Context
Researchers evaluated an adaptive tool-intermediary attack against DeepResearch-style agents that coordinates one attacker-controlled search result per query into a seemingly corroborating evidence chain. Controlled results show substantial vulnerability under the specified attacker permissions.
What changed
Unlike fixed malicious webpages, the study tested trajectory-aware injection into mediated Search/Visit tool results. The authors report Authority-Chain Hijack achieving 55.9% attack success and 83.3% MaxN attack success on the full SafeSearch test split; a trace-evolved variant scored 71.4% / 95.0% in a held-out setting.
Why it matters
Agentic retrieval and source selection can be influenced over multiple search steps, so corroboration among search results does not automatically establish independence when an intermediary can alter the observation stream.
Visibility OS interpretation
Visibility OS interpretation: source diversity, provenance and retrieval-channel integrity are distinct from citation count. This controlled adversarial model should not be presented as evidence that ordinary website edits manipulate production AI search.
What remains uncertain
How realistic is the per-query tool-intermediary capability in deployed systems? Can independent-source provenance checks mitigate coordinated evidence chains? Do the results transfer across commercial assistants and retrieval providers?
Evidence claims
Under a controlled threat model permitting one attacker-controlled result per query, the Breadcrumbing Search Agents study reports 55.9% attack success and 83.3% MaxN attack success for its Authority-Chain Hijack strategy on the SafeSearch full test split.
Related historical records
Research shows repeated UGC retrieval can contaminate deep-research citations
This record related to the linked event.