How thirteen words on Reddit can hijack a deep-research agent

A deep-research agent is the autonomous mode of a tool like ChatGPT or Gemini. You ask it a question, it browses the web, reads dozens of pages, and writes you a cited answer. A new Cornell Tech paper shows that planting a short promotional sentence on Reddit, Quora, or Wikipedia is enough to make those agents recommend products that do not exist. I want to walk through why this works, because the mechanism matters more than the headline.

The attack is called WARP, for Web Agent Retrieval Poisoning. The paper, by Tingwei Zhang, Hal Triedman, and Vitaly Shmatikov, was posted as a preprint last week. The number that got picked up everywhere, a 13-word Reddit comment, is real, but it is the smallest interesting part of the finding. The bigger part is why thirteen words are enough.

What a deep-research agent actually does

When you ask a deep-research agent for "the best portable monitor under $300", it does not answer from memory. It runs a sequence of web searches, fetches the pages, reads them, picks out the bits that seem to answer your question, and writes a summary with footnotes pointing back to those sources. This is retrieval-augmented generation, or RAG, taken to its logical extreme: instead of one search, the agent does many, and instead of pasting snippets, it synthesises across them.

Two facts about that pipeline matter for what comes next.

First, the agent leans heavily on user-generated content. Reddit threads, Quora answers, and Wikipedia pages are roughly 17–23% of what these agents cite on recommendation queries, according to the Cornell measurements. The reason is intuitive: when a real human asks "what monitor should I buy", the genuinely useful answers tend to live on forums where other humans have already had the same question. The agent has learned this and routes accordingly.

Second, the agent does not verify claims. It ranks sources by topical relevance and apparent credibility, does this page look like it is about the thing being asked?, and then aggregates. There is no step in the pipeline that asks "is this product real?" or "did this commenter actually own this thing?". The agent treats a Reddit comment the same way a careful human reader would treat it on a fast skim: probably fine, on topic, moving on.

The attack, step by step

Here is the WARP recipe. An attacker wants to promote a product — call it the FakeMonitor X. They write a short, fluent, on-topic comment and post it under a relevant Reddit thread, or edit it into a Quora answer, or slip it into a Wikipedia page. The comment is short enough to look like a casual recommendation: thirteen words is roughly "I've been using the FakeMonitor X for six months and it's great." They wait.

When somebody asks a deep-research agent about portable monitors, the agent searches the web, finds the thread, retrieves the page, and reads the planted comment alongside the genuine ones. Because the comment is fluent and topical, it clears every filter the agent applies. It then gets cited in the final report — often with a footnote pointing back to the Reddit thread, which lends it the credibility of the surrounding human discussion.

Against three open-source deep-research agents, STORM, Co-STORM, and OmniThink, the Cornell team ran the full attack end-to-end and measured how often the fabricated product made it into the final answer. When the poisoned page was retrieved, the attacker's product was mentioned in roughly 38–51% of runs. Spreading the payload across a handful of poisoned URLs pushed that to 62%.

For ChatGPT and Gemini, the researchers did not run the end-to-end exploit. They measured how often those systems cite user-generated content on the same query types, and concluded the attack surface is comparable. That is a meaningful caveat: the headline success rate is from open-source agents, and the commercial-system claim is inferred. I would not bet that the commercial numbers are radically lower, but they have not been directly measured.

Why detection makes the problem worse

Here is the part of the paper I keep coming back to. The obvious defence is to train a classifier that flags AI-generated or promotional text and downweight it before the agent reads it. The Cornell team tried this. It fails in a specific, telling way.

WARP-injected text is more fluent than genuine Reddit comments. Real comments are messy: typos, slang, half-finished thoughts, weird grammar. Planted promotional text is clean and on-topic, because the attacker drafted it carefully (or had a model draft it). When you run an AI-generated-text detector across the corpus, it flags the planted text — and also the most articulate human commenters, who write more like the attack than like average Reddit. The genuine humans get downweighted alongside the attackers, and the answer quality drops without the attack going away.

This is a general lesson about adversarial detection. The moment your detector is known, the attacker optimises against it, and the signal you were using to catch them often turns out to be a signal of care, not of malice. Careful humans and careful attackers look more alike than careful attackers and lazy humans.

The trust hierarchy that wasn't

Standard AI safety thinking assumes a trust hierarchy: the system prompt (what the lab wrote) is trusted most, the user prompt next, and retrieved web content least. The model is supposed to treat retrieved content as information, not as instructions.

WARP is not a prompt injection in the classic sense — the planted text doesn't say "ignore previous instructions". It just says "this product is good". But the effect is the same: a piece of untrusted, retrieved content ends up shaping the agent's output as if it were trustworthy. The hierarchy exists on paper. In practice, once retrieved content reaches the synthesis step, the model treats whatever it read as roughly equally weighted evidence. There is no internal tag saying "this came from a random Reddit account".

The structural fix the paper gestures toward is a whitelist: only cite from sources you trust. This works, partially. It also shrinks coverage dramatically, kills recency (Wikipedia is days behind, official docs do not exist for most consumer questions), and does not even solve the problem cleanly, because Wikipedia is on every plausible whitelist and Wikipedia is itself editable. The Cornell team showed the Wikipedia-injection variant works too.

What this changes

The reason WARP matters is that recommendation queries, what should I buy, which service is best, is this trustworthy, are exactly the queries where users act on AI output most directly. They are also the queries where the agent leans hardest on user-generated content, because that is where the useful signal lives. The attack surface is widest exactly where user trust is highest.

If you build with deep-research agents, the practical takeaway is to treat their recommendation outputs as leads, not as conclusions, and to keep a human verification step on anything where being wrong has a cost. If you use them as a reader, the same thing applies: the citations look authoritative, and most of them are. The thirteen words you cannot see are the problem.

Footnotes and links

Further reading

• Cornell Tech preprint (search arXiv cs.CR for June 2026): https://arxiv.org/list/cs.CR/2606
• STORM open-source deep-research agent: https://github.com/stanford-oval/storm
• 404 Media coverage: https://tech.yahoo.com/ai/chatgpt/articles/13-word-reddit-trick-ai-233157304.html

¶