SEO Recap covering October 31, 2026: BrightEdge AI travel study and Google Connected Apps preview

Built by Stephanie Chung·3 min read·3 stories

Daily summary of what matters in SEO, GEO, AEO, and AI search generated with Claude Code (beware of hallucinations)

Generative Engine Optimization (GEO) & Answer Engine Optimization (AEO)

BrightEdge tracked share of voice (not rankings, since AI answers lack ranked positions) across travel categories in ChatGPT and Google AI Overviews, finding American Airlines, Royal Caribbean, and Expedia lead their sectors on both engines.
Leaders diverge by engine and category:
- Hilton leads hotels on AI Overviews at 28.3% while Marriott leads ChatGPT at 29.4%
- American Airlines leads airlines on AI Overviews (26.6%) and ChatGPT (25.3%)
- Expedia's AI Overviews visibility is 2.2x Kayak's (31.3% vs 14.4%), narrowing to 1.4x on ChatGPT
Booking platforms appear in 78% of budget-related AI Overviews answers (terms like "cheap," "deal," "budget," "last-minute") versus 17% of other answers, with Expedia in 44% of those budget answers.
Only 9% of tracked AI Overviews prompts carry booking intent. Inspiration and comparison queries make up most of the panel, and UGC-heavy sources like YouTube, Reddit, and AAA show up more there, leaving room for smaller sites with first-hand expertise.

Google opened a public preview of its Connected Apps Platform on Oct. 28, letting approved developer apps run inside AI Mode in Search and the Gemini app, with over 50 connected apps already live across both.
Developers connect via a remote MCP server (reaching Gemini and Search on web, Android, and iOS) or AppFunctions/Android MCP (Gemini on Android only), registering through Google Connected Console.
The policy bars apps from referencing other tools, writing rules for when other tools should be used, or using overly broad or deceptive capability descriptions to get the model to pick them over rivals. Violations can trigger rejection, suspension, or account termination.
Current Search apps in AI Mode (US, English) include Instacart, Canva, YouTube Music, and 2 fantasy football apps, with Adobe, Experian, Peloton, and a Calm integration coming to Search in the coming weeks.
Google reviews and tests each app before publishing, requires test accounts with sample data for sign-in apps, and gives developers traffic, latency, and error-rate reporting once live.

DebugBear instructed customers on October 29 to remove its Real User Monitoring (Core Web Vitals) script after attackers compromised its DNS records through its domain registrar.
Hudson Rock found malicious JavaScript at a DebugBear script URL used by Polymarket, and Polymarket's incident report confirmed the code sold positions and moved funds using the access of already signed-in visitors, without needing passwords.
Site owners should take immediate steps:
- Remove the DebugBear embed from templates, plugins, and tag managers, then clear caches and verify it no longer loads
- Invalidate sessions and reset passwords for admins and privileged users, revoke exposed API credentials
- Audit logs for unauthorized changes, new accounts, injected scripts, and backdoors
- Put a confirmed-compromised site into maintenance mode with an HTTP 503 and restore from a clean backup
DebugBear said its initial investigation pointed to one targeted customer with no sign of internal systems being breached, though it could not receive email at its domain during the incident.

Published on November 1, 2026