Fake news has 62% success against trading agents, injection only 14%

Researchers made a benchmark to attack AI agents that trade stocks. These agents use news as evidence for each trade. Information injection is an attack on the evidence that the agent uses, not on its instructions. Fabricated news had a 62% attack success rate, against 14% for prompt injection. The test has about 10,000 decisions on 15 stocks in the US.

How it works

The benchmark has 5 injection vectors and 7 event categories. Agents read the same feeds with almost the same policies. One fabricated post can push them into the same trade at the same time.

The numbers

• When the team removed a named source or a “BREAKING” tag, success went from 100% to 0%.
• A fake indicator panel had 91% against an agent about to hold, and 12% against one about to buy.
• Attacks had success across model vendors, and when mixed into news that is correct.

What is not known

This is one paper, and no other group has done a check of it. It is a benchmark, not a report of an attack in use. Scaling of models stopped shallow vectors but not fact poisoning. Peer debate did not lower success. Only hierarchical aggregation lowered success.

Insight: Attacks now target the evidence of an agent

Previous work shows 2 results. Correct text in an item description makes agents rank items lower. Text in a repository made coding agents give a wide rule in 58% of tests. The attack moves from the instructions of an agent to its evidence, and filters on instructions do not find it. Attackers get control when many agents read one feed.