Data-Void Exploits in Web-Searching LLMs
A single attacker-controlled web page got cited in LLM search answers in 31% of tested conditions, across ChatGPT, Gemini and…
A peer-reviewed security paper (to appear at NDSS 2027) shows that web-searching LLMs can be manipulated via 'data-void exploits': attackers publish disinformation in topic areas where reliable content is sparse, and the LLM's web search retrieves and cites that single adversarial page. Testing ChatGPT, Gemini and Sonar Pro across varied prompt tones and attacker strategies, the researchers found attacker content appeared in responses 31% of the time overall, with user skepticism offering only limited protection.
Why it matters
This identifies a concrete, reproducible attack surface against the web-search features now embedded in mainstream LLM products, where users trust synthesized answers more than they would a raw link list, making the source of truth harder to audit. It matters to anyone building or relying on RAG-style web search in AI products, since the finding suggests disinformation can reach users through a channel increasingly treated as authoritative.
What is verified
Researchers demonstrate 'data-void exploits' where attackers publish narratives in search spaces lacking reliable content (data voids), and web-searching LLMs retrieve and cite that content. [1]
Across all tested conditions (varying prompt tone, LLM choice among ChatGPT, Gemini, Sonar Pro, and attacker controls), attacker-controlled content appeared in LLM responses 31% of the time. [1]
A single attacker-controlled page can succeed in getting cited by a web-searching LLM. [1]
Skeptical user prompt tone slightly reduced success and slightly increased flagging/warnings, but the study found no evidence of large effects from prompt tone or model choice on success rates. [1]
The paper is an extended version to appear at the NDSS Symposium 2027. [1]
What is not
- No details on which specific attacker strategies (of the five tested) were most effective, so no actionable mitigation ranking is available.
- No information on whether vendors (OpenAI, Google, Perplexity) have been notified or have responded.
- Unclear how 'data void' topics were selected and how representative they are of real-world adversarial search topics.
- No data on how this generalizes beyond the three tested models/products to other agentic or RAG-based search tools used in production.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 21 October 2026 at 21:28.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.