LLM search agents can be pushed to endorse manipulated web content

LLM-based search agents are starting to sit in a dangerous middle position: they are not just retrieving pages, and they are not just answering questions. They are deciding which sources to trust, then turning that judgment into a recommendation. This paper looks at that endorsement step directly.

That matters because a lot of current evaluation still treats search agents like answer machines. If the response sounds coherent or cites something, people tend to assume the system is behaving safely. SearchGEO asks a sharper question: can an adversary shape the information environment so that the agent actively backs the wrong thing?

The answer is yes, and the size of the problem depends a lot on the model family and the attack pattern.

---

SearchGEO measures endorsement, not just answer quality

SearchGEO is built to test a specific failure mode: endorsement corruption. In plain terms, the paper is not asking whether the model can be tricked into producing a bad answer. It is asking whether the model’s final recommendation ends up supporting manipulated web content.

The framework has three parts: a web-evidence manipulation pipeline, a five-mode attack taxonomy, and multiple output-level metrics. That is a useful shift. It lets the authors probe how agents behave when the evidence they see has been engineered to look credible, connected, or authoritative.

The evaluation is also broad enough to matter. The task suite covers 44 queries split evenly across four high-stakes domains: health, finance, consumer IT, and legal. Across those tasks, the paper evaluates 13 LLM backends on 308 cases each.

In total, that produces 4,004 cases. The authors also note the run spans over 6,000 evaluated cases across the broader experimental design.

---

Vulnerability is real, but it is not evenly distributed

The headline result is the spread. Overall attack success rate ranges from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash. That is not a small tuning effect. It means some backends are effectively resistant under this setup, while others can be pushed into endorsement surprisingly often.

The paper defines attack success in a straightforward way: the agent’s final answer recommends the manipulated material under its normal search-and-evidence workflow. So this is not about odd phrasing or superficial citation behavior. It is about the system landing on the wrong side of a recommendation decision.

A useful detail is how the experiments are staged. The search proxy uses cached real SerpAPI results, with live fallback for off-cluster follow-up queries. That makes the setup closer to realistic search behavior than a purely synthetic benchmark, even if it still falls short of live web dynamics.

There is one more measurement wrinkle worth keeping in mind. Each metric is computed by an LLM judge over the agent’s final answer, and the primary judges and the SS auditor both use GPT-5.4-mini. That is common in this kind of evaluation, but it does mean the scoring layer deserves some scrutiny of its own.

---

The same attack does not work equally well across models

The paper’s most practically important point is not just that agents are vulnerable. It is that the strongest attack mode changes by model family.

That means you cannot assume there is one universal failure pattern. A deployment scaffold that amplifies attack success on one backend can reduce it on another. The same wrapper, the same evidence flow, and the same search settings do not produce the same risk profile everywhere.

The taxonomy helps explain why. The attacks fall into three layers: machine-layer, trust-signal, and compound vectors. Some modes target a direct machine cue. Others target the way models interpret source diversity, authority, or citation chains. The compound cases combine those signals so the content looks more independently validated than it really is.

Mode 2B is especially relevant for anyone building search or RAG systems. It tests whether agents distinguish source diversity from genuine evidentiary independence. In other words, if several pages point to the same origin, does the model notice that they are correlated rather than independent proof?

Mode 3 goes after the same blind spot from another angle. It combines an authority anchor, a review that cites the anchor, and a forum post that cites both. The paper reports a 15.0% silent-shift rate for Mode 3, which is a concrete sign that correlated citation chains can still move the agent’s conclusion.

---

The clearest failure is not “bad search,” it is misread trust

The auxiliary agent-skill probe is useful because it changes the meaning of endorsement. When endorsement becomes an install command, the paper finds a sharp split: Claude over-rejects while GPT over-trusts.

That result matters because it suggests the issue is not just retrieval quality. Some systems are too cautious in the face of suggestive evidence, while others are too willing to accept it. If you are only watching whether the model cites sources or returns a plausible answer, you will miss that difference.

The authors are also careful about the limits of the setup. The evaluation relies on a hybrid web proxy rather than live search engines, and about 30% of cached results expose only snippet-level content. The setup does not capture live ranking dynamics, freshness signals, or competitive SEO, and the shorter cached contexts may make ASR look a little better than it would on fully rendered pages.

They also do not simulate several real-world attack surfaces: live ranking manipulation, ad buying, link farms, deceptive live domains, credential theft, or executable payloads. So the measured 31.4% is not a ceiling. It is a controlled estimate under a constrained threat model.

---

What to do if your workflow uses search agents to recommend things

The practical move is to stop treating “good answer quality” as the whole safety story. If a system is used to recommend, approve, rank, or shortlist content, endorsement needs its own evaluation track.

That means testing more than factual accuracy. You need checks for evidentiary independence, correlated citation signals, and source diversity that only looks diverse on the surface. A search agent can cite three pages and still be leaning on one origin. That is exactly the kind of failure this paper is trying to surface.

For teams shipping LLM search or RAG systems, the safest next step is internal red-teaming against endorsement behavior. Use manipulated evidence sets. Vary whether sources are genuinely independent. Check whether the model changes its judgment when authority and citation chains are coordinated. And do not assume that citations, by themselves, imply trustworthiness.

The paper also makes a broader point about eval design. If your deployment is sensitive to trust decisions, you probably need a separate benchmark for trust distortion, not just one for answer correctness. Otherwise you can end up optimizing the visible part of the system while leaving the real failure mode untouched.