An AI agent can cite accurate evidence and still reach the wrong decision

A retrieved document can be factually correct and still be selected to push the reader in one direction. An evidence file can contain a genuine case artifact and a forged instruction about how to interpret it. A research report can cite several real sources but write a conclusion stronger than any of them. These are different defects in the path from data to decision, and simple keyword-based prompt-injection tests do not cover all of them.

The stance-poisoning study injected factually accurate but one-sided material into a retrieval corpus. With a mean poisoning share of 18.9% in the evaluated ProCon documents, all four generator models shifted toward the injected stance. The paper reports that a balancing method reduced the measured deviation, but automatic equal representation can also be misleading where the actual evidence is not balanced. Experimental result.

The mechanism is not a command such as 'ignore previous instructions'. The model receives a distorted sample of relevant information. A detector that only searches for imperative instructions could approve every document while the aggregate evidence remains selectively biased.

The forensic-evidence injection study placed attacker instructions inside material examined through an Autopsy/MCP workflow. One controlled test steered an assistant toward misclassifying a rhino as a triceratops. Other pathways induced an integrity-file write or an HTTP callback using tools already granted to the investigator. These are laboratory demonstrations, not evidence that a real criminal case was altered. Observed tool paths.

An evidence artifact may support a proposition about the investigated system without granting instructions to the investigator. The error occurs when text encountered during analysis is promoted to the authority to edit the investigative record or contact an external destination.

The JevAdvBench study tests systems producing numbers, categories or ordered risk levels. The attacker does not need the final answer to contain free-form instructions. Reordered evidence and persuasive framing can change a syntactically valid decision that a downstream service automatically executes. The paper evaluates controlled models and task distributions, not a proven compromise of deployed financial or medical workflows. Benchmark methods.

The SmoothScore study reports material claim-strength exaggeration in research-agent outputs and traces in which many cited pages were not opened by the system. Its grader has limitations, but the distinction is operationally important: a URL attached to a sentence does not prove that the retrieved text was read or that it entails the sentence. Provenance measurement.

A related RAG defense-shortcut study removed an unnatural question-prefix cue from test input and observed RAGuard AUROC falling from 0.953 to 0.758, with missed attacks increasing. That warns against taking high detector scores at face value when the evaluation contains shortcuts unrelated to the real trust boundary. Operating-point evidence.

A more rigorous research trail keeps the source bytes or version, exact locator, claim extracted from the source, competing evidence and any action produced from the claim separately. It should test whether the conclusion would survive relevant omitted evidence. That is not a promise of a universally neutral judge; it is a way to expose precisely where citation, interpretation and authorized action diverge.