Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

Summary

This research introduces a benchmark for information injection attacks against LLM trading agents, which act on news as evidence and cannot reliably separate fabricated headlines from real ones. Across about 10,000 decisions on 15 U.S. stocks, fabricated news reached a 62% attack success rate, while two 30-word templates reached 100% on all 15 stocks. Removing credibility cues such as a named source or a "BREAKING" tag dropped success from 100% to 0% for the same fake claim. The authors report that most attacks evade standard defenses, and that only hierarchical aggregation reduced attack success rate.

Mitigation

Only hierarchical aggregation reduced ASR; model scaling, peer debate and other standard defenses did not stop fact poisoning.

Related items

• HighCVE-2026-77926: Aix-DB remote code execution through ChatBI common agent execute toolSimilar attack · NVD/CVE Database
• CriticalCVE-2026-75128: Langchain-Chatchat unauthenticated shell command executionSimilar attack · NVD/CVE Database
• HighCVE-2026-109443: JoySafeter remote code execution via unsandboxed execute tool in CopilotSimilar attack · NVD/CVE Database
• HighCVE-2026-109440: LangAlpha indirect prompt injection through agent-retrieved web contentSimilar attack · NVD/CVE Database
• HighCVE-2026-107366: IBM Langflow OSS message endpoints lack ownership verificationSimilar attack · NVD/CVE Database