Fake headlines fooled an AI trading agent 62% of the time. Prompt injection worked 14%.

AI agents that read news and then place orders are arriving at retail brokers. Security researchers have spent two years testing whether such an agent can be talked out of its instructions. A preprint posted to arXiv on October 19, 2026 by Mengxiao Wang and Nitesh Saxena of Texas A&M University asks a different question: what if the instructions stay intact and the evidence is false?

What they built

The authors call the attack information injection. Instead of typing "ignore previous instructions," the attacker posts a fabricated headline, such as a made-up report that a company's chief executive has been arrested. The test agent is a single-shot trader on GPT-4o-mini that reads market data, indicators and news, then returns a trade or a hold. The study crosses five ways of corrupting the content with seven kinds of faked event, over roughly 10,000 model calls on 15 large U.S. stocks. Success means the agent's decision flipped away from its benign baseline.

As a control, the authors reran each stock's unchanged context 150 times at slightly higher randomness. Zero decisions changed, so the flips they score are not sampling noise.

The headline result

Control-plane attacks, the prompt-injection style, succeeded on average 14% of the time. Fabricated information succeeded 62% of the time, about 4.5 times as often. Two 30-word templates flipped the agent on all 15 stocks, every run.¹

Within the information attacks, the strongest vector was plain fact poisoning, and the weakest was pure sentiment spin. The paper's Table 4 gives the averages by vector:⁴

• Fact poisoning: 79.1%
• Structured-signal poisoning (a fake indicator panel): 64.8%
• Coordinated multi-source agreement: 61.6%
• Selective evidence: 52.5%
• Sentiment narrative: 50.7%

The reason, in the authors' reading, is that a trading agent has a goal. It will not drop that goal for an odd command, but its job is to act on news, so a believable news item is exactly the input it is built to trust.

Form beat content

The most striking test kept a false claim identical and changed only its presentation. A template that succeeded 100% of the time fell to 0% once the named source and the "BREAKING" tag were removed.² The agent was responding to the look of credibility, not to anything it could verify.

Position mattered too. A fake indicator panel worked 91% of the time against an agent that was about to hold, and 12% against one that was about to add to a position.⁵ The authors turn this into an attacker recipe: pick the direction the agent is leaning against.

Do bigger models or more agents help?

Only partly. On a larger same-vendor model, GPT-4o, two structural attacks fell to 0%, because the model noticed they contradicted data already in its context. Fact poisoning still worked 93% of the time, since nothing in the context could contradict it.⁶

Adding agents helped only in one design. In a star pipeline, where an aggregation stage cross-checks the claim against other analysts' views, success fell from 75% to 9%. Under peer debate it stayed at 74%, because the debate manufactured a consensus around the fake story.³

The paper also reports that a safety-tuned model looked immune, 0% success, when the fake item carried an explicit adversarial label, yet fell to 46% once the same content was blended unlabeled into a feed.¹

In a day-by-day backtest on six stocks, the authors also forced the agent into the attacker's chosen direction and found that the attacker sets the sign of the victim's outcome, though results were mixed by stock. A single injection pushed the agent to deploy about $16,000 of its $20,000 in capital.

Why this is a lab result, not a market event

The agent is a deliberately simple, low-cost, single-shot design. The authors argue this is the tier retail integrations actually use, but they did not attack any live broker product. The fabricated items were appended to the agent's context under an explicit marker in the main tests, a choice the authors call conservative. The stocks, window and prompts are a small, fixed set.

Genuine same-company reporting that contradicts the fake claim, the strongest realistic defense, is listed as future work. The paper is a preprint and has not been peer reviewed.