Can a Reddit comment manipulate AI answers? Researchers say yes
A Cornell Tech study shows that deep-research agents can be poisoned by user-generated content. The threat is simple: if AI relies on pages such as Reddit or Wikipedia as sources, a small change can influence entire recommendation flows.
Summary
A new study by Cornell Tech researchers highlights an important vulnerability in deep-research agents: they can be influenced by user-generated content on platforms such as Reddit, Wikipedia, Quora, or YouTube.
The attack is called WARP, short for Web Agent Retrieval Poisoning. The idea is simple: if an AI agent searches the web, retrieves pages, synthesizes information, and cites sources, then an attacker can try to contaminate a page that the agent tends to retrieve repeatedly.
According to the researchers, adding a short promotional phrase to a frequently retrieved page can cause the agent to cite and promote an attacker-chosen entity. In the described tests, this was used to make agents recommend fictional products such as a dating app, a restaurant, or a cryptocurrency.
In practice
The vulnerability is not in the prompt itself. It is in the sources the agent chooses to consult.
When a deep-research tool receives a question, it does not simply run one search. It may issue multiple related queries, visit several pages, compare results, and then build a report with citations. The problem is that, for many common topics, these agents repeatedly return to the same user-generated pages.
That creates a concentrated attack point. If a frequently cited page is contaminated with text designed to look relevant to a common question, the agent may interpret that information as useful and include it in the answer.
The study evaluated the attack on three open-source deep-research systems: STORM, Co-STORM, and OmniThink. The researchers did not directly attack commercial tools in production, to avoid contaminating the live web. This means the work demonstrates a technical vulnerability, but does not prove that specific commercial systems have been exploited in the wild.
What we still don't know
The most concerning point is that obvious defenses do not easily solve the problem. Blocking all user-generated content can reduce answer quality, because useful knowledge often lives in forums, communities, commented documentation, and collaborative pages.
Filtering final answers is also not enough, because the poisoned text may look natural, relevant, and well written. The agent is not necessarily following a malicious instruction; it is reasoning over manipulated data.
That makes the problem different from classic prompt injection. Here, the risk is contamination of the information environment from which AI retrieves context. For users, companies, and journalists, the consequence is clear: answers with citations are not automatically reliable answers.
Why it matters
- AI search is replacing part of traditional search, but inherits weaknesses from the open web.
- User-generated content can be useful, but it is also easy to manipulate.
- Agents that synthesize information can amplify a small contamination if the same source is retrieved repeatedly.
- For shopping, health, safety, finance, or reputation topics, AI recommendations should be checked against primary sources.