ChatGPT Search's site: Operator Use Jumped 46x — What It Means for AI Security

On 20 August 2026, researcher Simon Willison flagged a sharp, undocumented change in how ChatGPT Search behaves. The evidence comes not from OpenAI but from Promptwatch, a Generative Engine Optimization (GEO) vendor that logs aggregate, anonymized query telemetry — over 26 billion data points, by its own account — pulled from the actual interfaces of ChatGPT, Gemini, Perplexity and others.

What the data shows

For weeks before early August, Promptwatch's data put site:-scoped searches at roughly 0.3-0.5% of ChatGPT's internal "fanout" queries — the sub-searches the model issues to answer a single prompt — dipping briefly to 0.15% between August 3-5. On 8 August 2026 that figure jumped to 16.8%, a roughly 46x increase in a single day. In the same window, the average number of fanout searches per ChatGPT response nearly doubled, from about 1.08 to 1.83. The timing lines up with OpenAI's own announcement of an update to GPT-5.6 Sol on 6 August, though OpenAI has not published details of a search-behavior change, and Willison notes the underlying tool most likely takes a structured search(query, recency, domains) call rather than literally emitting site: syntax.

Why this matters beyond SEO/GEO

The GEO industry reads this as a ranking-visibility story — which domains get pulled into more answers. For a security team, the more interesting read is architectural: ChatGPT is now scoping a materially larger share of its live web-search activity to specific domains, and issuing more searches per turn overall. Both changes enlarge the amount of live, third-party web content flowing into a session that the model treats as trustworthy context.

That's the same trust boundary abused in indirect prompt injection — where instructions hidden in a web page, comment, or indexed document are fetched by an AI's search or browsing tool and interpreted as commands rather than data. A higher fanout rate and heavier domain-scoping means more surface area for that class of attack, and it raises the stakes on AI-search poisoning: crafting or manipulating pages so they are both GEO-optimized for visibility and payload-carrying for any assistant that ingests them uncritically.

There's a second, quieter lesson. This behavior change was not disclosed by OpenAI — it was reverse-engineered from usage analytics by an outside vendor. Enterprises building on claude -p, ChatGPT, or any hosted search-augmented assistant are, in practice, depending on tool behavior that can shift without notice or changelog. Threat models and guardrails written against last month's fanout pattern may already be stale.

What defenders should take from this

• Treat any content your organisation publishes as a potential injection vector into AI answers, not just a ranking target — GEO hygiene and prompt-injection hygiene are converging concerns.
• If you operate a RAG or agentic system with a web-search or browsing tool, assume the underlying search/fanout behavior can change upstream without warning, and re-test injection defenses periodically rather than once.
• Don't rely on vendor disclosure to catch these shifts — independent telemetry (Promptwatch's here) is currently the only way this particular change was surfaced at all.

None of this means ChatGPT Search is newly "unsafe" — domain scoping can just as easily be read as OpenAI narrowing search rather than widening it. But a 46x jump in scoped queries, discovered by accident and still undocumented ten days later, is exactly the kind of silent capability drift that AI-security teams should be tracking, not just GEO consultants.