Study Finds Frontier LLM Agents Highly Susceptible to Malicious Influence in Agentic Tasks

Autonomous agent adoption hinges on execution reliability, but technical proficiency operates completely separately from an agent's ability to identify and reject adversarial manipulation.

• Vigilance deficiencies identified: Researchers Sasha Robinson, Katherine M. Collins, Ilia Sucholutsky, and Kelsey R. Allen evaluated frontier large language models across three realistic open-domain tasks—web navigation, e-commerce transactions, and code repository patching—and discovered universal susceptibility to malicious advice.
• Competence dissociates from discernment: The study demonstrated that an agent's standard task capability does not correlate with its vigilance, meaning stronger baseline models remain equally vulnerable to deception and harmful steering.
• Bayesian defense proposed: The authors developed a specialized Bayesian vigilance harness that models advisor value estimates, successfully restoring baseline task performance while preserving the operational benefits gained from benign guidance.

• The multi-turn exposure window: As autonomous systems transition from isolated prompt-response setups to long-horizon agentic workflows, they repeatedly interact with external environments such as web browsers, public databases, and third-party code bases where untrusted data resides.
• The psychological baseline gap: While human psychology has long studied cognitive vigilance—the capacity to selectively filter, scrutinize, and reject external inputs—this framework was never systematically integrated into the architecture of modern frontier model agents.
• Preprint tracking: The research was initially submitted to the arXiv preprint server as "Under the Influence: Evaluating and Improving LLM Vigilance in Agentic Tasks" on 24 February 2026, followed by iterative revisions concluding with version four on 22 October 2026.

The operational deployment of autonomous software agents rests on an untested assumption: that frontier model intelligence scales uniformly across all operational competencies. When an enterprise configures an LLM to browse the open web, manage checkout funnels, or inspect external code bases, the engineering objective is execution efficiency. The findings from Robinson, Collins, Sucholutsky, and Allen demonstrate that raw execution capability is fundamentally decoupled from defensive discernment.

In agentic environments, an LLM interacts across multi-turn decision loops. To achieve an objective, the agent must read external instructions, process user feedback, interpret site banners, and incorporate suggestions from external tools. The fundamental structural challenge is that frontier LLMs are trained to follow instructions and optimize toward contextual guidance. When an adversary injects malicious context—such as fraudulent checkout prompts on an e-commerce platform, booby-trapped pull requests inside a software repository, or deceptive click paths on an untrusted website—the agent treats that external influence as cooperative task guidance rather than adversarial interference.

Because task performance and vigilance capabilities operate on separate axes, scaling model size or general reasoning scores does not inherently resolve the flaw. A frontier model capable of resolving complex software bugs with precision remains just as likely to accept a malicious advisor's advice to execute an unsafe patch. The model optimizes for task completion according to the immediate prompt and available context, lacking an innate cognitive architecture to evaluate the latent motivations or empirical reliability of the advisor providing the data.

To resolve this structural vulnerability without eliminating an agent’s ability to benefit from genuine assistance, the researchers designed a Bayesian vigilance harness. Instead of treating all external input as valid context or applying crude, blanket filters that discard helpful collaboration, this architecture maintains a probabilistic model over the advisor's reliability. By updating advisor value estimates using Bayesian reasoning across multiple interaction steps, the harness creates an explicit verification layer. When the system detects advice diverging into hostile or destructive outcomes, it actively down-weights the external input, isolating the core agent logic and restoring task execution to baseline safe levels.

• Enterprise software engineering teams: Developers integrating automated code-patching agents into public and internal repositories face immediate risks from tainted dependencies and deceptive external contributions.
• E-commerce operations and procurement leads: Organizations using autonomous agents to source goods, navigate pricing environments, and conduct transactions are vulnerable to synthetic storefronts and purchasing scams designed to exploit naive agent heuristics.
• AI systems architects and security engineers: Technical leaders must redesign pipeline governance, moving away from relying purely on frontier model base reasoning and toward modular verification harnesses that explicitly monitor input provenance.

• Adoption of probabilistic agent harnesses: Watch whether commercial agent frameworks begin implementing Bayesian value estimators or similar stateful evaluation layers to manage multi-turn external inputs.
• Formalization of agentic red-teaming standards: Track whether institutional security evaluations shift benchmark suites away from static prompt-injection evaluations toward dynamic, open-domain interaction environments.