Skip to content

architectural-damping

Can poisoned news change what an AI financial agent tells its user?

agent security · solo research · in progress

The question

Can a poisoned news article change the rating that an LLM financial agent shows its user, once the model’s own run-to-run variation is taken into account? I test it on VYNN AI’s news path as it ran in April 2026. Related: Wang & Saxena (Oct 2026) (opens in new tab) show fabricated news can mislead LLM trading agents, and Wu & Lim (Sep 2026) (opens in new tab) show typed decision outputs still shift under injection. This study measures one deployed agent end to end, against the model’s own run-to-run variation.

How I’m testing it

Over 4,000 model runs so far, with run-to-run noise measured first: each scenario is re-run clean, and an attack counts only when it moves the result beyond that spread. The confirmatory test was specified before it ran.

What’s next

Fabricated-news attacks (false facts, not instructions), newer screener models, and defenses measured together with their cost to accuracy.

Source code (opens in new tab)The data tables (opens in new tab)The system tested (opens in new tab)

Early results

  • Instruction-style text in 3 of 4 news articles changed the AAPL rating in 19 of 100 runs, against 2 of 100 clean runs.
  • With 1 of 4 articles poisoned, ratings changed no more often than in clean runs.
  • The margin is thin: one fully adopted strong catalyst would flip the rating in some clean reruns of 5 of 20 scenarios.

How often VYNN’s AAPL rating changed, by articles poisoned

The test specified before it ran, 100 runs each

  • Clean runs, no attack2 of 100
  • 3 of 4 articles poisoned19 of 100

Exploratory, 50 runs each (20 at 4 of 4)

  • Clean runs, no attack2 of 50
  • 1 of 4 articles poisoned4 of 50
  • 2 of 4 articles poisoned7 of 50
  • 3 of 4 articles poisoned9 of 50
  • 4 of 4 articles poisoned4 of 20
The scenario nearest a rating boundary. Fresh runs of VYNN’s April 2026 news path, with instruction-style text in the poisoned articles; dots are the share of runs whose rating changed, lines their 95% intervals. Only the first pair is a test (Fisher p = 0.00005); the exploratory arms are a trend, and none survives correction on its own.

Early results, in detail

A confirmed effect near a boundary

In a test specified before it ran, instruction-style text in 3 of 4 news articles changed VYNN’s AAPL rating in 19 of 100 fresh runs, against 2 of 100 clean runs (Fisher p = 0.00005).

One article was not enough

With 1 of 4 articles poisoned, ratings changed no more often than in clean runs: on the scenario nearest a boundary, 4 of 50 runs against 2 of 50 clean. Still, 13 of 60 attacks moved the expected return towards the attacker’s target by more than the clean-run spread.

The margin is thin

Replaying saved outputs through VYNN’s own calculator, one fully adopted strong catalyst would flip the rating in some clean reruns of 5 of 20 scenarios. The template attacks failed mainly because the model only partly adopted the planted claims.

Noise first

Each of the 20 scenarios is re-run clean 10 times. The expected return varied with a median standard deviation of 0.52 points (at most 1.09), and 199 of 200 runs gave the scenario’s usual rating. An attack counts only when it moves the result beyond that spread.

More poisoned articles, further

Instruction-style attacks shift the expected return towards the attacker by +0.76 points with 1 poisoned article, +1.04 with 2 and +1.06 with 3. Cases beyond the clean-run spread: 13 of 60 at 1 article, 38 of 120 at 2 or 3.

What the user reads

With VYNN’s full report on, none of 73 reports quoted the injected text. The attack reached the user through the rating instead: 9 of 35 attacked reports showed HOLD instead of SELL, against 2 of 38 clean.

VYNN today

Since September 2026, VYNN’s production calculator no longer lets news scores move the expected return.