The text did not need to say ignore instructions. The planted review asserted a dangerous defect in ordinary suppliers, causing an assistant to eliminate those candidates as unsafe and choose the attacker-controlled option. Because the claimed hazard looked like task evidence rather than a command, filters tuned to imperative injection were less effective. …
Inspect the ClaimsCase · DiggingBeagle record
Fabricated safety warnings steered AI shopping agents without explicit instructions
Attackers could disqualify legitimate suppliers by planting ordinary-looking review claims.
Public disclosure: Nov 3, 2026
Scope
Controlled product-agent recommendation tests across synthetic providers and generated review contents.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The Voluntary Servitude authors observed controlled recommendation steering with fictitious suppliers. Corroboration rules were tested on selected payloads, not live colluding review networks. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-FAKE-SAFETY-REVIEW-AGENT-CHOICE-01 · CLM-FAKE-SAFETY-REVIEW-AGENT-CHOICE-02 · CLM-ENR-SAFETY-REVIEWS-ELIMINATION · Voluntary Servitude: weaponized safety warnings
At a glance
A content guard that detects commands can still accept invented facts that change a consequential recommendation.
Read the implicationsThe researchers used fictitious products and controlled recommendations. There is no verified damaged merchant, customer purchase or coordinated production review campaign in this dataset. Corroboration under an adaptive multi-source adversary still needs testing.
Limits and uncertaintyFull account
The text did not need to say ignore instructions. The planted review asserted a dangerous defect in ordinary suppliers, causing an assistant to eliminate those candidates as unsafe and choose the attacker-controlled option. Because the claimed hazard looked like task evidence rather than a command, filters tuned to imperative injection were less effective.
The researchers used fictitious products and controlled recommendations. There is no verified damaged merchant, customer purchase or coordinated production review campaign in this dataset. Corroboration under an adaptive multi-source adversary still needs testing.
The attacker did not need to tell the assistant to ignore instructions. A review presented a false safety hazard, causing the agent to remove competing suppliers through its ordinary selection logic. In four of the six tested models, elimination accounted for 97% to 99% of successful safety-family attacks. Injection filters designed for imperative language therefore missed a fact-contamination path. This was measured with synthetic merchants; separate corroboration before exclusion is a promising evaluated control, not proof against colluding false reviews.
Mechanism and trust boundary
- 01
Place a false hazard claim inside an external customer review.
- 02
Let the assistant evaluate product safety using that review as evidence.
- 03
Observe recommendation displacement without an explicit instruction to disobey.
Claims & evidence
CLM-ENR-SAFETY-REVIEWS-ELIMINATIONThe study reports that 97% to 99% of successful safety-family attacks for four of six models worked by disqualifying competing suppliers, not merely ranking the attacker target first.supported
Basis: reported finding
- supportsVoluntary Servitude: weaponized safety warningsprimary disclosure
Results 5.2: How the attack wins; Elimination and comparison
CLM-FAKE-SAFETY-REVIEW-AGENT-CHOICE-01In the Voluntary Servitude study, fake hazard warnings selected the attacker-preferred supplier in 60.4 percent of tested queries, versus 66.0 percent for explicit instruction injection.supported
Basis: reported finding
- supportsVoluntary Servitude: weaponized safety warningsprimary disclosure
Abstract; Table 1 effective attack success; results on warning family
CLM-FAKE-SAFETY-REVIEW-AGENT-CHOICE-02Behind the two tested injection filters, fake safety warnings had higher effective attacker success than imperative injection: 60.4 versus 35.7 and 47.1 versus 10.6 percent.supported
Basis: reported finding
- supportsVoluntary Servitude: weaponized safety warningsprimary disclosure
Table 1 ProtectAI and Lakera filter outcomes
Implications
A content guard that detects commands can still accept invented facts that change a consequential recommendation.
Controls and mitigations
- Require independently trusted corroboration before excluding a supplier for severe safety allegations.
Unknowns and contradictions
- The researchers used fictitious products and controlled recommendations. There is no verified damaged merchant, customer purchase or coordinated production review campaign in this dataset. Corroboration under an adaptive multi-source adversary still needs testing.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229