[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-study-shows-search-agents-can-be-herded-by-fake-sources":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},5848,"study-shows-search-agents-can-be-herded-by-fake-sources","Study Shows Search Agents Can Be Herded by Fake Sources","New research finds AI search agents can be tricked into wrong answers by planting coordinated fake sources across their search results, not just one bad page.","Researchers have found a way to fool AI search agents that goes beyond planting one bad webpage: feed them a trail of fake corroborating sources instead.\n\nThe study looks at LLM-based search agents, the kind that run web searches, read results, and cross-check sources before answering a question. Past attacks relied on injecting malicious instructions into a single page, but modern agents often catch that by checking multiple sources against each other. The researchers built an attack called Authority-Chain Hijack that plants one controlled result per query across an agent's multi-step search process, building what looks like independent confirmation from several sources. On a benchmark called SafeSearch, it succeeded in steering agents to a wrong or attacker-chosen answer 55.9% of the time, and up to 83.3% under a looser success measure. A follow-up method that automatically refines the attack strategy from past attempts pushed that as high as 71.4% to 95%.\n\nThis matters because it targets the exact behavior meant to make search agents safer. Cross-checking sources is the standard defense against a single poisoned page, and this attack shows that defense can be turned into the delivery mechanism. Any product that lets an agent browse the live web, from research assistants to shopping bots, inherits this exposure the moment it trusts what a search API hands back.\n\nThe fix isn't cross-checking harder. It's not trusting the search channel as a neutral pipe in the first place, the same lesson the web spent two decades learning about trusting user input.","[\"ai-security\",\"prompt-injection\",\"search-agents\",\"llm\"]","2026-08-25T04:00:00.000Z","2026-08-25T10:33:29.209Z","2026-08-25T10:33:41.128Z","published",null,[],"security",[26,27,28,29],"ai-security","prompt-injection","search-agents","llm",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2608.04565",0,{"sections":36},[37,41,44,49,54,59,64,69,74,79,84,89,94,99],{"name":38,"slug":39,"count":40,"latest_published_at":18},"AI","ai",3329,{"name":42,"slug":24,"count":43,"latest_published_at":18},"Security",471,{"name":45,"slug":46,"count":47,"latest_published_at":48},"Policy","policy",225,"2026-08-25T09:15:03.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",145,"2026-08-22T21:25:33.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Science","science",91,"2026-08-20T10:01:48.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Startups","startups",51,"2026-08-24T13:47:26.000Z",{"name":85,"slug":86,"count":87,"latest_published_at":88},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]