{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.26438",
  "title": "Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents",
  "summary": "The paper does not replace an existing method; it is an attack benchmark that supersedes informal red-teaming of news-consuming LLM agents, and it evaluates candidate defenses including hierarchical aggregation of evidence. Adopting its lessons costs added inference calls and latency (hierarchical aggregation and credibility-cue checking require extra model passes) plus engineering effort to validate and annotate untrusted feed items. Defenses can fail because attack success is state-dependent (91% ASR against an agent about to hold, 12% against one about to buy), generalizes across model vendors, and remains effective when fake items are blended unlabeled into real feeds, while surface credibility cues alone drive success regardless of claim content.",
  "rationale": "The reader should not deploy this as a feature, but any production LLM agent that consumes untrusted external text as evidence needs the validated defensive pattern (hierarchical aggregation) and the threat model this benchmark establishes.",
  "technique": "Information-injection benchmark and defenses for LLM trading agents",
  "family": "seguranca_e_guardrails",
  "recommendation": "observar",
  "published": "2026-10-19",
  "as_of": "2026-10-20",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.26438",
  "independent_implementations": 0,
  "total_implementations": 1,
  "stars": 0,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "The paper does not replace an existing method; it is an attack benchmark that supersedes informal red-teaming of news-consuming LLM agents, and it evaluates candidate defenses including hierarchical aggregation of evidence. Adopting its lessons costs added inference calls and latency (hierarchical aggregation and credibility-cue checking require extra model passes) plus engineering effort to validate and annotate untrusted feed items. Defenses can fail because attack success is state-dependent (91% ASR against an agent about to hold, 12% against one about to buy), generalizes across model vendors, and remains effective when fake items are blended unlabeled into real feeds, while surface credibility cues alone drive success regardless of claim content.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.26438",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "Fabricated news achieves 62% attack success rate (two 30-word templates reach 100% on all 15 stocks) versus 14% for prompt injection; model scaling, peer debate, and standard defenses mostly fail, with only hierarchical aggregation reducing ASR.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.26438",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}