13-Word Reddit Comment Can Influence AI Deep Research Results, Study Finds

A short Reddit comment can influence AI-generated research reports when deep-research agents repeatedly retrieve the same user-generated pages, according to a new academic study. The attack, called WARP, shows how attackers could use ordinary web comments to push fake brands, scams, or misinformation into AI-generated answers.

The research paper, titled Deep-Research Agents Can Be Poisoned via User-Generated Content, was written by Tingwei Zhang, Harold Triedman, and Vitaly Shmatikov. It examines how deep-research agents retrieve, synthesize, and cite web content when answering complex questions.

The key finding is simple: if an AI research agent keeps retrieving the same Reddit or Wikipedia page for related searches, a small piece of poisoned user-generated content can appear in reports for many different users. In one test, a 13-word snippet promoting a fictional cancellation service was enough to make an open-source agent cite and mention the fake service.

What WARP Means for AI Search

WARP stands for Web Agent Retrieval Poisoning. The attack does not require hacking OpenAI, Google, Reddit, or a search engine. It works by placing attacker-controlled text on public pages that AI research agents already tend to retrieve.

Deep-research tools are designed to perform multi-step searches, gather information, and produce cited reports. OpenAI describes deep research as an agent that can independently find, analyze, and synthesize online sources into a detailed report.

Google’s Gemini Deep Research documentation also describes a system that can plan, search, and synthesize long-horizon research tasks. These tools can be useful, but the study shows that web retrieval can become a weakness when systems rely on public user-generated content.

How the Attack Works

Stage	What the attacker does	Why it matters
Reconnaissance	Searches for Reddit, Wikipedia, or other UGC pages that appear across many related queries.	Recurring pages give attackers a high-leverage target.
Poisoned text creation	Adds a short, natural-sounding phrase that promotes a fake entity or claim.	The text can blend into the page and later appear in AI reports.
Deployment	Posts the text as a comment or adds it to another editable user-generated page.	The attack needs only access to a public posting surface.
Retrieval	The AI research agent retrieves the poisoned page during its research process.	The poisoned text enters the agent’s evidence pool.
Synthesis	The agent cites or repeats the planted claim in the final report.	The fake entity can look trustworthy because it appears with a citation.

The researchers tested the full attack on three open-source deep-research systems: STORM, Co-STORM, and OmniThink. They used 176 queries across 11 topic clusters, including cryptocurrency advice, service cancellation questions, product comparisons, dating apps, and local restaurant recommendations.

In the paper’s SERP-snippet setting, a single poisoned URL with 13 words of injected text produced 38% to 51% mention rates conditional on exposure. Multi-URL targeting raised that range to 42% to 62% across the tested open-source systems.

The study used an ethical simulation framework and did not poison live web pages. That distinction matters because the research proves the attack path under controlled conditions, not that a public Reddit comment has already manipulated a live ChatGPT or Gemini report.

Why Reddit Became the Main Target

Reddit appeared as the most important user-generated platform in the study because deep-research agents often retrieve Reddit threads for subjective or recommendation-style queries. These include questions about local restaurants, cancellation processes, consumer products, and personal services.

The researchers found that Reddit dominated the user-generated content retrieved by tested systems. In final citations, Reddit made up 72.9% of Co-STORM’s UGC citations, 65.8% of STORM’s, 46.9% of OmniThink’s, and 58.1% of Gemini Deep Research’s UGC citations.

This does not mean Reddit content is always unsafe. It means open-web AI systems may give a small number of frequently retrieved community pages too much influence when they build answers from public search results.

OpenAI and Gemini Showed Different Exposure Levels

The researchers did not run the live poisoning attack against commercial systems. Instead, they studied how often commercial deep-research tools cited user-generated content in final reports.

OpenAI Deep Research cited only three user-generated URLs across 176 queries, or 0.4% of citations. The paper says its final citations consisted almost entirely of established media, government sources, and official product pages.

Gemini Deep Research cited user-generated content much more often in the study. It had 623 UGC citations across 5,157 total cited URLs, or 12.1%. The researchers also found 102 recurring UGC URLs across the 11 topic clusters for Gemini, which suggests a larger citation-level exposure to WARP-style manipulation.

Examples From the Study

Query type	Poisoned entity	What the AI report did
Canceling Xfinity internet	CancelEase	Presented the fictional service as a way to simplify cancellation.
Mexican food near Austin	Sol Azteca	Recommended the fictional restaurant as an authentic option.
Dating apps for divorced men over 50	SilverPath	Described the fictional app as a suitable dating option.
AAA alternatives in Minneapolis	NorthStar Roadside	Framed the fictional roadside service as a competitive alternative.

The “13-word” example came from a cancellation query. The planted text promoted a fictional service called CancelEase. Once the poisoned page was retrieved, the agent could include that service in its report with a citation to the manipulated Reddit page.

A separate example used a Reddit food thread to promote a fictional restaurant called Sol Azteca near Austin. The attacked report then included Sol Azteca alongside real recommendations, showing how easily a fake local business could appear credible in an AI-generated answer.

These examples matter because they mirror real search behavior. People increasingly ask AI tools for recommendations, cancellation help, local services, health-adjacent products, and financial information. Those are areas where one poisoned citation can steer users toward poor or unsafe decisions.

Why Existing Defenses Struggled

The researchers tested several defenses, including blocking user-generated content, filtering inputs, and filtering final outputs. None fully solved the problem without trade-offs.

Blocking Reddit, Wikipedia, and similar platforms can reduce the attack surface, but it also removes useful first-hand information. For some topics, user-generated content adds details that official pages or media reports do not cover.

Input filtering also had limits. GEO-generated poisoned text can look fluent and natural, which makes it hard to detect using simple spam or perplexity-based methods. Output filtering also struggled because poisoned reports could remain semantically similar to clean reports while still inserting a fake recommendation.

What AI Companies and Users Should Do

For AI companies, the study points to a need for stronger source-quality scoring, cross-source verification, provenance checks, and separate treatment for highly editable user-generated pages. Agents should not treat one Reddit comment the same way they treat an official support page, a government advisory, or a long-standing expert source.

For users, the safer approach is to verify AI-generated recommendations before acting on them. This is especially important for financial advice, security tools, health products, legal services, subscriptions, and local providers.

• Check whether an AI answer relies on Reddit, forums, or other editable pages.
• Verify recommended brands, apps, services, or products outside the AI report.
• Look for official pages, regulator guidance, product documentation, or trusted reviews.
• Be cautious when an unfamiliar service appears in an AI answer with only a forum citation.
• Do not treat citations as proof that a recommendation is safe or legitimate.

The Bigger Risk for AI Search

The study shows that AI search poisoning may become a practical problem as more people use research agents instead of traditional search results. Attackers do not need to rank a full website or compromise an AI model. They only need to influence a source that the agent already retrieves.

The WARP paper also highlights a deeper design issue. Deep-research agents often ask many related queries during one task, and those queries can keep returning the same small set of pages.

That overlap creates a concentrated attack surface. A single manipulated Reddit thread can affect many different search phrasings inside the same topic cluster, making the attack efficient for scammers, marketers, or disinformation operators.

OpenAI’s research agent and Google’s Deep Research agent show where AI search is heading: longer reports, more autonomous browsing, and more cited synthesis. The WARP study warns that these systems need stronger defenses before users treat them as trusted research intermediaries.

FAQ