Search-grounded models reused attacker pages where independent evidence was scarce

The attacker did not need to alter model weights or own a ranking engine. The study describes the exploitation of thin search spaces: publish an apparently relevant page before reliable sources exist, then encourage an assistant to summarize or cite that page. primary evidence distinguishes a model citing the attacker-controlled text from untraceable adoption of it.

The study used constructed topics, not verified disinformation incidents. Citation rates and inferred use are different outcomes; neither measures a general public misinformation prevalence.

For emerging claims, seek independent corroboration, source age and original documents. A retrieved citation is evidence of where the assistant looked, not an independent verification of the cited assertion.

The attacker controls a search result, not the language model's weights. In the authors' constructed thin-information topics, a single hostile page was enough to appear as a cited, used or listed source in 31% of responses across tested conditions. This umbrella outcome is broader than explicit citation and must not be treated as a 31% false-belief adoption rate. The failure becomes material when a model presents retrieved material as corroboration even though the result is the only origin for the assertion. Reporting should trace the independent number of origins and whether sources merely syndicate one another.