How the Hoax Was Constructed

The r/poisonai campaign built three layers of false evidence designed to look like a legitimate news event:

• Dozens of fabricated Reddit mourning posts across multiple threads, creating the appearance of widespread discussion and grief .
• Fake Trump Truth Social screenshots, designed to look like official posts from the President's account .
• WKNA News, a "pink slime" site masquerading as a legitimate local West Virginia broadcaster . The site published multiple fabricated articles dated June 9–22, 2026, with headlines such as "Rabies awareness emphasized following death of JD Vance" and "Questions surrounding death of J.D. Vance and White House illness" . The AI cited these pages as credible sources .

Which AI Systems Were Duped

DuckDuckGo's AI Search Assist feature (Duck.ai) confidently told users that Trump died of rabies on June 7, 2026, and that Vance predeceased him . It produced a full, confident answer box citing the fake WKNA News articles alongside an unrelated real ABC News article about an Ohio rabies victim as "evidence" . Brave's AI search also fell for the same hoax, regurgitating the fabricated narrative .

Both AI systems ingested the planted content from Reddit and the fake news site, then surfaced it as truth because the narrative appeared corroborated across multiple indexed sources .

Why It Worked: The Cornell Tech WARP Attack

A preprint from Cornell Tech researchers (Tingwei Zhang, Harold Trieu, and colleagues), posted to arXiv in May 2026, directly explains the vulnerability exploited by r/poisonai . The paper — titled "Deep-Research Agents Can Be Poisoned via User-Generated Content" — introduced an attack called WARP (Web Agent Retrieval Poisoning) .

Key findings from the study include:

• A single ~13-word poisoned passage planted in a user-generated content page (Reddit, Wikipedia, Quora) is enough to steer a deep-research AI agent toward attacker-chosen content .
• Fictional products appeared in 38–62% of AI-generated responses when the poisoned text was spread across multiple threads . In one test, a 15-word sentence promoting a fabricated cryptocurrency called "BananaCoin" inserted into a single Reddit thread caused AI agents to recommend it as real, citing the manipulated post itself as the source .
• Deep-research agents pull 17–23% of all web pages from user-generated content sites, creating a concentrated attack surface . An adversary who poisons a single frequently retrieved UGC page can affect many related queries .

The Direct Connection

The r/poisonai campaign is a real-world demonstration of the exact vulnerability the Cornell Tech paper describes. The subreddit weaponized the same mechanism — AI search agents that broadly ingest and trust user-generated content without distinguishing it from authoritative sources . Because AI research agents scrape Reddit, low-credibility sites, and forums as sources in roughly half of all queries, a coordinated seeding campaign across multiple threads created the appearance of consensus, which the AI treated as corroboration .

The incident proves that the Cornell Tech finding is not a lab artifact: the same 13-word poisoning technique, scaled up with multiple threads and a pink slime site, successfully compromised production AI systems used by millions of people .

The Persistent Problem

The hoax succeeded because AI search tools cannot reliably distinguish between genuine user discussion and coordinated disinformation campaigns, especially when false content is cross-posted across multiple seemingly independent sources . The WKNA News site still hosts the fabricated articles, demonstrating how persistent this poisoned content is in the indexed web . Both DuckDuckGo and Brave have acknowledged the incident, but the underlying vulnerability — AI agents that treat UGC as authoritative — remains unpatched at the architectural level .

How the Hoax Was Constructed

The r/poisonai campaign built three layers of false evidence designed to look like a legitimate news event:

• Dozens of fabricated Reddit mourning posts across multiple threads, creating the appearance of widespread discussion and grief .
• Fake Trump Truth Social screenshots, designed to look like official posts from the President's account .
• WKNA News, a "pink slime" site masquerading as a legitimate local West Virginia broadcaster . The site published multiple fabricated articles dated June 9–22, 2026, with headlines such as "Rabies awareness emphasized following death of JD Vance" and "Questions surrounding death of J.D. Vance and White House illness" . The AI cited these pages as credible sources .

Which AI Systems Were Duped

DuckDuckGo's AI Search Assist feature (Duck.ai) confidently told users that Trump died of rabies on June 7, 2026, and that Vance predeceased him . It produced a full, confident answer box citing the fake WKNA News articles alongside an unrelated real ABC News article about an Ohio rabies victim as "evidence" . Brave's AI search also fell for the same hoax, regurgitating the fabricated narrative .

Both AI systems ingested the planted content from Reddit and the fake news site, then surfaced it as truth because the narrative appeared corroborated across multiple indexed sources .

Why It Worked: The Cornell Tech WARP Attack

A preprint from Cornell Tech researchers (Tingwei Zhang, Harold Trieu, and colleagues), posted to arXiv in May 2026, directly explains the vulnerability exploited by r/poisonai . The paper — titled "Deep-Research Agents Can Be Poisoned via User-Generated Content" — introduced an attack called WARP (Web Agent Retrieval Poisoning) .

Key findings from the study include:

• A single ~13-word poisoned passage planted in a user-generated content page (Reddit, Wikipedia, Quora) is enough to steer a deep-research AI agent toward attacker-chosen content .
• Fictional products appeared in 38–62% of AI-generated responses when the poisoned text was spread across multiple threads . In one test, a 15-word sentence promoting a fabricated cryptocurrency called "BananaCoin" inserted into a single Reddit thread caused AI agents to recommend it as real, citing the manipulated post itself as the source .
• Deep-research agents pull 17–23% of all web pages from user-generated content sites, creating a concentrated attack surface . An adversary who poisons a single frequently retrieved UGC page can affect many related queries .

The Direct Connection

The r/poisonai campaign is a real-world demonstration of the exact vulnerability the Cornell Tech paper describes. The subreddit weaponized the same mechanism — AI search agents that broadly ingest and trust user-generated content without distinguishing it from authoritative sources . Because AI research agents scrape Reddit, low-credibility sites, and forums as sources in roughly half of all queries, a coordinated seeding campaign across multiple threads created the appearance of consensus, which the AI treated as corroboration .

The incident proves that the Cornell Tech finding is not a lab artifact: the same 13-word poisoning technique, scaled up with multiple threads and a pink slime site, successfully compromised production AI systems used by millions of people .

The Persistent Problem

The hoax succeeded because AI search tools cannot reliably distinguish between genuine user discussion and coordinated disinformation campaigns, especially when false content is cross-posted across multiple seemingly independent sources . The WKNA News site still hosts the fabricated articles, demonstrating how persistent this poisoned content is in the indexed web . Both DuckDuckGo and Brave have acknowledged the incident, but the underlying vulnerability — AI agents that treat UGC as authoritative — remains unpatched at the architectural level .