AI Deep-Research Agents Vulnerable to Reddit Content Poisoning

Cornell Tech researchers Tingwei Zhang, Hal Triedman, and Vitaly Shmatikov built WARP (Web Agent Retrieval Poisoning) after noticing that deep-research agents repeatedly retrieve the same handful of user-generated pages across related queries ^[1], turning platforms like Reddit and Wikipedia into a concentrated attack surface rather than a diffuse one. Individual UGC pages recurred in up to 48% of runs on related queries, meaning a single compromised Reddit thread can bleed into an entire family of future agent answers ^[5]. The attack itself needs no access to any AI provider's model weights or proprietary retrieval index - just the ability to leave a comment ^[5]. Tested against three open-source deep-research systems, STORM, Co-STORM, and OmniThink ^[1], a snippet of roughly 13 words was enough to consistently steer outputs toward spam or scam content ^[2]. Cornell researcher Hal Triedman explained that wording matters as much as placement: an 11-to-15-word snippet closely mirroring a likely search query is disproportionately persuasive to an LLM ^[2]. Co-author Tingwei Zhang added that the underlying problem is architectural, not just adversarial - deep-research agents don't weigh source credibility the way a person would, treating a random Reddit comment the same as a government website ^[2].

The paper's proof-of-concept harms read like a con artist's wish list. A poisoned r/austinfood comment got agents to recommend a fabricated restaurant, 'Sol Azteca,' instead of a real one ^[2]; a planted post in r/OnlineDating pushed a nonexistent dating app called 'SilverPath' ^[2]; other tests produced a bogus Xfinity-cancellation service and a fictional cryptocurrency, 'BananaCoin,' elevated in the same breath as Bitcoin and Ethereum ^[5]. These weren't rare flukes - when the poisoned page was retrieved, a 13-word payload produced conditional mention rates of roughly 38-51%, rising to 62% when the payload was spread across multiple pages ^[3][5]. Even when the injected text made up less than 4% of a full Reddit thread's content, agents still repeated the planted claim in 30-53% of runs where the page was viewed ^[3][5]. That effectiveness traces back to where the vulnerability sits structurally: user-generated platforms already supply 17-23% of the URLs deep-research agents retrieve, and Reddit alone accounts for roughly 54-71% of that pool ^[4][5].

The researchers didn't just find the hole, they tried to patch it - and mostly failed. Source-level filtering and output-based detection, including perplexity-based text filters meant to flag machine-crafted injections, failed to reliably separate poisoned passages from ordinary Reddit writing ^[3]. That's because well-crafted attacker text reads as natural - statistically indistinguishable from a genuine comment - to the same kind of language model doing the filtering ^[3]. The team stopped short of running live manipulation tests against commercial products like OpenAI Deep Research or Gemini Deep Research, since doing so would require publishing altered content to the open web ^[3], but they did audit how often each system cited UGC in the first place and found a wide gap: Gemini Deep Research cited user-generated content in 12.1% of observed citations, versus just 0.4% for OpenAI Deep Research ^[4]. That gap suggests some production systems are already far more exposed to this class of attack than others, even before anyone tries to exploit it.

The uncomfortable subplot is who profits while this vulnerability sits unresolved. Reddit's UGC is not an incidental data source for the AI industry - it is a licensed one. Google signed a roughly $60 million-a-year deal for structured API access to Reddit data in February 2024 ^[6], and OpenAI followed months later with a comparable agreement, part of an aggregate $203 million in licensing contracts Reddit disclosed at its IPO ^[6]. OpenAI CEO Sam Altman has a more direct stake still: he served on Reddit's board from 2015 to 2022, briefly as interim CEO, and holds an 8.7% ownership stake - about 12.2 million shares, making him the company's third-largest shareholder behind the Newhouse family's Advance and Tencent ^[7]. None of that created the WARP vulnerability, but it does mean the two companies with the deepest financial ties to Reddit - one of them run by a major Reddit shareholder - are also the two whose flagship research products the paper suggests are most exposed to Reddit-sourced manipulation.