Preprint: Fabricated News Achieves 62% Attack Success Rate Against AI Trading Agents, Far Exceeding Prompt Injection's 14%
New research indicates that for LLM trading agents, fake news poses a greater threat than traditional prompt injection, with surface-level credibility cues being key attack vectors.
ImportanceMaterialEvidenceE2 unreplicatedWrite-upQuick
Researchers Mengxiao Wang and Nitesh Saxena published a preprint on arXiv on October 19, 2026, titled "Fake News, Real Crashes," introducing a systematic benchmark for "information injection" attacks against Large Language Model (LLM) financial trading agents. Unlike prompt injection, which aims to manipulate the model's instructions, information injection directly targets the external evidence, such as news feeds, that the agent trusts.
The study evaluated approximately 10,000 decisions across 15 U.S. stocks. Results showed that while traditional prompt injection achieved a 14% Attack Success Rate (ASR), fabricated news reached 62%. More surprisingly, two simple 30-word templates achieved a 100% success rate across all tested stocks.
The authors found that for fact-poisoning templates, surface form matters more than content: removing credibility cues like "BREAKING" tags or named sources dropped the ASR from 100% to 0%, even though the false claim itself remained unchanged. Additionally, attack effectiveness depended on the agent's state; for instance, a fake indicator panel scored 91% against an agent about to hold but only 12% against one about to buy.