A paper published on arXiv by Cornell Tech researchers on May 22, 2026 demonstrates that adding roughly 13 words to sites like Reddit or Wikipedia can make deep-research AI systems from OpenAI and Google cite fake brands or scam services in their reports.
22 May 2026 · Cornell Tech
A 13-Word Reddit Comment Can Poison "Deep-Research" AI Agents
Researchers show that appending ~13 words of crafted text to a single frequently-retrieved user post can make OpenAI and Google deep-research agents cite and recommend attacker-chosen brands or misinformation — no model access, no prompt control required.
~13
words of text is enough to plant the poison (SERP-snippet setting)
17–23%
of retrieved URLs come from user-generated-content sites
48%
a single page can be retrieved in up to this share of a topic's queries
How often the attacker's entity is mentioned
Conditional mention rate — when the poisoned URL is retrieved. Ranges shown to scale (0–100%).
SERP snippet
Multi-URL
Full-content
Why one comment poisons many answers
+13 words on one Reddit post
→
Agent retrieves & trusts the UGC page
→
Fake brand cited across a whole cluster of queries
Agents treat retrieved content similarly regardless of source credibility — exporting trust to platform moderation. Demonstrated examples included a fictional restaurant "Sol Azteca" and a dating app "SilverPath" recommended with citations.
The structural weakness
The attack needs no control over the agent's model or prompts, no new document injection — and works even when users phrase queries differently.
Poison can be under 4% of a full Reddit thread's content
Gemini: UGC made up 12.1% of citations for tested topics
11–15-word snippets mirroring common queries are most effective
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…