Ask any marketer how to track brand mentions in AI search, and you will get the same answer: pick a tool, feed it prompts, and watch the dashboard. Ask a security engineer the same question, and you get a different one: how do you know any of that data is real?
That second question turns out to be the important one. In 2026, the standard advice for monitoring your brand inside ChatGPT, Claude, Gemini, and Perplexity rests on two signals — what the chatbot says when you ask it, and what your server logs say about which AI crawlers visited. Both signals are softer than almost anyone admits. One is a random variable being reported as a fact. The other is an unauthenticated string that anybody on the internet can type.
This piece is about how to properly track brand mentions in AI search: what each layer actually measures, where each one breaks down, and how to verify what can be verified. There is a working script at the end that you can run against your own access logs today.
Three different things people call "AI visibility"
Most of the confusion in this field comes from collapsing three separate measurements into a single number. They are not the same, they fail differently, and they need different instruments.
- Crawl — did the engine's robot fetch your page at all? Measurable from your server logs, with a large caveat covered below. This is the eligibility layer.
- Citation — did the engine link your URL as a source? Partially measurable, via referral traffic and prompt testing.
- Mention — did the engine write your brand name in the answer text a human reads? Only measurable by sampling, and this is the one that moves buyers.
The gap between the last two is enormous and well-documented. Semrush and growth advisor Kevin Indig analyzed 3,981 domain appearances across ChatGPT, Gemini, Google AI Overviews, and Google AI Mode in June 2026 and found that roughly 62% were what Indig calls ghost citations — the engine used your page as a source but never spoke your brand name. Only 13.2% were both cited and mentioned.
That matters because of a companion finding: 74% of users in Indig's earlier research chose the brand the AI named as their final pick. Nobody reads footnotes. If your reporting counts citations and your boss hears "mentions," the number on the slide is not the number that wins customers.
The engines are not even consistent with each other. Gemini names brands in 83.7% of appearances but links a source only 21.4% of the time. ChatGPT does the reverse — an 87% citation rate against a 20.7% mention rate. Across 454 prompt-and-domain pairs, the engines disagreed on whether to name the brand 22% of the time. Indig's read is that these are "different behavioral systems," and a single blended visibility score across engines destroys exactly the information you need.
The part nobody checks: your logs are unauthenticated
Here is where the marketing and security literatures stop agreeing.
Every guide to tracking AI crawlers tells you to grep your access logs for GPTBot, ClaudeBot or PerplexityBot. That instruction has a flaw so basic it is easy to miss: the User-Agent is a request header the client writes about itself. It is a claim, not an identity. I can send you a request from a VPS in Frankfurt announcing itself as GPTBot/1.4 and your log will record it as OpenAI. Any bot analytics dashboard built on string matching will count it.
This is not theoretical. Scrapers routinely use AI-bot user agents because many sites now allow them. So the error runs in one direction: your "AI crawl" numbers are inflated by forgeries.
The error also runs in the other direction, and there is a documented case at the top of the industry. In its investigation of Perplexity, Cloudflare set up brand-new, unindexed domains with a robots.txt forbidding all automated access, plus WAF rules blocking Perplexity's two declared crawlers. Perplexity still answered detailed questions about the content. Cloudflare found that when the declared crawler was blocked, requests continued from a user agent impersonating Chrome 124 on macOS, from IP addresses outside Perplexity's published ranges, rotating through different ASNs (autonomous system numbers — the network blocks that identify who owns an IP). Cloudflare logged the declared crawler at 20–25 million requests a day and the undeclared one at 3–6 million, across tens of thousands of domains, and de-listed Perplexity as a Verified Bot.
Put the two failure modes together, and you get the finding that should change how you report this data:
Log-based AI crawl measurement has error in both directions, and the direction differs by vendor. Traffic that claims to be an AI bot may not be. Traffic from an AI engine may not claim to be.
Nobody's dashboard is showing you this because checking it requires a step from network security rather than marketing.
The fix: verify against published IP ranges
The vendors solved the identity problem themselves — quietly, in developer documentation that marketing tools largely ignore. OpenAI and Anthropic both publish machine-readable lists of the IP prefixes their crawlers operate from. A request is only genuine if its source IP falls inside the list for the bot it claims to be.
These are live endpoints you can fetch right now:
| Feed | Endpoint |
|---|---|
| OpenAI OAI-SearchBot | https://openai.com/searchbot.json |
| OpenAI GPTBot | https://openai.com/gptbot.json |
| OpenAI ChatGPT-User | https://openai.com/chatgpt-user.json |
| OpenAI OAI-AdsBot | https://openai.com/adsbot.json |
| Anthropic (all three bots) | https://claude.com/crawling/bots.json |
When I pulled these while writing, OpenAI's SearchBot file listed 35 IPv4 prefixes with a publication stamp of 2 January 2026, and Anthropic's combined file listed 20 prefixes with a publication stamp of 1 May 2026. Both are small enough to check every request against, and both change, which is the point of fetching them rather than hardcoding.
Anthropic adds a warning worth repeating: do not try to block their bots by IP. Blocking the addresses stops them from reading your robots.txt, which is the only mechanism that reliably expresses your preference.
The bot taxonomy that actually decides your visibility
This is the reference table I couldn't find anywhere in one place, so here it is, compiled from each vendor's documentation. The critical column is the middle one — most people treat all AI bots as interchangeable, and they are not remotely.
| Bot | Vendor | What it governs |
|---|---|---|
GPTBot | OpenAI | Training corpus only. Blocking it removes you from future model training, not from ChatGPT search answers. |
OAI-SearchBot | OpenAI | Citation eligibility. Opt out and your site "will not be shown in ChatGPT search answers," though it can still appear as a navigational link. |
ChatGPT-User | OpenAI | Live fetch when a real user's conversation pulls your page. User-initiated, so per OpenAI's docs, "robots.txt rules may not apply." |
OAI-AdsBot | OpenAI | Validates landing pages submitted as ChatGPT ads. Not used for model training. |
ClaudeBot | Anthropic | Training corpus only. |
Claude-SearchBot | Anthropic | Citation eligibility for Claude's search results. |
Claude-User | Anthropic | Live fetch triggered by a Claude user's question. |
PerplexityBot | Perplexity | Declared crawler for indexing. |
Perplexity-User | Perplexity | Declared live user-triggered fetch. |
Googlebot | Feeds AI Overviews and AI Mode. There is no separate AI crawler to allow. | |
Google-Extended | Gemini training and grounding. Blocking it does not remove you from AI Overviews. |
Three consequences fall out of that table, and each one is a mistake I see repeatedly.
Blocking GPTBot does not hide you from ChatGPT
It removes you from training. Search visibility is governed by OAI-SearchBot, a completely separate directive. OpenAI is explicit that the settings are independent, and notes it can take around 24 hours after a robots.txt change for their systems to adjust.
Google works on an opposite model to OpenAI and Anthropic
There is no "AI Overviews bot" to permit or deny — those features draw on the ordinary Googlebot index. Google-Extended covers Gemini training and grounding, not AI Overviews inclusion. Historically, the only exit was nosnippet, which also destroys your normal search snippet. Google began rolling out a Search Console toggle in mid-2026 that separates the two, initially to a limited set of sites.
The index bot is a hard gate
If OAI-SearchBot has never successfully fetched a page; that page cannot be cited in ChatGPT search, no matter how good the content is. This makes crawl data genuinely diagnostic rather than vanity: it tells you whether a visibility problem is an eligibility problem or a preference problem, and those have completely different fixes.
Run it on your own logs
I wrote a script that performs the verification described above: it pulls the vendors' live prefix files, parses a standard combined-format access log, and classifies every request that claims to be from an AI user agent as verified or forged. It then prints an eligibility funnel per engine.
Running it against a test log of 470 requests produced this:
AGENT VERIFIED FORGED FORGE % WHAT IT MEANS ---------------------------------------------------------------------------- OAI-SearchBot 120 10 7.7% ChatGPT search index (ELIGIBILITY) ClaudeBot 60 15 20.0% training corpus Claude-SearchBot 28 16 36.4% Claude search index (ELIGIBILITY) Claude-User 14 7 33.3% live user-triggered fetch (ACTIVE) ---------------------------------------------------------------------------- TOTAL 222 48 17.8% Eligibility funnel (verified hits only) ChatGPT index: 120 hits / 7 pages live: 0 -> indexed, not yet surfacing Claude index: 28 hits / 6 pages live: 14 -> indexed and actively cited
Read the funnel, not the totals. "Indexed, not yet surfacing" and "not indexed, cannot be cited" are different diagnoses requiring different work — the first is a content and authority problem, the second is a robots.txt server-configuration problem you can fix this afternoon.
Usage:
python3 verify_ai_bots.py --log /var/log/nginx/access.log --show-spoofed
No dependencies beyond the Python standard library.
The sampling layer, and its honest limits
Crawl data tells you whether you are eligible. It cannot tell you whether you are mentioned. For that, you have to ask the engines and count — and that is where the measurement gets genuinely difficult, because language models are non-deterministic. The same prompt returns different brands on consecutive runs.
To their credit, several practitioners have already worked on this problem, and their conclusion is consistent: a single run is an anecdote, and mention rates should be published with confidence intervals rather than as bare percentages. Treat any tool that reports "you appear in 34% of answers" with no interval and no run count as reporting a number it cannot support.
Two further effects make the sample design matter more than the sample size:
Phrasing dominates. In the Semrush dataset, short conversational prompts yielded brand-mention rates near 100%, whereas long structured prompts on the same topic yielded 2–3%. That is a 30x-to-50x swing driven entirely by how the question was typed.
Intent dominates. Informational prompts ("what is", "how does") returned an 89.3% citation rate but only an 18% mention rate. Comparative prompts ("best", "vs", "alternatives") returned 43.3% mentions — 2.4x more. A prompt set weighted toward one intent will produce a flattering or damning number almost independently of your actual standing.
Which leads to the caveat that this article would be dishonest without. Testing via a vendor's API does not measure the consumer product. ChatGPT the product applies retrieval, a system prompt, personalisation and memory; the API applies none of that. API sampling is reproducible and cheap, and it is measuring a different system. Use it for trend detection, not for absolute claims about what users see.
The consumer-side equivalent has its own trap, and it is the single most common self-inflicted error in this whole field: if you are logged in with memory enabled, ChatGPT already knows where you work and will hand your own brand back to you. Test in Temporary Chat, or logged out in a private window, with memory and custom instructions off. Otherwise your first data point is a false positive.
A checklist that survives contact with reality
- Verify before you count. Run the IP check against your logs before reporting any AI crawl figure. If you are on Cloudflare, use Verified Bots signals rather than user-agent rules.
- Separate the three layers in your reporting. Crawl, citation and mention get three columns. Never one blended score.
- Fix eligibility first. Confirm
OAI-SearchBotandClaude-SearchBotcan reach your important pages, and remember that blockingGPTBotorGoogle-Extendeddoes not achieve what most people think it achieves. - Freeze your prompt set. Changing prompts between cycles means you are measuring your prompt list, not your brand. Deliberately balance short and long phrasings, informational and comparative intents.
- Report intervals and run counts, and check each engine separately. Aggregation hides the cases where you own one engine and are invisible in another.
- Catch what referral data you can. ChatGPT appends
utm_source=chatgpt.comto citation links, which makes it the one engine most analytics setups can already see. In GA4, build a custom channel group with a regex coveringchatgpt\.com|perplexity\.ai|claude\.ai|gemini\.google\.com|copilot\.microsoft\.com, and place it above the built-in Referral rule or it stays empty. - Audit accuracy, not just presence. Being described wrongly — stale pricing, features you never shipped — is worse than being absent, and almost no tool checks for it.
None of this makes AI visibility a solved measurement problem. It is not one, and anyone selling you a single confident number is selling you the appearance of certainty. What it does is separate the parts you can verify from the parts you can only estimate — and knowing which is which is the whole job.
Quick answers
Is it possible to track brand mentions in AI answers?
Yes, by sampling. There is no index to query, so every method works by repeatedly asking engines questions and recording the answers. Any single run is an anecdote.
How can you track brand mentions in ChatGPT for free?
Prompt it in Temporary Chat while logged out, filter GA4 for utm_source=chatgpt.com, and verify OAI-SearchBot and ChatGPT-User hits in your logs against openai.com/searchbot.json. That covers eligibility, citation and referral at zero cost.
Does blocking GPTBot remove me from ChatGPT?
No. GPTBot governs training data. ChatGPT search visibility is controlled separately by OAI-SearchBot.
Can I opt out of Google AI Overviews without losing rankings?
Historically no — nosnippet removed your normal snippet too, and Google-Extended never controlled AI Overviews. Google began rolling out a Search Console toggle in mid-2026 that separates them, initially to a limited set of sites.
Sources
- Overview of OpenAI Crawlers — OpenAI developer documentation
- Does Anthropic crawl data from the web? — Anthropic Help Center
- Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives — Cloudflare
- Why 62% of AI citations don't lead to brand mentions — Semrush with Kevin Indig
- AI visibility is a topic-level game: 50,000 brands in ChatGPT — Semrush
- An Analysis of AI Overview Brand Visibility Factors — Ahrefs
- Introducing Search Generative AI performance reports in Search Console — Google Search Central