A convincing data source is not necessarily an independent source

In one controlled trading-agent study, fabricated financial news changed simulated decisions much more often than direct commands to ignore instructions. The model did not need to abandon its trading objective. It only had to believe a market claim that an attacker had placed inside its ordinary evidence feed.

That distinction connects three October studies about financial decisions, mobile interfaces and browser content. Their common failure is not that agents cannot read text. It is that content supplied by an untrusted origin can be mistaken for independent evidence or permission to act.

The financial information-injection benchmark reports a mean 62% attack-success rate for fabricated task-relevant news, compared with 14% for direct prompt-control attempts under its selected conditions. It includes around 10,000 simulated decisions on 15 US equities. The effect is a changed trading policy decision, not proof of a broker-executed trade, stock-price movement or real investor loss.

Source attribution was part of the mechanism. In one selected ablation, removing a claimed source noun from a highly effective false-news template removed the measured attack success. That observation illustrates how a credibility cue can alter model behavior even when the underlying statement remains invented; it does not establish that every attribution cue has the same effect.

MobileInject synchronizes hostile visual content and accessibility text in simulated Android workflows. If the same application controls both observations, agreement between the screenshot and the accessibility tree is duplication, not independent corroboration. Its executable benchmark tracks when reasoning influence reaches later actions, but it does not document exploitation of an ordinary consumer banking application.

Intact addresses a related browser problem at the element level. Its GenTree representation retains information about which scripts created or modified content and constrains how text from an element can influence actions. The paper reports reducing a selected injection-planning success measure from 73.1% to 12.8%. The scored milestone concerns consent or planning in experimental browsing tasks, not a measured reduction of all final unauthorized transactions.

A repeated claim is not corroborated simply because it appears in two agent summaries, two rendered formats or two downstream reports. The investigator needs a provenance graph: origin, transformation, independent source, decision and authorized effect. In the trading study, the output that matters is a selected position; in MobileInject, it is an observed application action; in Intact, it is the browser-interaction milestone the researchers actually scored.

Source authentication and action authorization solve different parts of this problem. Checking that a market report came from a named issuer addresses evidence origin; an independently enforced trading limit constrains what a bad report can cause. Element provenance may prevent untrusted page content from issuing requests, but it cannot prove every asserted fact is true. The defensible design makes both boundaries observable and tests their effects separately.