Steering Agentic Decisions using Adversarial Safety Attacks

People increasingly delegate option-ranking tasks—shopping, job search, travel—to AI agents, which creates novel attack surfaces via malicious content. To defend against malicious content, people count on models’ safety training and platform policies. We show that current safety behavior can be exploited to steer agentic decisions, using only platform-compliant content. Our proposed attack takes a two-step approach: We inject a truthful negation about a fictitious concept (“Does not contain X”) into listing content, triggering an agent to search the web (“What is X?”), which surfaces information associating the fictitious concept with harmful implications (“X linked to ...”). Evaluating our attack across four real-world listing datasets, we find most frontier models are exposed using policy-compliant concepts and content, letting an adversarial vendor penalize competitors without naming anyone or stating a falsehood. We discuss the broader challenge of regulating advertising aimed at AI agents and provide actionable recommendations to platform providers