Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

What it is

"Fake News, Real Crashes" (Mengxiao Wang and Nitesh Saxena, Texas A&M, arXiv 2610.26438v1, 19 October 2026) is a benchmark of 62 templates for information injection. This attack plants fabricated news in a feed that an LLM trading agent reads as evidence. It differs from prompt injection, which targets the agent's instructions. The benchmark crosses five vectors (fact poisoning, sentiment narrative, selective evidence, structured signal, coordinated multi-source) with seven event categories. It was run on 15 U.S. stocks over about 10,000 decisions.

How it works

The attacker can only post text to a public channel the agent ingests, such as X, Reddit or a fake press-release wire. The attacker has no knowledge of the prompt or model. The reference victim is a single-call trend-following agent of 130 lines of Python on GPT-4o-mini, returning BUY/SELL/HOLD, a quantity, and take-profit and stop-loss prices. Attack success is a change from the agent's deterministic benign decision at temperature 0.

The paper reports these results:

• Vector comparison: Prompt injection reaches 14% attack success rate (ASR). Fabricated news reaches 62%, about 4.5 times higher.
• Surface cues: For fact-poisoning templates, removing a named source or a "BREAKING" tag drops ASR from 100% to 0% with the claim unchanged.
• Agent state: A fake indicator panel scores 91% against an agent about to hold and 12% against one about to buy. The paper uses this to define an attacker procedure (§5.7, not in the fetched text).
• Target choice: Stock choice moves ASR from 34% to 87%, more than vector choice does.
• Impact per injection: The agent deploys about $16K of its $20K buying power in the attacker's direction.

Preconditions / Affected

The setup targets agents that take unauthenticated news or social text into a trading decision. Robinhood's 2026 agentic beta, Interactive Brokers and Public.com are cited as deployments of this kind. The paper says many agents reading the same feed under similar policies could trade the same way at once, but the market-level analysis (§8) was not in the fetched text.

What to do

The page gives no patch or command. Its defense findings:

• Larger model: GPT-4o cuts the structural vectors to 0%, but fact poisoning still succeeds at 93%. GPT-5 is no better.
• Multi-agent design: A hierarchical (star) pipeline cuts ASR to 9%. Peer debate leaves it at 74%. In all three topologies tested, the fake narrative still appears in an intermediate agent's output, and the final trader agent's action is what blocks it where the attack fails.
• Defense criterion: The authors say a defense must score content conditional on the agent's posture and report ASR at a fixed false-positive rate. Content alone cannot separate a fake "CEO arrested" post from a real one. Only provenance or the agent's own market state can.

Caveats

• The reference agent is a single-call GPT-4o-mini design, chosen by the authors as the realistic retail setup. Results on slower multi-call agents are covered only by the topology and model-vendor tests.
• A safety-tuned model shows 0% ASR under an explicit adversarial marker but 46% once the same content is blended into the feed.
• The page text cuts off in the threat model section. The ablation details, defense protocols and the market-exposure analysis are known here only from the abstract and introduction.