Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Fabricated news fooled LLM trading agents into bad trades 100% of the time, far more reliably than classic prompt injection.
Researchers built a benchmark testing LLM financial trading agents against fabricated news and data rather than instruction-based prompt injection, running roughly 10,000 decisions across 15 U.S. stocks. They found fabricated news and fake indicator panels were dramatically more effective than classic prompt injection at manipulating agent trades, and that surface-level credibility cues like a named source or "BREAKING" label mattered more than the content of the fake claim itself.
Why it matters
This reframes LLM agent security: the biggest risk isn't attackers hijacking an agent's instructions, but feeding it plausible-looking but false evidence it is designed to trust and act on. As agents are deployed to read external data feeds and take consequential autonomous actions (trading, purchasing, reporting), this "information injection" surface is shown to be far easier to exploit than prompt injection and largely evades current defenses except for one aggregation approach.
What is verified
The benchmark evaluates information injection attacks against LLM trading agents across five injection vectors and seven event categories, over roughly 10,000 decisions on 15 U.S. stocks. [1]
Prompt injection achieved a 14% attack success rate, while fabricated news achieved 62%, and two 30-word templates reached 100% success across all 15 stocks. [1]
Removing credibility cues such as a named source or a 'BREAKING' tag from fact-poisoning templates dropped attack success rate from 100% to 0% while the fake claim content remained identical. [1]
A fake indicator panel scored 91% success against an agent about to hold but only 12% against one about to buy, showing success depends on agent state. [1]
The attacks generalize across model vendors and remain effective when blended unlabeled into real news feeds, and most evade standard defenses; model scaling stops shallow vectors but not fact poisoning, peer debate fails, and only hierarchical aggregation reduces attack success rate. [1]
What is not
- No independent replication or third-party verification of the benchmark results beyond the authors' own paper.
- Unclear which specific LLMs/vendors were tested or how 'hierarchical aggregation' defense is implemented and how practical it is to deploy.
- No information on whether any real-world trading systems have been affected or whether this is purely a research simulation.
- Paper is a preprint (arXiv submission), not yet peer-reviewed.
Sources
- 1arXiv cs.SEarxiv.org · Primary source
Original source published 19 October 2026 at 15:58.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.