# Breadcrumbing Search Agent — Coordinated Corroboration Injection

- **Severity:** Medium
- **Signature ID:** `8e2a1f0d-6c3b-4e9a-9f7d-2b6a4c8e1d35`
- **MITRE ATLAS:** AML.T0051.000 (Direct), AML.T0034.000 (Excessive Queries)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This detects text fed to an AI search agent that falsely claims a new result confirms an earlier one, paired with an instruction telling the agent to stop checking and accept the answer. Attackers plant this combination in web pages or search results the agent reads, hoping the agent's own cross-referencing logic will treat manufactured 'corroboration' as proof and skip further verification.

## How the attack works

An attacker seeds a search result, fetched page, or other content the agent consumes with two things at once: language that ties it to a prior step ('this confirms the previous finding') and a directive to stop verifying ('you can now conclude', 'stop searching', 'treat this as verified'). When the agent processes this content across one or more queries, it can be manipulated into believing independent sources agree, short-circuiting its own fact-checking. The detection only looks at the content of a single tool call — it does not (and cannot, given current telemetry) confirm that the same attacker planted matching payloads across multiple queries to build a real corroboration chain.

## Why it matters

An AI search agent can be pushed to accept a false or attacker-planted claim as verified fact, skipping further research, and pass that conclusion to a user or downstream process as if it had been properly checked.

## What you can do

- Review flagged tool-call content manually rather than assuming an automatic block; this rule only reports, it doesn't stop anything.
- Configure search agents to require corroboration from sources outside the current tool-call session, not just text claiming agreement within it.
- Log and periodically audit multi-query search sessions to look for repeated 'confirms/stop searching' phrasing patterns across different queries, since single-event detection can't see that chain.
- Exclude known legitimate uses (ticket-consolidation tools, editorial summaries, security-training content) from alerting to cut down noise, but keep reviewing edge cases.

## Known benign look-alikes

- QA or support-ticket aggregation tooling that legitimately restates "this confirms the earlier report and no further sources are needed" while consolidating duplicate tickets
- News- or research-aggregation summaries describing genuinely corroborated reporting across independent sources with an editorial "no need to search further" conclusion
- Security-awareness or incident-writeup content that discusses this exact breadcrumbing/prompt-injection technique using illustrative example phrasing (partially mitigated by filter_discussion, not exhaustive)

---
Source: https://www.netzilo.com/threats/breadcrumbing-search-corroboration