What Is Your Agent Searching For?

⚠ This action requires your approval.
[1] Yes
[2] Yes, and don't ask again
[3] No

-> Yes

This confirmation dialog pops up hundreds of millions of times daily across AI Agents. Most users press the Enter key within one second. Few users pay attention to what the Agent searches, what content it reads, and what answers it generates.

But what if the information an Agent searches for is fundamentally incorrect?

Over the past year, a quiet yet profound shift has been taking place: queries to search systems are increasingly sent not by humans, but by Agents.

This itself is nothing new. However, its underlying security risks have been drastically underestimated amid the booming Agent era:

In March 2026, Salesforce AI Research published "Poisoning the Well." The study found that when search agents encounter carefully crafted disinformation, 80% of queries return answers preset by attackers. Even with a corpus of over 100,000 clean documents, nearly a quarter of queries are successfully poisoned. In the same month, OX Security uncovered an architecture-level vulnerability in the MCP protocol—the de facto communication standard for AI Agent—affecting over 200,000 instances, which Anthropic refused to fix at the protocol level.

These are no longer hypothetical scenarios in academic papers. When AI Agents become the mainstream way for enterprises and individuals to obtain external information, the act of searching itself constitutes a brand-new and largely unprotected attack surface.

I. Queries Are Intelligence

For the past two decades, Data Loss Prevention (DLP) has centered on one core risk: preventing sensitive data from leaking outward.

The Agent era introduces a symmetrical threat: the query itself is the leak.

A security operations Agent searching for "CVE-2026-4721 exploit mitigation Kubernetes 1.28 containerd"—this single query reveals three critical pieces of information to the search API provider: the enterprise runs Kubernetes 1.28 with containerd, and is likely facing active exploitation of this specific CVE vulnerability.

Humans have an instinct for self-censorship when searching. No one types "ProjectX Q3 revenue model acquisition target X battery" into Google. But an Agent won't. It faithfully translates its internal reasoning chain into external queries—project codenames, version numbers, internal paths—every single one.

What's more critical is frequency and relevance.

An agent may issue 50 consecutive, related queries in a single research task. Individually, each seems harmless. But aggregated as a sequence, these search queries form a real-time corporate strategy briefing.

This is a question every security leader should ask themselves: Which search APIs are your Agents using? What are these providers’ data retention policies? Which third-party vendors may receive such query data?

II. Search Result Poisoning: The Cheapest Way to Manipulate an Agent

Manipulating an AI Agent's decision-making can be easier than sending a phishing email.

Traditional attacks require finding vulnerabilities, writing exploits, bypassing defenses, and maintaining persistence.

Manipulating an Agent's search results? One carefully crafted blog post is enough. Even a Reddit comment.

1. In May 2026, WARP research fully reproduced the attack path: the attacker can append a carefully constructed text segment to a page the Agent frequently retrieves. Since the Agent repeatedly hits the same high-ranking page for the same topic, a single poisoning operation can compromise all Agent outputs related to that topic.
2. The CorruptRAG research demonstrates from another dimension: injecting one malicious document allows it to be retrieved by a wide variety of semantically similar queries, producing persistent influence.

Why does this matter so much? An Agent is like a diligent research analyst. Someone can slip a report into her reading material that sounds authoritative but draws false conclusions—and she cannot tell the difference.
This kind of attack operates entirely outside traditional security monitoring:

• It never penetrates your network → Undetected by WAF
• It generates no anomalous events → Undetected by SIEM
• Data flows inward instead of outward → Undetected by DLP

This is the new paradigm of cyber attack: influencing decisions through information injection.

Don't touch the system. Just change what the Agent sees. Extremely low cost, extremely difficult to attribute, extremely high return.

III. Unsourced Information Is Unsigned Code

Software supply chain security has a fundamental principle: do not deploy binaries of unknown origin. Every package has a signature, a version number, and a checksum hash.

But when it comes to information Agents retrieve from search—the "evidence" used to make decisions—there is currently almost no equivalent traceability mechanism.

When an Agent gives wrong advice, an enterprise acts on it, and losses occur, if security teams cannot answer "Which search result did this advice come from? Which data source? Could it have been tampered with?"—then accountability is impossible, remediation is impossible, and recurrence prevention is impossible.

Trust cannot be passively transferred by default.

Search engines trust web pages → Agents trust search engines → Enterprises trust Agents → Customers trust enterprises.

Attackers only need to inject false information at the first node of the chain, and the negative impact will cascade all the way to the final node.

That's why we need basic mechanisms to break the default chain of trust: source annotation, confidence grading, multi-source cross-validation, and so on.

IV. Why General-Purpose Search Isn't Enough

General-purpose search engines are the backbone of the internet. But there is a structural mismatch between its design goals, security assumptions and the actual demands of enterprise Agents.

Ranking signals are click-through rates, dwell time, and link authority—measuring "what most people find useful," not "what is most accurate for this specific enterprise decision." Popular doesn't mean correct. High-ranking doesn't mean trustworthy.

Even more critical is the difference in security assumptions: general-purpose search assumes users can judge credibility independently. Humans have such capability, while agents do not.

They receive top-ranking, semantically well-matched search content and incorporate it into their reasoning as trusted context.

For high-stakes industries, this mismatch directly constitutes a security threat: contaminated financial market data leading to faulty trading strategies; expired medical literature being cited leading to erroneous clinical judgments; repealed regulations being treated as valid leading to incorrect compliance advice.

It's not that "you can't use general-purpose search." It's that you can't use only general-purpose search. General-purpose search cannot meet the needs of enterprise agents. Therefore, general-purpose search cannot meet the exclusive demands of enterprise agents. A better solution follows clear rules: prioritize trusted sources, supplement with general-purpose search results, and mark uncontrollable sources as unverified. An Agent's information intake needs full governance.

V. What to Do About Search Risk in Agent Era?

"If one believes everything one reads, it would be better not to read at all." —Mencius

An Agent never doubts whether what it reads is true. For it, "Not believing everything" cannot rely on enlightenment, it can only rely on mechanisms.

Whether you're a developer or an enterprise, there is much to be done. For example:

Map your information supply chain. List every search API your Agents are using. Audit each provider's data retention policy, one by one. Understand where query data goes, how long it's kept, and whether it might be reused.

Establish query classification. Which queries can go to the public web, which need sanitization and rewriting, which must only use internal data sources—this should be governed by explicit policy, rather than being left to individual developers’ discretion.

Demand source traceability. Every output from an Agent must be able to answer: "Where did this conclusion come from?" If it can't answer, it shouldn't be used for critical decisions.

These are not optional enhancements; they are fundamental security baselines.

Conclusion

The core question of traditional, human-centric security is "data that shouldn't go out, went out."

The core question of Agent-centric security flips it exactly: it lies with undesired and malicious information infiltrating the system.

Search seems harmless. It's not an intrusion. It triggers no alerts. It doesn't light up red on the security dashboard. But in the Agent era, search is the perception layer—the first input node in the reasoning chain. If you don't protect the input, protecting the output is meaningless.

The software supply chain security system has evolved through phases including SCA, SBOM, code signing and dependency auditing, achieving complete development from 0 to 1.

The information supply chain now stands at the same starting line.

What AnySearch is doing moves in exactly this direction:

• Query data is not persistently stored
• Search results are traceable
• Multi-source fusion with quality scoring, without equating search ranking with trustworthiness
• Tiered routing enabling enterprises to control Agent information intake
• Continuously expanding self-built trusted data sources

These capabilities should ultimately become industry standards, not one company's differentiator.

Until the problem of search security is solved, any Agent remains nothing more than a blind runner with greater speed.