Fake-news inputs steer LLM trading agents far more than prompt injection, Texas A&M finds

Fake news-style inputs were far more effective than classic prompt injection at steering large language model-powered trading agents in simulated tests, according to a new Texas A&M University research preprint. In the authors’ benchmark, short fabricated news items pushed agents into attacker-chosen trades much more reliably than attempts to tamper with the models’ instructions, including two 30-word templates that flipped decisions across every stock tested.

The paper, “Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents,” was posted to arXiv on Oct. 19, 2026, as arXiv:2610.26438v1 by Mengxiao Wang and Nitesh Saxena of Texas A&M University. It is a research preprint, not a peer-reviewed journal paper, and its results come from controlled experiments and simulations rather than live-market tests.

The researchers said they built a benchmark covering five injection vectors and seven event categories, evaluating about 10,000 trading decisions on 15 U.S. stocks. Their central comparison was between prompt injection — attacks that try to alter a model’s instructions — and what they call information injection, which feeds the agent false market “evidence” such as fabricated news. Across the benchmark, the paper reports a mean attack success rate of about 14% for prompt injection versus about 62% for fabricated news and other information-injection attacks.

The most striking result was narrower than the headline may suggest. The paper says two 30-word fabricated-news templates reached a 100% attack success rate across all 15 stocks tested. In the context of the benchmark, that means those templates flipped the agent’s trading decision on every stock the researchers tried, not that they would work universally in real markets or against every deployed system.

The distinction matters because the attack is aimed less at the model’s guardrails than at the material it is supposed to analyze. “Unlike prompt injection, which targets the model’s instructions, information injection targets the evidence the agent trusts,” the abstract says. In some fact-poisoning tests, the paper reports, surface credibility cues mattered more than the underlying false claim itself: removing a named source or a “BREAKING” label dropped attack success from 100% to 0%, even though the false claim text remained unchanged.

The agent’s own starting position also changed how vulnerable it was. The paper says a fake indicator panel achieved a 91% attack success rate against an agent that was about to hold a stock, but only 12% against an agent that was already leaning toward a buy. The authors also report that the attacks generalized across multiple model vendors and still worked when fake items were blended into real news feeds without labels.

The defense results were mixed. According to the paper, larger or more capable models reduced the effectiveness of some weaker attack types, but fact-poisoning remained effective. A peer-debate setup, in which models challenge one another’s reasoning, still left attack success high at about 74%. A hierarchical or star-aggregation setup, which combines outputs through a more structured multi-agent scheme, reduced attack success to about 9%.

In the simulated environment, each successful injection caused the trading agent to deploy about $16,000, roughly 80% of its $20,000 buying power, in the attacker’s chosen direction, the paper says. That does not show real market manipulation, but it illustrates why correlated behavior could matter if many agents act on the same bad input. As the introduction puts it, “Because thousands of agents consume the same feed under near-identical policies, one post can change many portfolios at once.”

There is a real-world precedent for false information jolting markets, even if this paper did not test live trading. In April 2013, a hacked Associated Press account on X, then Twitter, falsely reported explosions at the White House, and major U.S. indexes briefly fell before recovering. The backdrop today is that agentic trading tools are no longer hypothetical: retail brokerages including Robinhood and Public rolled out or announced AI and agent features in 2025 and 2026, while U.S. regulators and lawmakers have started scrutinizing how autonomous trading systems should be supervised.

Still, the paper leaves a key question unanswered. It does not establish how many deployed agents, or how much coordinated capital, would be needed to move real markets. The authors identify that threshold as future work, making the study best read as evidence of a specific security weakness in simulated LLM trading agents — not proof of real-world crashes or manipulation.