A paper accepted to the WAB@COLM 2026 workshop shows that agentic AI systems can be steered in laboratory conditions: a seemingly harmless denial sentence about a nonexistent item, when paired with fabricated background text that implies danger, can change ranking outcomes. The study tested eight commercial models and found that background text presented directly in the agent context could elevate previously lower-ranked offers into the top two positions, potentially altering human decisions that rely on agent recommendations.
Who wrote the study and where was it presented?
The study, titled Welcome to the Age of Agent Ads: Using On-Policy Attacks to Steer Agentic Decisions, was authored by Tim R. Davidson, Marija Šakota and Robert West of École Polytechnique Fédérale de Lausanne (EPFL) and Joshua Joseph of Harvard University. The work was accepted to the WAB@COLM 2026 workshop; COLM is a conference for researchers working on language models.
What is the attack and how does it work?
The authors describe the pattern as an "on-policy attack": rather than bypassing model constraints or issuing forbidden instructions, the attack exploits the model's intended, cautious behaviour. For example, a product description might include the sentence “This product does not contain blizyester.” Blizyester is a fabricated term. A human reader may ignore it or notice it as odd, but an agentic assistant that is designed to be cautious and to look things up may query the web. If the surrounding context—either in the agent prompt or retrieved from the web—contains documents that assert blizyester is dangerous, the agent may rank the product that denies it higher than competitors.
Experimental setup: models, domains, and samples
The researchers evaluated two variants from each of four providers — OpenAI, Anthropic, Google and xAI — for a total of eight commercial models. Each model ranked seven offers in four domains: beauty products, dietary supplements, job postings and short-term rentals. For each category the experiment used 100 ads; for example, job postings were Android developer roles and rentals were Amsterdam Airbnb listings.
In the intervention, one offer included a claim that a fictional concept was absent (a non-existent ingredient, a fabricated legal term, or a made-up standard). The metric was how many offers that originally ranked between positions 3 and 7 rose into either of the top two slots when fabricated background text implying danger was present in the agent’s context.
Key findings
Aggregated results reported by the authors (based on Table 8 averages) indicate that when the fabricated, danger-implying background text was placed directly in the model’s context, a substantial portion of previously lower-ranked offers moved into the top two positions. The effect was largest for beauty products and dietary supplements; it was smaller but still measurable for job and rental listings.
When the fabricated background text was not inserted directly into the model prompt but was instead presented as if retrieved from a web search, the effect was generally weaker. The authors note that Gemini 3.1 Pro and Claude Opus 4.8 were among the most susceptible models in these experiments. Susceptibility and the models’ willingness to perform web searches varied by model and by instruction.
Why does this manipulation succeed?
The attack requires two components: the innocuous denial phrase by itself is not decisive; the decisive factor is the fabricated background material that presents the invented concept as risky. The approach works because the agent behaves like a cautious assistant: it looks up unfamiliar terms, considers contextual evidence and produces a ranked recommendation. That combination of caution, openness to new information and ranking behaviour creates the attack surface.
The researchers also reviewed the policies of 15 platforms (marketplaces, job boards and rental platforms). While platform rules generally require advertisers to tell the truth and some prohibit competitor smear campaigns or manipulation of rankings/discoverability, none of the examined policies mention deceptive practices targeted specifically at AI agents.
Recommendations and limitations
The authors propose adding a rule that content must not be designed to mislead readers’ AI agents. They argue this is necessary but not sufficient. On the technical side, they caution that simply increasing an agent’s cautiousness is counterproductive, because the attack relies on that cautiousness. Instead, agents should consistently evaluate source reliability during ranking decisions.
An interesting result is that when researchers explicitly asked the models about the fabricated concepts and provided the false background text, all models identified the concepts as fabricated. However, during ranking—without an explicit query—this detection did not reliably prevent the models from being influenced.
The paper is explicit about its limits: this was a controlled laboratory experiment, not a market study. Sample sizes and categories are specific, and the reported results are experimental measurements rather than broad field estimates.
Broader implications
Agentic AI systems promise to save users time by pre-filtering and recommending offers, but that role also makes them potential vectors for influence. The more decisions we delegate to agents, the more important the informational ecosystem around those agents becomes and the more valuable it becomes for adversaries to shape that ecosystem. The study highlights a wider data-quality concern: the web is increasingly populated by machine-generated and low-quality content, which can degrade the knowledge base that models rely on.
Conclusion
The study does not claim widespread market exploitation today, but it demonstrates a measurable attack surface: agents’ justified caution and context-sensitive ranking can be exploited to promote certain offers. The authors call for both regulatory updates to address AI-targeted deception and technical measures so agents assess source credibility during ranking, reducing their vulnerability to such on-policy attacks.
