OpenAI Still Thinks CrowdStrike Is In Sunnyvale. Six Things Your AI Chatbot Is Telling Buyers That Aren't True.

I asked OpenAI GPT-4o where CrowdStrike is headquartered this afternoon. It told me, with complete confidence and no hedging:

"CrowdStrike was founded by George Kurtz, Dmitri Alperovitch, and Gregg Marston in 2011. The company is based in Sunnyvale, California."

CrowdStrike officially designated Austin, Texas as its principal executive office in 2022. That is public information. It is in their annual report. It is on their own investor relations page. A Google search for "crowdstrike headquarters" returns Austin as the first result.

A ten-second web search would have confirmed it. A three-year-old fact about the single most visible endpoint security vendor in the entire market. The #1 EDR brand by revenue, by market cap, by media presence, by every conceivable measure. And the most-used commercial AI model in the world is still quoting a headquarters address that changed during the Biden administration.

I know this because I built a product that runs this exact test against every major brand on request, runs it on all five major AI models in parallel, and scores the answers. It's called AIPM — AI Presence Management — and it lives at aipmsec.com. I ran it on CrowdStrike this afternoon. Here's what each of the five models said about the headquarters.

Model	Answer	Correct?
OpenAI GPT-4o	"Sunnyvale, California"	WRONG — three years stale
Anthropic Claude Haiku 4.5 (browsing)	"Austin, Texas... with Sunnyvale continuing as an innovation hub"	Correct, with nuance
Google Gemini 2.5 Flash	"Austin, Texas"	Correct
Mistral Large	"Austin, Texas, USA"	Correct
DeepSeek Reasoner	"Austin, Texas, USA"	Correct

Four models got it right. OpenAI was the single outlier. And OpenAI is the model your customers, your investors, your procurement targets, and your press are actually using.

Why this matters

When the VP of Procurement at a mid-sized healthcare system opens ChatGPT and types "Which EDR vendors are based in Austin, Texas? I want to do business locally" — and ChatGPT doesn't list CrowdStrike, because ChatGPT thinks CrowdStrike is still in Sunnyvale — that's a lost deal that CrowdStrike will never know happened. There's no error log. There's no 404. There's no bounce. There's just a procurement conversation that goes in the wrong direction because an AI made a confident factual error and the buyer never second-guessed it.

CrowdStrike is not my customer. I'm not picking on CrowdStrike. CrowdStrike happens to be the one I grabbed this morning for a demo. The same test applied to your company is probably producing exactly the same category of error. We have the data to prove it.

The bigger finding from this morning's audit run

AIPM has scored 865 domains so far across its leaderboard. Here's what the top 30 looks like right now:

• WordPress.com — AIPM-NPS –40

• Stripe — AIPM-NPS 0

• NASA.gov — AIPM-NPS +20

• KPMG — AIPM-NPS –40

• Accenture — AIPM-NPS –20

• CrowdStrike — AIPM-NPS –20 on prior audit, +20 on the fresh one today

• Zscaler — AIPM-NPS –40

• SentinelOne — AIPM-NPS –20

• Dell — AIPM-NPS –40

• Goldman Sachs — AIPM-NPS –20

• UnitedHealth Group — AIPM-NPS –60

• Darktrace — AIPM-NPS –20

• Rapid7 — AIPM-NPS 0

The highest AIPM-NPS in the entire top 30 of our leaderboard is europol.europa.eu at +40. Europol. A European law enforcement agency. Scoring higher in AI-model perception than Stripe or NASA.

And here's the striking thing: every single entry in the top 30 scored exactly 50 out of 100 on the accuracy dimension. Same number. Across wildly different industries, company sizes, verticals, and levels of fame. Stripe, NASA, CrowdStrike, Zscaler, Dell, Huggingface, Cohere, Goldman Sachs, Bain, EY, Salesforce — all at 50. That means the models produce confident, fluent, often-long answers about these brands, and when you measure the factual correctness of those answers, the whole top of the market is averaging half-right. The other half is fabricated, stale, or pattern-matched.

Six specific things your AI chatbot is telling your buyers that aren't true

From our audit history, across named brands where we have the receipts:

1. OpenAI GPT-4o thinks CrowdStrike is still in Sunnyvale, California. Three years stale. Four other models got it right.

2. Google Gemini thinks DugganUSA is Duggan Manufacturing in Livonia, Michigan. We are a cybersecurity threat intelligence platform in Minneapolis. Duggan Manufacturing is a metal stamping and laser cutting contract shop. The only thing we share is half of a surname. Gemini confidently cites their service list. We have no overlap.

3. Google Gemini thinks aipmsec.com is the "Membership & Election Committee of the All India Primary Teachers' Federation." We are the AIPM product. AIPTF is a real teachers' union in India. It is not us. Gemini hallucinated an entire governance body.

4. Google Gemini thinks security.dugganusa.com is a security guard patrol service. It saw the substring "security" in the subdomain and backfilled a plausible-sounding identity from the words.

5. Anthropic Claude Haiku didn't know we existed at all — until we gave it a web search tool this morning. Its training cutoff was May 2025. We were founded October 2025. Claude had no way to know about us without live retrieval, and the default API call to Claude in most applications doesn't include retrieval. Meanwhile, the other four models in our council were all answering based on live web access and getting scores in the 85 range. Claude, running honestly from its weights alone, scored 5. The model that told us the truth about its limits scored 17× worse than the model that made up a metal stamping shop.

6. Every major brand in cybersecurity is at negative AIPM-NPS. SentinelOne –20. CrowdStrike –20. Zscaler –40. Darktrace –20. Rapid7 0. Snyk 0. The five-model council, asked whether it would recommend each of these companies in their own industry, produced answers the AIPM-NPS framework grades as a net detractor in every single case. The industry is losing the AI brand perception game and nobody is measuring it.

Why the models are getting it wrong

There are three failure modes and they compound.

Failure mode 1: training data cutoff. Every current-generation commercial AI model has a training cutoff somewhere between mid-2023 and mid-2025. Anything that happened after that cutoff — a headquarters move, a rebrand, a new product launch, a founder change, a company sale — does not exist in the model's weights. The only way the model learns about it is live retrieval at query time. Not all models have retrieval. Not all deployments of the models have retrieval enabled. When a model without retrieval is asked about post-cutoff facts, it either confabulates (Gemini) or produces stale answers (OpenAI GPT-4o on CrowdStrike's headquarters).

Failure mode 2: pattern completion over retrieval. When a model does have retrieval but can't find high-quality content about a specific query, it falls back to pattern completion over whatever prior the training data supplied. If your domain name contains a common noun, that noun becomes the industry. If your company name collides with an older, larger, more-indexed brand, you inherit their identity. Gemini hallucinated three different wrong companies for our three domains this morning. Each wrong answer was internally consistent with the surface features of the domain name. None of them were actually retrieved from our websites.

Failure mode 3: scoring confident-wrong above honest-unknown. Our own AIPM scoring algorithm, built by us, was rewarding fluent confident output and penalizing "I don't know" responses. We discovered this while auditing ourselves this morning. Claude scored 5 for being honest about its training data limits, while Gemini scored 85 for confidently hallucinating three different wrong companies in a single afternoon. That is backwards and we are fixing it. A scoring system that rewards the worst kind of answer is worse than no scoring system at all.

What we did about it this morning

All three failure modes have fixes, and all three of them got addressed today:

Training data: We gave Claude Haiku the web_search_20250305 server-side tool that Anthropic ships for exactly this problem. Thirty lines of code in our AIPM council's Anthropic API call. Claude's awareness score on dugganusa.com went from 5 to 85 in the next audit run. Not because Claude got smarter. Because we gave it the tool Anthropic already built.

Pattern completion: We added explicit negative disambiguation to our schema.org/Organization JSON-LD blocks. The disambiguatingDescription field now names the exact wrong companies Gemini confabulated — "NOT affiliated with the All India Primary Teachers' Federation, NOT affiliated with Duggan Manufacturing of Livonia Michigan, NOT a physical security guard services company." We named the hallucinations in the metadata so that any model that does retrieve our files has a concrete hook to land on instead of a plausible-sounding guess.

Scoring: The AIPM algorithm is being updated to penalize awareness ≫ accuracy gaps — the signature of confident confabulation. When a model produces a long, fluent answer that is factually wrong, that should score worse than a short, honest "I don't know." We are fixing this on the product side.

What you should do about it

If you run a cybersecurity brand, a SaaS product, a consulting firm, a biotech, a fintech, or anything with a recognizable name and a website — and if any of your customers or prospects have ever opened an AI chatbot to research your company — you should know what the models are actually saying about you. You do not know this right now. You cannot know this from your marketing dashboard. Your SEO tools do not measure it. Your brand tracking surveys do not measure it. AI chatbots are a distribution layer for your brand story that is completely dark to conventional analytics.

AIPM measures it. It takes 20 seconds per audit. Free tier, no credit card, 500 queries per day. Five models, seven structure signals, full model-response text, scored and saved to history. Regional pricing for 80+ countries. aipmsec.com.

If your AI-brand perception is wrong right now — and mathematically, for most brands, it is — the fix is not magic and the fix is not cheap, but it is tractable. The first step is measuring the gap. The second step is giving the models actual content to retrieve against. The third step is patience while the next training cycle brings your correct information into the weights.

The fourth step is remembering that the people using AI chatbots are not the chatbots. The humans on the other end of those conversations are your actual customers, and every hallucinated answer is a human getting wrong information about your business. The AI model is a distribution channel, not an audience. We optimize for the channel so the audience gets the real story.

One more thing about OpenAI and CrowdStrike

I want to be fair about this. OpenAI's answer wasn't made up out of nothing. There is a real CrowdStrike Sunnyvale office. It used to be the principal executive office. It is still listed in some contexts as an innovation hub or engineering center. OpenAI was not inventing the location from whole cloth. It was quoting a fact that used to be true three years ago and has not been updated in its training data.

That's actually the more dangerous failure mode than a wild hallucination. A wild hallucination is easy to catch — nobody would confuse DugganUSA with a metal stamping shop if they spent thirty seconds on our website. But a stale-but-plausible answer, quoted with perfect grammar and corporate authority, is the kind of thing a busy procurement analyst will never second-guess. They'll just write "CrowdStrike HQ: Sunnyvale CA" in their vendor sheet and move on. And when CrowdStrike misses the Austin-based deal three months later, nobody will ever know what happened.

That is the dark analytics problem. That is what AIPM exists to illuminate.

Four models right, one model wrong, on one question, about one brand, on one afternoon. We ran the audit. We have the receipt. We're publishing it so that OpenAI (who I am confident are reading this) has a chance to update whatever needs updating, and so that CrowdStrike (who I am equally confident have a marketing team that cares about this) has a chance to ask us for the other 95 questions we asked about them.

If you're a brand that wants to know what the AI models actually say about you, before your customers find out first — we built the tool. It's live. It's free to try. And unlike the AI chatbots it audits, it will tell you when it's wrong.

— Patrick