A paper by Tingwei Zhang, Harold Triedman, and Vitaly Shmatikov of Cornell Tech, on an attack against deep-research agents — "systems that rely on multi-agent pipelines to iteratively retrieve, synthesize, and cite Web content in order to produce structured reports," which the authors note "are rapidly replacing traditional search for both routine and complex information needs."
The structural vulnerability
The attack surface follows from two facts the paper establishes rather than assumes.
Retrieval concentrates on user-generated content. "A large fraction of the content retrieved by deep-research agents originates from user-generated platforms such as Wikipedia, Reddit, and community forums, because they provide detailed explanations and broad topical coverage. At the same time, they allow users to directly edit or contribute content, making them comparatively easy to modify." The properties that make these sources useful to agents are the same properties that make them writable by adversaries.
Retrieval overlaps across queries. Agents "issue many related queries during a single research session," and "for many common search topics, they repeatedly retrieve the same user-generated content pages."
Together these yield the paper's central observation: "this retrieval overlap creates a concentrated attack surface." A single poisoned page is reached repeatedly, so "an adversary who appends a short, crafted text to a single, frequently retrieved UGC page can cause the agent to cite attacker-chosen content and promote attacker-chosen entities across many related queries" — affecting "reports for an entire topic, regardless of the user's specific query."
The WARP attack
WARP (Web Agent Retrieval Poisoning) is described as "the first content-injection attack against deep-research agents" operating under an unusually weak threat model. The adversary is assumed to have:
- no control over retrieval,
- no knowledge of the agent's model, prompts, or the user's specific query,
- no ability to inject new documents,
- only the ability to edit "existing documents or discussion threads on a UGC platform."
The authors distinguish this from prior work on RAG poisoning and generative engine optimization, "which takes retrieval of the poisoned content as a given." WARP's pipeline instead "covers reconnaissance, content generation, and deployment" — the attacker must first determine which pages are reliably retrieved for a topic, which is what makes the query-independence possible.
Evaluation covers three representative systems — STORM, Co-STORM, and OmniThink — across multiple query clusters.
Defenses
The paper studies mitigations "at different stages of the pipeline, including source-level filtering and output-based detection," and frames its overall result as structural rather than implementation-specific: the findings "highlight a fundamental vulnerability in how deep-research agents retrieve and integrate web content."
The difficulty is that the two properties enabling the attack — reliance on user-editable sources and repeated retrieval of the same pages across a session — are both design features rather than bugs.
Bearing on the wiki's own method
The attack targets the general pattern of agent-assisted research: iterative retrieval and synthesis of web content into cited reports. It is one argument for retrieving primary sources at canonical hosts and recording an authenticity-verification trail, rather than accepting agent-synthesized summaries of web material.
Relationships
- related: Prompt Injection — a distinct mechanism: content poisoning of retrieved sources rather than instruction injection into a prompt
- related: Agentic AI, AI and Cybersecurity, Autonomous cyber-agents
- related: AI Benchmarks and Evaluation, AI and Misinformation