# Deep-Research Agents Can Be Poisoned via User-Generated Content

arXiv: https://arxiv.org/abs/2605.24245 · HTML: https://mlsanity.com/paper/2605.24245/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 24 of its 47 references that are in the map.
- First posted on arXiv 22 May 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 24 of 24)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks](https://mlsanity.com/paper/1908.10084/) (2019)
- [BERTScore: Evaluating Text Generation with BERT](https://mlsanity.com/paper/1904.09675/) (2019)
- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Dense Passage Retrieval for Open-Domain Question Answering](https://mlsanity.com/paper/2004.04906/) (2020)
- [REALM: Retrieval-Augmented Language Model Pre-Training](https://mlsanity.com/paper/2002.08909/) (2020)
- [Leveraging Passage Retrieval with Generative Models for Open Domain Question Answering](https://mlsanity.com/paper/2007.01282/) (2020)
- [Prometheus 2: An Open Source Language Model Specialized in Evaluating Other Language Models](https://mlsanity.com/paper/2405.01535/) (2024)
- [PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models](https://mlsanity.com/paper/2402.07867/) (2024)
- [Spotting LLMs With Binoculars: Zero-Shot Detection of Machine-Generated Text](https://mlsanity.com/paper/2401.12070/) (2024)
- [DetectLLM: Leveraging Log Rank Information for Zero-Shot Detection of Machine-Generated Text](https://mlsanity.com/paper/2306.05540/) (2023)
- [Assisting in Writing Wikipedia-like Articles From Scratch with Large Language Models](https://mlsanity.com/paper/2402.14207/) (2024)
- [What Evidence Do Language Models Find Convincing?](https://mlsanity.com/paper/2402.11782/) (2024)
- [GEO: Generative Engine Optimization](https://mlsanity.com/paper/2311.09735/) (2023)
- [Into the Unknown Unknowns: Engaged Human Learning through Participation in Language Model Agent Conversations](https://mlsanity.com/paper/2408.15232/) (2024)
- [Adversarial Search Engine Optimization for Large Language Models](https://mlsanity.com/paper/2406.18382/) (2024)
- [Ranking Manipulation for Conversational Search Engines](https://mlsanity.com/paper/2406.03589/) (2024)
- [The Rise of AI-Generated Content in Wikipedia](https://mlsanity.com/paper/2410.08044/) (2024)
- [OmniThink: Expanding Knowledge Boundaries in Machine Writing through Thinking](https://mlsanity.com/paper/2501.09751/) (2025)
- [Generative Engine Optimization: How to Dominate AI Search](https://mlsanity.com/paper/2509.08919/) (2025)
- [Adversarial Decoding: Generating Readable Documents for Adversarial Objectives](https://mlsanity.com/paper/2410.02163/) (2024)
- [Commercial Persuasion in AI-Mediated Conversations](https://mlsanity.com/paper/2604.04263/) (2026)
- [Fool Me, Fool Me: User Attitudes Toward LLM Falsehoods](https://mlsanity.com/paper/2412.11625/) (2024)
- [Exposing Citation Vulnerabilities in Generative Engines](https://mlsanity.com/paper/2510.06823/) (2025)

## Built on by (most cited first, 4 of 4)

- [How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement](https://mlsanity.com/paper/2607.13718/) (2026)
- [Evaluating Deep-Search Agents under Hierarchical Web Evidence Poisoning](https://mlsanity.com/paper/2609.06027/) (2026)
- [Breadcrumbing Search Agents](https://mlsanity.com/paper/2608.04565/) (2026)
- [AX is the New AEO](https://mlsanity.com/paper/2609.34951/) (2026)

## Abstract (arXiv)

Deep-research agents are an alternative to conventional Web search. They use multi-agent pipelines to issue multiple Web searches related to user queries, retrieve relevant content from the answers, and generate detailed, evidence-based reports. We show that for many common search topics (including financial, medical, and product recommendations), agent-generated reports are consistently based on the same user-generated content (UGC) pages from platforms such as Reddit and Wikipedia. This retrieval overlap, combined with lax moderation and access controls for UGC, is an opportunity for subversion: an attacker who appends a short text to a single, frequently-retrieved page can cause agents to cite this text and promote attacker-chosen entities across many user questions. We evaluate this attack on representative deep-research systems across multiple topics, such as investment advice, antivirus software, restaurant recommendations, etc. Poisoning a single URL with as few as 13 words can be sufficient for the attacker's content to be retrieved in 57-76% of the agent executions for a given topic and cited in 38-51% of the generated reports. A more aggressive attack (poisoning an entire subreddit) achieves 30-53% citation rates even when the poison is only 0.5-4% of the retrieved content. The attacker does not need to know the phrasing of the user's question, nor the specific Web queries generated by the agent, nor the agent's internal retrieval and generation mechanisms. We then study defenses at different stages of the pipeline, including source-level filtering and output-based detection. Dropping UGC from retrieved content blocks the attack but degrades the quality of generated reports. We show that lightweight anomaly detection on inputs and outputs does not reliably identify poisoned content, nor the results of poisoning.