Andrii Bidochko

• Updated: July 10, 2026
• 7 min read

FORGE: Research‑Trajectory Hijacking Attacks on Deep Research Agents

Direct Answer

The paper introduces FORGE (Fabricated Orchestrated Reasoning chain for aGent Exploitation), a two‑level attack that poisons the planning layer of deep research agents by injecting fabricated documents that steer both intra‑step reasoning and inter‑step task selection. This matters because it reveals a previously under‑explored attack surface that can corrupt entire multi‑round research reports, threatening the reliability of AI‑driven knowledge work.

Background: Why This Problem Is Hard

Deep research agents—large‑language‑model (LLM) pipelines that decompose open‑ended queries, retrieve web evidence, and synthesize long‑form reports—are rapidly becoming the backbone of enterprise knowledge automation. Their power stems from a recursive workflow:

• Decompose the original question into sub‑tasks.
• Issue a retrieval request for each sub‑task.
• Consume the retrieved documents to answer the sub‑task.
• Iteratively generate follow‑up questions that guide the next retrieval round.

This loop creates a planning‑layer where each new query is conditioned on the content of previously retrieved documents. Existing defenses focus on single‑step retrieval robustness (e.g., adversarial filtering, citation verification) but ignore the cumulative effect of malicious evidence across multiple rounds. Consequently, an attacker who can slip a single crafted document into the retrieval pool can influence not only the immediate answer but also the subsequent sub‑task selection, leading to a cascade of misinformation.

Traditional poisoning attacks on LLMs rely on large‑scale data injection during pre‑training. In contrast, research‑trajectory hijacking operates at inference time, requires far fewer injected documents, and exploits the agent’s own planning logic. The difficulty lies in:

1. Intra‑document fabrication: convincing the agent that a fabricated source is credible enough to base a claim on.
2. Inter‑document coordination: aligning multiple fabricated pieces so that they reinforce each other across recursive steps.
3. Stealth: keeping the malicious content hidden from simple heuristics that flag overtly false statements.

What the Researchers Propose

FORGE attacks consist of two tightly coupled mechanisms:

• Intra‑Document Reasoning Fabrication – The attacker crafts a document that contains a plausible reasoning chain, complete with citations, data snippets, and logical steps. The document is designed to be indistinguishable from genuine web content when evaluated by the agent’s internal verifier.
• Inter‑Document Chain Coordination – Multiple fabricated documents are linked together through shared entities, references, or narrative arcs. This coordination ensures that once the agent consumes the first poisoned document, subsequent retrievals naturally surface the remaining fabricated pieces, reinforcing the malicious narrative.

The researchers also introduce two auxiliary tools:

• PRISM metric – A weighted score that evaluates how many report claims are infected, taking into account the cognitive type of each claim (e.g., factual premise vs. interpretive conclusion).
• Root Query Anchoring (RQA) – A lightweight defense that forces every recursive follow‑up question to be explicitly tied back to the original query, limiting the attacker’s ability to drift the research trajectory.

How It Works in Practice

The FORGE workflow can be visualized as a three‑stage pipeline:

Stage 1 – Document Fabrication

The attacker selects a target research query (e.g., “What are the environmental impacts of lithium‑ion battery recycling?”) and creates a set of five fabricated web pages. Each page contains:

• A headline that matches typical SEO patterns.
• Embedded tables, charts, or code snippets that the agent can cite.
• Cross‑references to the other fabricated pages, forming a hidden chain.

Stage 2 – Insertion into Retrieval Pool

These pages are hosted on low‑cost domains and indexed by search engines. Because the retrieval component of the research agent relies on keyword matching and relevance scoring, the fabricated pages surface alongside legitimate sources during the first retrieval round.

Stage 3 – Recursive Hijacking

When the agent consumes the first fabricated document, its internal reasoning module extracts a set of “next‑step” questions that are subtly biased toward the attacker’s narrative. The subsequent retrieval round then pulls the second fabricated page, and the cycle repeats. Over three to four recursion levels, the agent’s final report is populated with poisoned premises that appear well‑supported.

What distinguishes FORGE from prior attacks is the deliberate coordination of the fabricated chain. By ensuring that each document references the next, the attacker leverages the agent’s own planning logic to propagate the malicious content without needing to flood the web with thousands of low‑quality pages.

Evaluation & Results

The authors evaluated FORGE on a benchmark of 25 open‑ended research queries spanning technology, health, and policy domains. Their experimental setup included a state‑of‑the‑art deep research agent built on GPT‑4‑Turbo, a retrieval backend powered by a dense vector store, and a synthetic web corpus where the fabricated documents were injected.

Key Findings

• Infection Rate: With just five injected documents per query, the agent’s reports exhibited a PRISM score of 26.4%, meaning more than a quarter of the claims were compromised.
• Depth Migration: Early rounds of the attack introduced overtly fabricated framing statements; later rounds shifted the poison into factual premises that are harder to detect.
• Defense Effectiveness: Applying Root Query Anchoring on a subset of 10 queries reduced the PRISM score from 38.5% (unprotected) to 18.3%, demonstrating that anchoring can halve the impact but does not eliminate it.
• Stealth Metrics: Standard plagiarism detectors and citation‑consistency checks flagged less than 5% of the poisoned claims, confirming the attack’s low visibility.

These results illustrate that a modest amount of crafted content can systematically corrupt the entire reasoning trajectory of a deep research agent, even when the agent employs conventional safety layers.

Why This Matters for AI Systems and Agents

Enterprises that rely on autonomous research agents for market analysis, regulatory compliance, or scientific literature reviews must now consider a new class of supply‑chain risk: information‑flow poisoning. The implications are threefold:

1. Trust Erosion – Decision‑makers may act on reports that appear well‑sourced but contain subtly manipulated premises, leading to costly strategic errors.
2. Compliance Exposure – In regulated industries, presenting inaccurate data as evidence can trigger legal penalties, especially when the source appears to be a legitimate web page.
3. Design Re‑evaluation – System architects need to revisit the assumption that retrieval is a benign preprocessing step. Instead, retrieval must be treated as an attack surface requiring continuous verification.

Practically, teams can mitigate risk by integrating provenance‑aware retrieval pipelines, employing cross‑checking against trusted knowledge bases, and adopting defenses like Root Query Anchoring. For organizations already using the UBOS platform overview, extending the workflow automation studio to embed query‑anchoring logic is a low‑friction way to harden existing agents.

What Comes Next

While FORGE demonstrates a potent attack vector, several open challenges remain:

• Scalable Detection – Developing automated tools that can flag coordinated chains of fabricated documents without incurring prohibitive compute costs.
• Robust Planning Layers – Designing planning algorithms that remain resilient even when a subset of retrieved evidence is malicious, perhaps by incorporating Bayesian trust models.
• Human‑in‑the‑Loop Verification – Creating UI patterns that surface provenance alerts to analysts without overwhelming them.
• Adversarial Training – Augmenting agent fine‑tuning datasets with synthetic hijacking scenarios to improve resistance.

Future research could also explore how FORGE‑style attacks interact with multimodal agents that ingest images, audio, or code. As agents become more capable, the attack surface will expand beyond text, demanding holistic security frameworks.

From a product perspective, the Enterprise AI platform by UBOS is positioned to incorporate these next‑generation safeguards, offering built‑in provenance tracking, chain‑of‑trust verification, and customizable anchoring policies for large‑scale deployments.

For readers who want to dive deeper into the technical details, the full pre‑print is available on FORGE paper.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.