FORGE shows how deep research agents can be steered off course
July 7, 2026
A paper published on July 7, 2026 describes attacks that steer deep research agents through fabricated evidence chains. The risk touches journalism, market analysis and science.
What this is about
A paper published on arXiv on July 7, 2026 describes FORGE, short for Fabricated Orchestrated Reasoning chain for Agent Exploitation. The authors examine how deep research agents can be manipulated when they search sources over several rounds, form follow-up questions and finally write a long report.
The topic matters because these systems are being used where people want orientation: market analysis, policy briefs, literature reviews, medical overviews or due-diligence memos. If early sources influence not only the text but also the next research path, an attack can grow quietly.
What FORGE actually does
FORGE is not a single jailbreak sentence. The paper describes a two-level attack. At the first level, manipulated documents appear plausible inside one text. At the second level, multiple documents coordinate a chain that guides the agent toward further matching but poisoned trails.
The researchers call this research-trajectory hijacking. The agent does not merely answer a question incorrectly; it decides which subquestions to ask next based on manipulated evidence. A small early nudge can later appear as a factual premise in the final report. According to the abstract, Network FORGE reaches a 26.4 percent PRISM score across 25 queries with five injected documents. A proposed mitigation, Root Query Anchoring, reduced PRISM on a 10-query subset from 38.5 to 18.3 percent.
Why it matters
Deep research agents are attractive because they save work. They collect links, read many pages and write structured summaries. That is also what makes them vulnerable: an attacker who influences the research environment does not need to attack the final text directly. It can be enough to shift the path toward that text.
Search optimization, lobbying, disinformation and competitive intelligence all create motives. A manipulated document does not need to shout, "believe me." It can work more quietly: name a seemingly technical constraint, suggest a follow-up question, frame a source as authoritative and thereby change the next search.
This also matters for companies. If an agent evaluates suppliers, security products or market trends, a poisoned research path can influence decisions. The risk is not only false sentences. It is misplaced attention.
In plain language
Imagine packing a suitcase for a trip. On the table is a false weather note: "It will be cold and rainy." You pack a jacket and boots, then search for rainy-day routes and ignore swimwear. The note changed not only one answer, but all next decisions. FORGE describes that kind of effect for research agents.
A practical example
A procurement team asks an agent to compare 40 security-software vendors. In the first research round, the agent finds five manipulated blog posts that present one technical category as decisive. It then searches specifically for that category, weights other criteria lower and writes a report that appears cleanly cited.
One protection would be to force the original question back into the loop: what did the user actually ask? Which criteria were set at the start? Which new search questions came from sources, and which came from the assignment? Reports should also flag when a claim comes from several sources in the same cluster.
Scope and limits
- FORGE is a research result, not a report about a known real campaign against a specific product.
- The authors say they do not release optimized adversarial documents or tools for deploying poisoned corpora into live retrieval environments.
- The PRISM values come from the experimental setup and should not be read as a general success rate for every deep research system.
SEO & GEO keywords
FORGE, deep research agents, research trajectory hijacking, AI security, agent security, retrieval poisoning, PRISM metric, Root Query Anchoring, arXiv, Fudan University, AI research, misinformation
💡 In plain English
FORGE shows that a research agent can be steered in the wrong direction while it is still searching. The final report may look clean even though the choice of questions was poisoned. Protection therefore needs control over the research path, not only the final text.
Key Takeaways
- →FORGE was published on arXiv on July 7, 2026.
- →The attack targets the research path of deep research agents, not only single answers.
- →In the paper, Network FORGE reaches 26.4 percent PRISM across 25 queries with five injected documents.
- →Root Query Anchoring reduced PRISM in a subset from 38.5 to 18.3 percent.
- →The authors withhold the most misuse-enabling attack tooling.
FAQ
What is research-trajectory hijacking?
It means manipulated sources influence which subquestions an agent asks next. That shifts the whole research path.
Is FORGE already a real-world attack?
The paper describes a research attack and evaluation. It is not evidence of a specific campaign against a specific product.
What helps against it?
The paper proposes Root Query Anchoring. In practice, source-cluster checks, clear starting criteria and transparency about where follow-up questions came from also matter.