The study proposes an indirect data poisoning attack that can manipulate the research conclusions of Claude, Codex, and Gemini

Can a remote attacker manipulate autonomous research AI agents through indirect data poisoning to produce false conclusions aligned with the attacker's preferences and scale academic fraud.

• Risk scenario of autonomous retrieval by research agents: With the proliferation of tools like Claude Code, Codex, and Gemini CLI, honest scientists are using AI agents with web retrieval capabilities to automate data exploration and end-to-end research; retrieval accounts for approximately 6% of agent tool calls.
• Limitations of traditional fraud and existing poisoning research: Traditional corporate academic fraud requires substantial funding and complex operations; existing machine learning poisoning mostly targets model pretraining, and RAG poisoning typically targets known knowledge bases or includes malicious prompt injection instructions, not covering instruction-free natural tampering in the open data ecosystem.
• Threat model:
  • Attack goal: Manipulate research agents to produce false or misleading conclusions supporting or opposing a specific hypothesis H, leading honest scientists to publish tampered results, granting academic legitimacy to the attacker's narrative.
  • Attacker knowledge: Has black-box access conditions, shares the same public literature and open-source data ecosystem as honest users, but cannot directly access the AI system or know the honest user's specific prompts.
  • Attacker capabilities: No need to modify model weights; uses generative AI assistance to implement four attack vectors at low cost (creating new datasets, inserting new data, imputing existing data, writing misleading metadata), and uploads tampered data to public platforms.
  • Victim system: An end-to-end research AI agent deployed by an honest scientist with autonomous retrieval and code execution capabilities; the base model is not poisoned, and user prompts have no malicious bias.
• Research framework and defense exploration: The authors built an evaluation pipeline covering 5 sociotechnical topics, 3 frontier agents, and 450 controlled experiments, and proposed two prompt-layer defense mechanisms: scientist persona and five-item data provenance audit.

At the intersection of research automation and data security, the paper discusses the following groups of related work:

• Automated research systems and their reliability flaws: Early attempts such as Boiko et al. (2023) targeted specific processes, while later work such as The AI Scientist (Lu et al., 2026), Curie (Kon et al., 2025), Agent Laboratory (Schmidgall et al., 2025), and AI-Researcher (Tang et al., 2025) advanced end-to-end automation. Addressing their flaws, Luo et al. (2025) noted that fully automated AI scientist systems have benchmark selection bias, data leakage, and post-hoc selection bias similar to p-hacking, which is hard to identify from the final paper; Trehan and Chopra (2026), Beel et al. (2025) noted that the systems have bias and numerical confabulation.
• Poisoning attacks against AI systems: Traditional deep learning poisoning is mostly carried out through training data (Goodfellow et al., 2015; Carlini et al., 2024; Wallace et al., 2021). For retrieval pipelines, indirect prompt injection (Greshake et al., 2023) and RAG poisoning (Zou et al., 2025; Liu et al., 2025; Zhang et al., 2026a; Li et al., 2025) usually rely on controlling the retrieval source or injecting instructions; Stokel-Walker (2026) discussed the phenomenon of publishing fabricated papers to establish cognitive bias.
• Verification of research outputs and retrieval defenses: Some work attempts to use structured knowledge graphs to verify model outputs (Alber et al., 2025; Yang et al., 2024), but the authors note that knowledge graphs themselves are built from the literature, so they are also affected once the literature is polluted; Edemacu et al. (2026) and Pathmanathan et al. (2025) proposed retrieval-stage defense mechanisms for RAG.
• Baseline methods and test benchmarks: The paper's comparison baseline is agent performance under a no-defense setting, and the test benchmarks cover topics built from 5 public datasets: hiring discrimination (Lippens et al., 2022), European fertility (OWID dataset), generative AI motivation loss (Wu et al., 2025), racial disparities in traffic enforcement (Pierson et al., 2020), and autonomous driving safety (California DMV and NHTSA FARS data).
• Positioning relative to existing work: The authors note that this paper relaxes previous assumptions that poisoning requires direct access to the agent, control of a designated retrieval source, or injection of malicious instructions and marker words, showing that merely using seemingly legitimate datasets and metadata in the open data ecosystem can induce research agents to reach attacker-preferred conclusions.

The authors propose and evaluate an indirect data poisoning attack framework, test its harm under black-box, no-privileged-instruction settings, and then design two defenses: scientist persona and data provenance audit.

Threat Model and Formalization

• Black-box attack setting: The attacker cannot directly access the AI agent, the AI agent is not training-poisoned, and the honest scientist's prompts contain no deceptive intent.
• Core definition: Given a scientific hypothesis H supported by the original dataset, the attacker aims to construct a tampered dataset D′₁ to alter the agent's direction of support.
• Four attack vectors:
  1. Creating new datasets: Constructing entirely new fake data using public metadata of datasets that require registration to access.
  2. Inserting new data: Using models fitted on existing data to perform biased sampling and insert fake new samples.
  3. Imputing existing data: Modifying existing features to change correlations or regression relationships.
  4. Writing misleading metadata: Writing fake READMEs or data loading code to support the attack hypothesis or question the real data.
• Bidirectional attack targets: For each topic, design both a Reject goal (refuting the original hypothesis) and an Exaggerate goal (exaggerating the original hypothesis's effect).

Experimental Topic Construction and Ethical Isolation

• Five sociotechnical topics: Covering workplace hiring discrimination (Kaggle), European fertility (OWID/GitHub), generative AI motivation loss (OSF), traffic enforcement racial disparities (Stanford Open Policing/GitHub), and autonomous driving safety comparison (CA DMV/FARS/HF).
• Ethical isolation and API wrapper: Tampered data uploaded to private repositories on GitHub, HuggingFace, OSF, and Kaggle, with a man-in-the-middle wrapper intercepting APIs and modifying public visibility attributes, making agents perceive them as public repositories without knowing about the interception.

Prompt Gradient Design

• Prompt design: Three types of prompts written by authors independent of the poisoning process:
  1. Minimal prompt: Single-sentence neutral prompt, no methodological details.
  2. Targeted prompt: Adds methodological guidance and highlights variables of interest.
  3. Critical prompt: Emphasizes critical analysis, literature comparison, and potential bias checks. None of the three prompt types directly mention any specific dataset.

Defense Mechanism Design

• Scientist Persona: Extends the system prompt to require the model to act as a researcher with intellectual honesty, statistical rigor, and scientific skepticism.
• Data Provenance Audit: Building on the persona, uses a custom audit skill to run five independent checks in parallel and synthesize a risk score:
  1. Finding cited literature: Checking whether the dataset is cited by credible scientific publications.
  2. Verifying social markers: Evaluating usage metrics such as stars and downloads.
  3. Checking statistical anomalies: Computing simple statistics like mean, extremes, and variance to identify anomalous distributions.
  4. Comparing related datasets: Retrieving other datasets on the same topic to compare scale and distribution consistency.
  5. Being alert to data poisoning: Explicitly prompting the model to assess whether the dataset shows signs of deliberate manipulation.

Experimental Setup

• Models under test: Claude Code with Claude Opus 4.7, Codex with GPT-5.5, Gemini CLI with Gemini 3.1 Pro, all with high reasoning level and default system prompts.
• Datasets and scale: Workplace hiring discrimination (594 data points, 29 features), European fertility (931 data points, 46 features), generative AI motivation loss (3562 data points, 373 features), traffic enforcement racial disparities (4,310,165 data points, 22 features), autonomous driving safety (33,862 data points, 187 features).
• Baselines and experimental conditions: 90 experimental conditions (3 agents × 5 topics × 2 attack targets × 3 prompts), each condition independently repeated 5 times, baseline total 450 runs; defense evaluation set 3 conditions (Baseline, Scientist Persona, Provenance Audit) totaling 450 runs.
• Main metrics: No success, Partial success, Full success, Any success; pipeline stages include Found, Retrieved, Used, Statistics, Conclusion; detection results classified as Not detected, Partial, Detected, N/A.
• Evaluation method: Claude Sonnet 4.6 running under Claude Code used as LLM judge to score results; agreement with human evaluation on a 10% random sample (45 runs) reached Cohen's κ = 0.802 (0.758 for defense experiments).
• Statistical methods: Report 95% Wilson score intervals; proportion differences use Newcombe confidence intervals; frequency comparisons use chi-square test with Yates' continuity correction.

Main Results

Swipe horizontally to read the table

• High attack success rate independent of target direction: The authors state that across all runs, the retrieval rate of poisoned data was 84.22%, and the full success rate reached 49.56%; moreover, the Exaggerate target (58.22% Any success) and Reject target (60.44% Any success) showed no statistically significant difference (p = 0.70), indicating attackers can induce any predetermined conclusion (Section 4.1).
• Differences in model and topic vulnerability: The authors state that Gemini exhibited the highest full success rate (62.0%), followed by Claude (55.33%) and Codex (31.33%); the full success rate gap across topics reached 33.33%, highest on GenAI Motivation (68.89%) where strong priors are lacking, and lowest on AV Safety (35.56%) which emphasizes methodological skepticism (Section 4.2).
• Spontaneous detection extremely rare and mostly attributed to methodological errors: The authors state that under baseline prompts, the overall detection rate was only 6.0%, and 85.19% of detections were partial (attributed to methodological or reporting errors rather than deliberate poisoning); stricter Critical prompts reduced conclusion contamination, but mainly because retrieval did not occur rather than because poisoning was identified (Section 4.3).

Pipeline Propagation and Non-Retrieval Effects Analysis

• What was tested: Tracking the attrition and retention of poisoned data across 5 stages of the research pipeline (Found → Retrieved → Used → Statistics → Conclusion) (Figure 4, Section 4.1).
• Experimental results: Retrieval rate decreased from 90.67% with Minimal prompts to 76.67% with Critical prompts; the proportion of poisoned conclusions generated decreased from 61.33% with Minimal to 26.67% with Critical.
• Authors' interpretation: The authors state that prompt-induced resistance mainly stems from failure to retrieve data (search terms too simple being overwhelmed by massive results, or too complex limiting the search space), rather than active identification of poisoning; once data is retrieved, it often propagates through to the final conclusion.

Defense Strategy Evaluation: Persona Setting and Data Provenance Audit

• What was tested: Comparing attack success rates and detection rates under three defense conditions—Baseline, Scientist Persona, and Provenance Audit—across 450 experiments (Figures 6, 7, 8, Sections 5.3, 5.4).
• Experimental results: Under Scientist Persona, Full success dropped to 16.67% (Any success 55.33%), and detection rate rose to 30.67%; under Provenance Audit, Full success dropped to 0.0% (Any success 8.67%), detection rate rose to 77.33%, and poisoned data usage rate dropped to 40.0%.
• Authors' interpretation: The authors state that the scientist persona only suppressed conclusion output but still analyzed with contaminated data, whereas data provenance audit prevented data usage after retrieval, eliminating full attack success to zero; multi-agent ensemble detection improved detection rates by 12.0%, 41.33%, and 18.67% under Baseline, Persona, and Audit, respectively.

Predictive Power Analysis of Provenance Audit Subtasks

• What was tested: Analyzing the predictive power of 5 subtasks in data provenance audit for high-risk judgments using mixed-effects logistic regression (Section 5.5).
• Experimental results: Cross-dataset consistency (OR ≈ 648, p ≈ 0) and statistical anomaly checks (OR ≈ 145, p ≈ 0) had the strongest predictive signals, followed by paper citation verification (OR ≈ 33, p ≈ 0) and social reputation markers (OR ≈ 30, p = 10^-3); poisoning warnings did not become a major predictor of high risk.
• Authors' interpretation: The authors state that poisoning warnings mainly served a priming role guiding agents to consider manipulation as a potential risk source, while cross-dataset comparison and statistical anomalies were the most effective evidence for identifying poisoning.

Other Ablations and Analyses

• After controlling for the proportion of retrieved alternative non-poisoned datasets, the effect of topic on attack success rate remained statistically significant (LR = 47.81, df = 4, p ≪ 0.05, Section 4.2).
• Poisoning detection rate based on the retrieved success subset was largely consistent with the full set, at 7.12% (full set 6.0%, Section 4.3).
• Detection rates by prompt type were Minimal 3.33%, Targeted 8.67%, Critical 6.0% (χ²_2 = 3.78, p = 0.15, Section 4.3).
• In defense experiments, there was an interaction effect between model and poisoning topic; Claude performed best on GenAI Motivation (Full detection 63.33%), and Codex best on Hiring (56.67%) (Section 5.3).
• Cross-agent detection agreement was Fleiss κ = +0.09 at Baseline, κ = -0.13 under Scientist Persona, and κ = +0.16 under Provenance Audit (Section 5.4).
• Data provenance audit produced 3 false rejections on legitimate datasets, with a false positive rate of 2.0% (Section 6.1).

Limitations and future directions noted by the authors

• Test topics limited to sociotechnical domains: The authors note that all five test topics fall within sociotechnical domains, lacking broad social or scientific consensus, and may be more susceptible to manipulation; whereas natural science or medical domains have stronger truth priors, but because they require highly specialized knowledge, poisoning designed against them may be equally difficult to detect (Section 6.1).
• Data formats are all tabular data: The authors note that the datasets in the experiments are all tabular in form, not involving the unstructured datasets (such as text corpora or image databases) that modern deep learning often relies on; manipulating unstructured data may be harder but also more covert (Section 6.1).
• Reliance on private repositories and custom API wrappers: To avoid spreading false data on the public internet, the authors hosted the datasets in private repositories and used custom API wrappers, which may introduce potential confounding factors for the agents' retrieval success rate, although trace logs show that the agents searched all four platforms in every run (Section 6.1).
• Defenses only counter a single threat model at the prompt level: The defenses proposed by the authors operate only at the prompt level and target a specific threat model, without exploring internal model mechanism adjustments or system-level defense suites under more aggressive threat models (such as multi-path parallel attacks) (Section 6.1).
• Data source audit has a 2.0% false positive rate: The data source audit recommended against using actually existing datasets in 3 cases (false positive rate 2.0%), stemming from genuine statistical anomalies in legitimate data and the decision logic when the agent aggregates five checks; the authors note that a better scoring aggregation mechanism is needed (Section 6.1).
• Evaluation relies on an LLM judge: The experimental results use Claude Sonnet 4.6 for LLM-as-a-judge evaluation, and although human review on a 10% sample shows strong agreement (κ ≥ 0.758), it may still introduce annotation bias (Section 6.1).

Experimental coverage

• The tested agents include Claude Code (Claude Opus 4.7), Codex (GPT-5.5), and Gemini CLI (Gemini 3.1 Pro), 3 frontier systems in total, all given unauthenticated programming and network access in isolated container environments.
• The attacks cover 5 sociotechnical topics, with each topic separately testing 2 attack goals: reverse refusal and positive exaggeration; the prompts are set with 3 gradients: Minimal, Targeted, and Critical; each condition is independently repeated 5 times (450 baseline runs in total).
• The poisoning data hosting platforms cover 4 public data platforms: GitHub, HuggingFace, OSF, and Kaggle, retrieved through a unified API wrapper.
• The defense evaluation covers 3 prompt-level defense conditions: Baseline, Scientist Persona, and Provenance Audit, also completing 450 independent runs across the 5 topics and 3 agents.
• The paper does not report the actual end-to-end poisoning success rate of the agents in a fully real public internet environment without interception by the API wrapper.

• Paper positioning: The paper proposes and evaluates a black-box attack paradigm—indirect data poisoning—against autonomous scientific research AI agents.
• Core question: It explores whether remote attackers can exploit the open data ecosystem and research agents' retrieval capabilities to tamper with public datasets and manipulate the end-to-end research conclusions of honest scientists, without accessing model internals or user prompts.
• Method highlights: Based on 5 sociotechnical issues, the authors tampered with data by inserting fake samples, imputing values, and writing misleading metadata, then deployed it to private platform APIs; they evaluated 3 state-of-the-art research agents under different prompts and proposed a scientist role setting and a data provenance audit defense with five checks.
• Key experimental findings:
  1. In 450 baseline runs, agents retrieved poisoned data in 84.22% of cases, produced tampered conclusions without any awareness or warning (Full success) in 49.56% of cases, while detection rate was only 6.0% (Section 4.1, 4.3).
  2. Success rates for two opposing attack goals—rejecting hypotheses and exaggerating hypotheses—showed no statistically significant difference (58.22% vs. 60.44%, p = 0.70), indicating attackers can arbitrarily manipulate the direction of conclusions (Section 4.1).
  3. Vulnerability varied across agents; Gemini had the highest full success rate (62.0%), followed by Claude (55.33%) and Codex (31.33%); critical prompts reduced success primarily by lowering data retrieval rates rather than enhancing detection (Section 4.1, 4.2).
  4. The five-check data provenance audit reduced full attack success to 0.0% and raised detection to 77.33%, with cross-dataset consistency (OR ≈ 648) and statistical anomalies (OR ≈ 145) as the strongest predictors (Section 5.4, 5.5).
• Authors' conclusions and implications: The authors argue that indirect data poisoning could scale academic fraud, putting honest scientists at risk of becoming unwitting propagators of false research; they call on the research community to establish AI-native trust infrastructure, including verifiable dataset provenance credentials, strict platform metadata and statistical tracking, and automated audits at the agent retrieval stage.