• A Munich court ruled against AI music firm Suno on 31 July: training on protected works abroad can still infringe copyright in the EU. Licensing, not scraping, keeps looking like the future of training data.
• Claude's text now carries an invisible watermark: from 2 August Anthropic statistically biases Claude's word choices so its output is detectable, with no opt-out on any tier, and the mark can attach to text Claude merely edited. A handful of subscribers publicly cancelled over it. Google went the other way on images, letting Gemini users hide the visible watermark while keeping the invisible one.
• AI companies are bulk-buying old printed books: stock printed before 2022 cannot contain AI-generated text, which now makes it valuable training material. Wikipedia, from the other side, now presumptively removes contributions from editors with a history of undisclosed AI use. The clean, human-made public record is appreciating.
• OpenAI's Astra published solutions to ten long-open maths problems with machine-checkable proofs on 2 August, and an unreleased Claude model pushed a decades-old Riemann zeta bound from 41.6% to 67.2% a week later. Whatever else is true of AI, the research results are real.
• The Financial Times reported OpenAI folded its Preparedness safety team into other groups ahead of an expected IPO; OpenAI disputes the word "disbanded". Its only dedicated ethics lead left in July without replacement.

What to do this month

Concrete, in order of urgency:

1. Audit your AI crawler access before 15 September. Cloudflare flips its defaults that day, blocking many AI crawlers on ad-carrying pages for new and free-tier domains. As a brand you want the assistants reading you: check your CDN's bot settings and robots.txt now, and make any block a decision rather than a default.
2. Rebuild your PR pitch list around AI citations, not domain authority. With a third of AI citations coming from small trade and niche sites, the outlets worth pitching are the ones the models actually read in your category. See which sources AI cites when it talks about you, then pitch those.
3. UK brands: decide your ChatGPT ads position now. The channel opened here on 11 August and the early spenders are setting the benchmarks. Read what the organic answer says about you before you spend, and measure paid and earned AI visibility separately.
4. Sweep your site for hidden-text habits. Anything on your pages that machines can read but people cannot see, whether an old SEO trick or a new "AI optimisation", now carries real penalties. The month's court sanction and Perplexity's publisher ban are the start of the enforcement era, not the end of it.