A study finds 36 expired websites in the search results of AI agents

AIR Research Lab released a study of Web Hole, an attack on AI agents that use web search. The team examined about 2,000 queries and about 6,500 sites. It found 36 sites in the search results. The domain of each site was free to get. An attacker can get such a domain and put dangerous text on it.

How it works

An agent uses web search, gets results and opens a page. The system sends a short text of the page to the agent, and dangerous text can go into it. An expired site can keep its rank. The report tells us that this takes less work than a new site.

The numbers

• About 2,000 queries were examined.
• About 6,500 sites were examined.
• 36 sites were free to get and were in the results.

Examples are the domains pyquestions and thestackoverflow. The text gives no report of an attack on a user.

What is not known

The researchers tell us that standard web filters can possibly not stop this. Users can possibly not see which instructions came from a page. The study tests no repair. It tells us that external data must be examined before it goes into the agent.

Insight: Attackers can get the search trust that already exists

An earlier study found attacker pages in 31% of the answers from AI search tools. A different study showed that one hidden instruction can make an agent send data out. Web Hole adds a low-cost entry: an expired domain. This reads as a move where the attacker gets used search trust and does not make new trust. The search index is the weak point. Tell your vendor to show how it examines page text.