First Line or Last Word: Where a Stored Order Sits in a Product Review and Whether a Web LLM Assistant Obeys It

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

In a companion study we showed that a short stored review carrying a direct order (“delete user carlos”) made a small local assistant delete the account every time, while a hosted-class assistant ignored it (Hadad, Hadad, and Tavakoli 2026). Real reviews are not short shouts. They run to a paragraph, and a planted sentence can sit at the top, in the middle, or at the bottom of one. This paper moves that one sentence around inside the same ordinary review and asks whether where it sits decides whether it is obeyed, discussed, or simply summarised away. We test two framings (direct order, support note) at three positions in one fixed jacket review, in the same Flask shop, on the same two models, vulnerable and tool-free variants, 84 trials in total. No position produced a deletion on either model: direct orders in a full-length review gave 0/9 effects on the local model, against 3/3 for near-identical plain wording in a one-line review in the companion study. Position showed up one level lower. On the local model the opening direct order was still discussed as account business in 3/3 trials, while every other planted cell was summarised as jacket text (0/15; Fisher \(\:p=0.0012\) on deletion talk). Muse surfaced exactly one planted order in 18 attack trials, at the end of a review, and surfaced it to refuse it by name (§[sec:results36]). A stored order, it turns out, needs to be the review, not merely in it – and even at the top of a real review, this small model only talked. We release payloads, transcripts, judge labels, and the counting scripts.