An AI agent is software that reads websites and makes choices or takes actions for someone. A fake safety warning in a review can make it reject trustworthy options and choose an attacker’s listing. Unlike a direct command, the warning looks like ordinary advice.
Researchers tested this tactic across models, services, live web-browsing agents, and a system that fetches pages for an agent. They also tested filters designed to catch commands, then added an instruction requiring a separate source to confirm a safety claim before it could rule out a provider.
Fake warnings often got through the filters and steered choices about as often as direct commands. Requiring separate confirmation cut successful attacks by roughly 95%, showing that checking evidence, not just filtering suspicious wording, can make agents safer.