Authority-Chain Hijack beats search-agent cross-checking by poisoning one result per query across the whole trajectory

arXiv·high signalXBlueskyLinkedInCopy link

arXiv 2608.04565 (Aug 5) shows that a single injected page gets diluted because modern search agents issue follow-up queries and compare sources — so the attack instead appends one controlled result to every query, building a coherent fake evidence chain across seemingly corroborating sources. Authority-Chain Hijack reaches 55.9% ASR / 83.3% MaxN ASR on the full SafeSearch test split, and a companion method, Trace-Guided Strategy Evolution, automatically refines attacker strategies from execution traces to reach 71.4% / 95.0% in held-out evaluation. The finding kills a common assumption: multi-source corroboration is not a defense when the attacker controls the mediating search interface.