{"slug": "deep-research-agents-can-be-poisoned-via-user-generated-content", "title": "Deep-Research Agents Can Be Poisoned via User-Generated Content", "summary": "Researchers have discovered that deep-research agents, which use multi-agent pipelines to retrieve and synthesize web content, can be poisoned by adversaries appending crafted text to frequently retrieved user-generated content pages on platforms like Reddit and Wikipedia. The attack, demonstrated on systems such as STORM, Co-STORM, and OmniThink, allows attackers to manipulate citations and promote chosen entities across multiple queries, highlighting a fundamental vulnerability in how these agents integrate web content.", "body_md": "# Computer Science > Cryptography and Security\n\n[Submitted on 22 May 2026]\n\n# Title:Deep-Research Agents Can Be Poisoned via User-Generated Content\n\n[View PDF](/pdf/2605.24245)\n\n[HTML (experimental)](https://arxiv.org/html/2605.24245v1)\n\nAbstract:Deep-research agents, i.e., systems that rely on multi-agent pipelines to iteratively retrieve, synthesize, and cite Web content in order to produce structured reports, are rapidly replacing traditional search for both routine and complex information needs. These agents issue many related queries during a single research session. We show that for many common search topics, they repeatedly retrieve the same user-generated content (UGC) pages from platforms such as Reddit and Wikipedia. Next, we argue that this retrieval overlap creates a concentrated attack surface: an adversary who appends a short, crafted text to a single, frequently retrieved UGC page can cause the agent to cite attacker-chosen content and promote attacker-chosen entities across many related queries.\n\nWe evaluate this attack on three representative deep-research systems (STORM, Co-STORM, and OmniThink) across multiple query clusters. We also study defenses at different stages of the pipeline, including source-level filtering and output-based detection. Our findings highlight a fundamental vulnerability in how deep-research agents retrieve and integrate web content.\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer\n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers\n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps\n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations\n\n*(*[What are Smart Citations?](https://www.scite.ai/))# Code, Data and Media Associated with this Article\n\nalphaXiv\n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers\n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub\n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub\n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face\n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast\n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower\n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender\n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [ Learn more about arXivLabs](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/deep-research-agents-can-be-poisoned-via-user-generated-content", "canonical_source": "https://arxiv.org/abs/2605.24245", "published_at": "2026-06-15 14:28:46+00:00", "updated_at": "2026-06-15 14:38:22.985531+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "natural-language-processing", "ai-research"], "entities": ["STORM", "Co-STORM", "OmniThink", "Reddit", "Wikipedia"], "alternates": {"html": "https://wpnews.pro/news/deep-research-agents-can-be-poisoned-via-user-generated-content", "markdown": "https://wpnews.pro/news/deep-research-agents-can-be-poisoned-via-user-generated-content.md", "text": "https://wpnews.pro/news/deep-research-agents-can-be-poisoned-via-user-generated-content.txt", "jsonld": "https://wpnews.pro/news/deep-research-agents-can-be-poisoned-via-user-generated-content.jsonld"}}