AI trading bots can be quietly poisoned by fake social-media posts, and the damage shows up in the numbers.
Researchers built a framework called GMATS to model how modern multi-agent LLM trading systems are put together, then designed a black-box attacker that treats an LLM as a content generator. The attacker crafts a limited, budget-constrained batch of plausible-looking social-media posts and feeds them into the analyst agent's evidence stream. Running the setup on an offline benchmark built from historical market and social data, the team tracked how those fake signals moved through the stack, measuring belief shifts at both the analyst and coordinator layers. Even these simple, low-budget attacks were enough to sharply cut Sharpe ratios compared with a clean run.
That matters because LLM-based multi-agent trading systems are already starting to appear in quantitative finance, and this shows how little adversarial content it takes to knock one off course. The researchers also found that certain multi-agent topologies and coordinator prompts can dampen the shock, so how a system is wired matters almost as much as which model runs it.
It's a reminder that any trading system reading social media for signals is only as trustworthy as the posts flooding its feed.