Context
A Cornell Tech original preprint demonstrates that frequently retrieved user-generated pages can become a cross-query poisoning surface for open deep-research agents, influencing both retrieved evidence and report citations.
What changed
Zhang, Triedman and Shmatikov introduced WARP (Web Agent Retrieval Poisoning) and tested modifications to frequently retrieved UGC in STORM, Co-STORM and OmniThink. In reported topic setups, short inserted text was retrieved in 57–76% of executions and cited in 38–51% of reports.
Why it matters
Multi-query agentic retrieval can repeatedly select the same editable sources. Citation occurrence alone is not evidence of factual reliability; provenance, moderation and source integrity affect trustworthy AI discovery.
Visibility OS interpretation
Visibility OS interpretation: concentrated UGC source selection creates both legitimate exposure and adversarial contamination risk. The paper does not establish that commercial AI-search products exhibit the reported attack success rates.
What remains uncertain
Do production deep-research agents show similar retrieval overlap under current defenses? Which provenance checks reduce poisoning without degrading evidence coverage? How do moderation and freshness affect vulnerability?
Evidence claims
In the WARP study's tested open deep-research agent and topic configurations, inserting as few as 13 words into a frequently retrieved UGC page led to the inserted text being retrieved in 57–76% of agent executions and cited in 38–51% of generated reports.
Related historical records
Breadcrumbing study shows adaptive search-result injection can steer multi-step agent evidence chains
That record related to this event.