Three stories landed this week that, read together, sketch the state of AI-era search better than any conference keynote. Google confirmed on its earnings call that AI Mode is growing faster than it monetizes. WordPress shipped a security patch for vulnerabilities that have been sitting in core since version 4.7. And Google quietly gave restaurants direct control over which ordering providers appear on their profiles. One is a market signal, one is a hygiene reminder, one is a small but telling case study in who controls surface area. Here's the synthesis.
What changed: Google said the quiet part on AI Mode
Search revenue growth has been decelerating for two straight quarters. The Search & Other line grew 12% year-over-year in Q3 2026 to $63.35 billion, down from 19% in Q1 and 17% in Q2, and essentially flat quarter-over-quarter. On the earnings call, Chief Business Officer Philipp Schindler named lower monetization within AI Mode as one of three reasons for the slowdown — alongside currency movements and a regional advertising dip tied to the EU eliminating its de minimis exemption for low-value imports.
That's a remarkable admission. For two years the party line has been that AI experiences would monetize at or above traditional search over time. Now the CFO-adjacent leadership is telling investors that the AI surface is a drag on growth, not a lift. Google is responding the predictable way: expanding ads in AI Mode to ten additional markets and launching ads in AI Mode follow-up questions in the United States, with all existing Search, Shopping, and Performance Max campaigns eligible by default and no ability to opt out separately.
Why it matters for marketers
Two implications, one immediate and one structural.
Immediate: AI Mode inventory is about to fill with ads, and your existing campaigns are in it whether you planned for it or not. If you've been treating AI Mode as a monitoring project rather than a channel, that window is closing. Default eligibility means your budget allocation decisions are now being made for you unless you actively shape them.
Structural: monetization pressure is the strongest signal we have for how AI answers will evolve. Free AI answers with no ads are a transitional state. Once Google needs AI Mode to carry revenue, expect commercial queries to get heavier ad treatment, more shopping integrations, and tighter feedback loops between what the model surfaces and what it can sell. For anyone doing AI SEO, the practical question shifts from "am I cited?" to "am I cited in the queries where monetization concentrates?" Being the citation on a commercial-intent answer is about to be worth materially more than being the citation on an informational one.
The hygiene story: WordPress 7.1.4
Separately, WordPress shipped version 7.1.4 to fix 22 vulnerabilities, including a race condition in the update process itself that could allow remote code execution during the upgrade window — the kind of flaw that enables full site takeover — plus numerous stored cross-site scripting issues, some of which have existed in core since version 4.7.
Why does this belong in an AI SEO briefing? Because every AI answer, every AI crawler, and every generative engine citation depends on your site being fetchable and trustworthy. A compromised site doesn't just risk downtime; it risks serving injected content that poisons whatever the crawlers learned from you. If AI engines are forming representations of your brand from what they scrape, site integrity is now an AEO problem, not just an IT ticket. Patch this week. Check that your update pipeline itself wasn't running an exploitable version.
The control story: restaurants and ordering providers
The smallest story of the three is arguably the most instructive. Restaurants can now opt out of specific third-party ordering providers directly from their Business Profile dashboard, flipping pickup and delivery switches per provider instead of filing a removal request the provider had five business days to process. Google's product team confirmed the setting is available in all countries.
Read it as a template. Google is incrementally handing businesses direct levers over how they appear on its surfaces, starting with the verticals where third-party intermediaries extract the most margin. Watch whether this pattern extends to how businesses control their representations in AI-generated answers. If Google builds self-serve controls for AI Mode visibility the way it just built them for ordering links, the brands positioned early will have an advantage nobody can scrape their way into.
The move to make this week
Three actions, in priority order. First, audit your Search, Shopping, and PMax campaigns for AI Mode eligibility and decide deliberately where you want that inventory to go — because the default is on. Second, patch to WordPress 7.1.4 and verify your site integrity, especially if AI engines cite you commercially. Third, if you operate in a vertical with third-party intermediaries on Google surfaces, watch the Business Profile controls closely; the restaurant precedent suggests direct control is the direction of travel.
The throughline: the platforms are deciding how AI-era distribution gets monetized and controlled, and they're telling us in plain language. The only mistake is waiting for a polished playbook before acting on what they've already said out loud.