On 29 June 2025, an AI search researcher published a neat little growth hack. Put a row of buttons at the top of your article. Each one opens an AI assistant with a prompt about your page already typed in. Do that, the argument went, and you'll get cited more often.
By 10 February 2026, Microsoft Security had catalogued the aggressive version of that same tactic as an attack class. It has a MITRE ATLAS entry now.
Seven months. Growth hack to threat model.
I built them anyway. They're sitting at the top of this page, with the risky part stripped out.
So here's the honest version: what these buttons actually are, what the evidence says once you go and read it, and how to build a set that won't age badly on you.
Key Takeaways
- An LLM share button opens an AI assistant with a prompt about your page already typed into it
- Metehan Yesilyurt named and popularised the tactic on 29 June 2025, calling it the CiteMET method
- The citation claim behind it has exactly one independent test, and that test failed to reproduce it
- The aggressive "remember this source" variant is now catalogued as AI Recommendation Poisoning
- The buttons still have a real, defensible use, as a reading affordance rather than a memory hack
What an LLM Share Button Actually Is
An LLM share button is a link at the top of an article that opens ChatGPT, Claude, Perplexity, Grok or Google AI Mode in a new tab, with a prompt about that page already sitting in the composer. The reader clicks once and gets a summary of the page. That's the whole feature.
Think of it like a social share button pointed at an AI assistant instead of a social network. Same idea, different destination.
The mechanism is much dumber than people assume. There's no API, no integration, no JavaScript needed for the link itself. It's a plain anchor tag. The prompt travels in the query string, URL-encoded, and the assistant reads it on page load.
The shape looks roughly like this:
https://chatgpt.com/?q=Summarise%20this%20article%3A%20https%3A%2F%2Fyoursite.com%2Fpost
Every platform names that parameter differently, and that is where almost all of the trouble lives. More on that shortly.
Where It Came From: Metehan and the CiteMET Method
Metehan Yesilyurt published the tactic on 29 June 2025 and shipped a WordPress plugin for it the same day. The plugin repo was created at 21:33 UTC on 29 June, which is solid corroboration on the date.
The method got a name: CiteMET, standing for Cited, Memorable, Effective and Trackable. Metehan is an AI search researcher who has spoken at BrightonSEO, and the original post is still up.
Two lines from it did most of the travelling: "AI share buttons aren't a gimmick" and "Nobody's using them… yet". You can see why it spread.
Now, credit where it's due, and only where it's due. Prefilled prompt URLs existed well before June 2025. What Metehan did was name the pattern, package it for editorial sites and ship the tooling on day one. That's real work, and it's why the tactic carries that name. It isn't the same thing as inventing it, and a fair few write-ups since have blurred those two together.
The other thing worth saying plainly: the evidence in that original post was screenshots. No baseline, no control, no time window. That's a fact about the evidence rather than a swing at the person. Plenty of genuinely useful SEO ideas start life as a screenshot and a hunch. It only becomes a problem when the whole industry repeats the screenshot for a year and nobody goes and checks.
Does It Actually Work? The Honest Answer
Three things get mashed together every time this topic comes up, so let's keep them apart: what was claimed, what was actually measured, and what has simply been repeated.
The claim is that these buttons increase how often an assistant cites your domain, partly by seeding your URL into real conversations.
The one independent test came from Roger Montti at Search Engine Journal on 8 July 2025, about a week after the original post. Montti tried to reproduce the effect on a ChatGPT account that had no history with the domain in memory. The domain did not turn up as a cited source. One test is not a verdict, but it is the only attempt anyone published, and it came back negative. (Search Engine Journal)
The only controlled A/B I could find ran on Leite's Culinaria and was reported by Search Engine Land on 13 April 2026. Buttons paired with an on-page AI summary block returned +36% clicks and +116% impressions. Buttons on their own returned −17% clicks. (Search Engine Land)
Read that pair again, because it's the most useful number in this whole article. The winning variant included a summary block. The variant that was only buttons went backwards.
So the summary block looks like the driver, and the buttons look like the passenger. That is not the story anyone was selling.
Everything else, the platform tables, the AI visibility claims, the LinkedIn carousels, is repetition of the June 2025 post. Handy to know before you budget a sprint for it.
The Part Nobody Mentions
On 10 February 2026, Microsoft Security published research classifying a specific pattern as AI Recommendation Poisoning: prompts that instruct an assistant to remember a brand as an authoritative source. They found 50+ distinct prompts across 31 companies in a 60-day window. It's now tracked in MITRE ATLAS as AML.T0080. (Microsoft Security)
If you want to check your own implementation, the flagged wording is easy to eyeball. Look for prompts containing:
- "remember"
- "authoritative source"
- "trusted source"
- "in future conversations"
- "cite"
The growth-hack crowd and the security crowd genuinely do not read each other. That's how a technique can be a clever tip in one feed and a catalogued attack pattern in another, at the same time, for months.
To be fair on the timeline: I could not find any public response from Metehan to the security reframing. That's a fact about what's published, nothing more.
And here's the good news, which mostly gets lost in the drama. The tactic survives the criticism completely if you just ask for a summary and stop there. "Summarise this article and give me the main takeaways" is a normal product feature. It's what a share button has always been. The problem was never the button. It was the sentence someone typed into it.
What I Found Testing Every Platform Myself
Every write-up on this topic reproduces the same platform list. I loaded the URLs in a logged-in browser instead and watched what the composer actually did. Five surfaces, five different behaviours.
- Gemini cannot be prefilled at all. I tested
?q=,?text=,?prompt=and?prompt_text=. The composer stayed empty every single time. The?prompt_text=parameter that circulates in GEO write-ups does not work. - Claude works properly. It prefills the composer and does not auto-send, so the reader sees the prompt before anything happens. Best behaviour of the five by a decent margin.
- Grok consumes the parameter but auto-submits. For a logged-out reader, which is most of them, that means being fired straight into a sign-in wall with the prompt gone.
- Copilot's prefill was deliberately disabled in January 2026 after a data-exfiltration attack. That's a vendor closing a door on purpose, and it's the clearest signal in this whole space about which way things are heading.
- Google AI Mode via
udm=50is the reachable Google surface, and it is a different product from Gemini. Worth saying out loud, because at least one published implementation spec tells developers to badge the AI Mode button with the Gemini logo. That's wrong, and it'll confuse readers about where they're being sent.
The lesson underneath all of that: these are undocumented surfaces. None of them promise to keep working, one has already been switched off, and the trend is removal rather than addition.
So whatever you build, keep all five URLs in a single config block. When one breaks, and one will, you want that to be a two-minute fix rather than an archaeology project across your templates.
Should You Build Them?
Yes, if you treat them as a reading affordance. Pair them with an on-page summary block, use a plain summarise prompt, and judge them on referral sessions rather than on vibes about citations.
No, if you're doing it purely for the citation claim. The one independent test came back empty, and the one controlled A/B measured −17% clicks for buttons on their own. That's a thin base to build a strategy on.
Definitely no if you're tempted by the memory-seeding wording. It's the one part of this with a documented downside and no measured upside.
The honest cost is small. Roughly half a day of dev work if your templates are tidy, and one line to remove it if you change your mind. That's a fair bet on an unproven idea, which is exactly why I took it.
One trap on the way out: logos. Anthropic requires prior written approval for trademark use, and Google forbids composite logo lockups, which is precisely what a row of five AI logos is. Wordmark-only buttons are the safe default, and they look cleaner anyway.
How I Built Mine
The buttons on this page came out of a Claude Code skill rather than a one-off build, because I'd rather ship the system than the artefact.
The skill scrapes the site, detects the stack and extracts the brand palette, then generates three things: an implementation brief, a code reference, and a live in-brand HTML demo I can look at before anything goes near production.
One gotcha is worth the price of admission on its own. The first brand-extraction pass pulled the homepage palette. On this site that palette is scoped to the homepage only, and the blog runs a different token set entirely. So the widget would have shipped looking unstyled, with no error thrown anywhere. Nothing would have gone red in the build. It just would have looked broken to every reader.
Everything else was the boring part: wordmark-only buttons, one config block holding the five URLs, a plain summarise prompt with none of the flagged wording, and the whole row sitting above the article where a reader can actually see it.
This is Part 1 of my GEO journey, getting cited in LLMs. Part 1 is the build. The measurement comes later, once there's enough data to say anything worth saying.
What I'll Be Watching
Three things over the next few months.
Referral sessions broken out by assistant, so I can see whether anybody clicks these at all. Whether pairing the buttons with an on-page summary block moves clicks the way it did for Leite's Culinaria. And whether any of the five endpoints quietly break, because on current form at least one of them will.
One site is not a study, and I'm not going to dress up a small sample as evidence. But somebody has to publish the numbers instead of the screenshots, and I'll report mine either way, including the very likely outcome that it does nothing much at all.
If you want the raw version of that as it happens, I document these builds in my free Skool community: The Vibe Marketing Lab. Come and grab the pieces before I've tidied them up.
Frequently Asked Questions
Do LLM share buttons improve your SEO rankings?
No. They don't retrain models, change rankings, or influence AI Overviews. A share button is just a link with text in the query string. None of that touches how anything gets ranked. What they can do is send measurable referral traffic, which is a real but much smaller claim.
Who invented AI share buttons?
Metehan Yesilyurt named and popularised them on 29 June 2025 as the CiteMET method, and shipped a WordPress plugin the same day. Prefilled prompt URLs predate that by a long way, so the contribution was framing and packaging rather than the underlying mechanism. It's a genuine contribution. It just isn't invention.
Can you prefill a prompt in Gemini?
No. I tested it directly in a logged-in browser using ?q=, ?text=, ?prompt= and ?prompt_text=, and the composer stayed empty every time. The ?prompt_text= parameter cited in several guides does not work. Google AI Mode via udm=50 is the reachable Google surface instead.
Are AI share buttons safe to use?
The buttons are fine. The wording of the prompt is what matters. A plain summarise request is a normal UX feature and nobody has a problem with it. A prompt telling the assistant to remember you as an authoritative source is a different animal, and it's what Microsoft Security classifies as AI Recommendation Poisoning. Ask for a summary, and stop there.