You ask AI for market research. It searches dozens of web pages, turns them into a fluent report, and attaches citation links after every paragraph. It looks far more reliable than a chat answer with no sources.
In May 2026, researchers at Cornell Tech published a paper testing “deep research” AI that searches, organizes, and writes reports on its own over many steps. They found these systems repeatedly read the same user-generated content across many topics, such as Reddit and Wikipedia. An attacker who adds a short passage, as few as about 13 words, to one frequently read page saw that text retrieved in 57% to 76% of runs on the topic and cited in 38% to 51% of reports. The researchers call the technique “web agent retrieval poisoning”; it doesn’t require touching the AI model at all, only the ability to post on a public platform.
So a source attached to an AI report only shows where it read a statement, not that the statement is reliable. A conclusion you’ll base a decision on needs at least one independent source that no one can simply edit.
A citation only answers “where it was read”
A citation link answers one question: where did AI get this claim? It doesn’t answer two others: whether the source itself is reliable, and whether it’s enough to support the decision you’re making.
The trouble with deep research AI is that it puts material of very different quality into one fluent report. A forum comment and an official specification both appear as small footnotes. Readers who only look at the result easily mistake “cited” for “verified.” The researchers also note that users tend to find AI output highly convincing even when it contains obvious falsehoods.
Sort the sources behind key conclusions into four tiers
When you get a report, don’t start by polishing the wording. Take each conclusion that will affect the decision and sort its cited source into a tier:
Official documents or primary material: product specifications, prices, policies, announcements. Good for confirming facts, but not a substitute for third-party evaluation.
Original research or credible media: studies and reporting with stated methods and dates. Rely on them only after checking the method and date.
Community discussion, forums, Wikipedia: good for learning how users describe problems, common complaints, and leads to follow up, but anyone can edit them, and they’re the easiest to flood.
Unknown sources or secondhand summaries: only search leads for finding more original material; they don’t belong in a formal report.
The rule is simple: if a conclusion rests only on the third or fourth tier, it’s a lead, not evidence. Community material can serve as a radar for problems, not as the foundation of a decision.
Three situations where you must add evidence
Getting a quick sense of a new term or building a personal reading list is low risk. But in these three situations, how smoothly the report reads isn’t enough:
Purchasing or renewing. Confirm prices, limits, support scope, and contract terms against official documents.
Publishing externally. If an article, deck, or white paper will be cited by customers or the press, don’t dress forum claims up as verified conclusions.
Security or compliance judgments. Relying only on forums saying something is safe is too risky; check official security advisories or professional analysis. The topics tested in the study included antivirus recommendations and investment advice.
There is no one-click fix yet
The researchers found that excluding all user-generated content blocks this attack but also lowers report quality, and that lightweight anomaly detection doesn’t reliably catch poisoned content. In other words, there’s no one-click fix for now; it still takes the reader checking tier by tier.
If the problem is citations that are themselves wrong, such as dead links or mismatched content, see For Reports Written With AI, Check the Citations Before Polishing the Prose. For reining in research whose scope keeps growing, see When AI Research Keeps Growing, Write Down the One Decision It Must Support.
AI handoff card
I have an AI deep research report that I'm about to base a decision on, and I want to check first which conclusions have sources that hold up.
The method comes from this article: https://boosterminiclass.com/en/posts/deep-research-source-poisoning-checklist/
Its view: a source attached to an AI report only shows where it read something, not that it's reliable. Research shows that adding a short passage to a frequently read community page can get deep research AI to cite what an attacker wants to promote. A conclusion used for a decision needs at least one independent source no one can simply edit.
The full report follows this text. Please complete these steps in order:
1. First ask me what decision this report will be used for;
2. List the key conclusions that affect that decision, and mark which tier each cited source belongs to: official documents or primary material, original research or credible media, community discussion or Wikipedia, or unknown source;
3. Flag conclusions that rest only on community or unknown sources, and say what kind of independent source needs to be added;
4. Finally, sort the conclusions into three groups: usable, usable only after adding evidence, and leads only that can't go into the decision.
Don't find new sources to fill the gaps for me; only point out the gaps.
References
- arXiv (Cornell Tech research paper): Deep-Research Agents Can Be Poisoned via User-Generated Content — https://arxiv.org/abs/2605.24245 (2026-05-22)
- Help Net Security: Using Reddit to manipulate AI search results is surprisingly easy — https://www.helpnetsecurity.com/2026/06/23/reddit-ai-search-poisoning-research/ (2026-06-23)
- 404 Media: It Is Trivially Easy to Use Reddit to Manipulate AI Search, Research Suggests — https://www.404media.co/it-is-trivially-easy-to-use-reddit-to-manipulate-ai-search-research-suggests/ [accessed: 2026-10-11]
