One Fabrication Is Enough: A Fake News Article Changes the Forecasts of LLM Forecasting Systems

Summary

Researchers show that an attacker who knows only the forecasting question and publishes fabricated news articles can reverse 74% to 82% of opposing forecasts across every frontier model tested. Retrieval-augmented forecasting systems are most exposed, retrieving the fabricated article in about 90% of runs. Two published retrieval-time defenses, passage filtering and partitioned retrieval, each stop the one-article attack but are bypassed by a one-prompt change, and together they still fail against sixteen distorted copies while discarding 39% of genuine news.

Related items

• InfoMobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoIntent-Aware Protection for AI AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-126767: OpsTree REMS prompt injection exposes hidden system prompt via /api/v1/rca/chatSimilar attack · NVD/CVE Database
• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Similar attack · VicOne Blog
• InfoTop GenAI security resources — November 2026Similar attack · Adversa AI Blog