Breadcrumbing Search Agents

2026-08-05

AI Summary

This work demonstrates that large language model–based search agents are vulnerable to cross-turn collaborative attacks, wherein adversarial search results and web content are progressively injected to steer the agent toward erroneous conclusions. To exploit this vulnerability, the authors propose the Authority-Chain Hijack attack, which integrates multi-source evidence chain construction with a Trace-Guided Strategy Evolution (TGSE) mechanism to optimize attack strategies over extended interaction sequences while maintaining high stealth. Experimental evaluation on the SafeSearch benchmark shows that the proposed method elevates the overall attack success rate from 55.9% to 71.4%, achieving up to 95.0% success at critical decision points, thereby substantiating the effectiveness and novelty of the attack framework.

Abstract

LLM-based search agents are widely used for information-seeking tasks, but their reliance on external tool returns introduces a critical security risk: web content retrieved during execution is untrusted, exposing agents to prompt injection and goal hijacking. Prior work on search-agent safety primarily focuses on static web-content injection, but modern agents issue follow-up queries and cross-check competing sources, so a single injected page is often diluted or rejected. We show that the channel delivering search and page observations is a fragile security boundary: beyond exposing the agent to a single poisoned page, a mediated search interface can repeatedly steer how the agent gathers evidence and forms its final answer. Under a constrained tool-intermediary threat model, appending only one controlled result per query can substantially increase attack success when the evidence is coordinated across the agent's trajectory. We study this setting with a strategy-driven long-horizon attack system and introduce Authority-Chain Hijack (ACH), an expert-refined strategy that turns isolated search-result and page-content manipulations into a coherent evidence chain across seemingly corroborating sources. ACH achieves the highest Overall ASR among all baselines, reaching 55.9% / 83.3% ASR / MaxN ASR on the full SafeSearch test split. We further introduce Trace-Guided Strategy Evolution (TGSE), which automatically improves attacker strategies from execution traces, replacing manual redesign with trace-driven refinement; its strongest single setting reaches 71.4% / 95.0% in held-out evaluation.

Problem

• prompt injection
• goal hijacking
• search agents
• security risk
• evidence chain

Innovation

• Authority-Chain Hijack
• Trace-Guided Strategy Evolution
• search agent security
• prompt injection
• long-horizon attack