English

How Adversarial Environments Mislead Agentic AI?

Artificial Intelligence 2026-04-22 v1

Abstract

Tool-integrated agents are deployed on the premise that external tools ground their outputs in reality. Yet this very reliance creates a critical attack surface. Current evaluations benchmark capability in benign settings, asking "can the agent use tools correctly" but never "what if the tools lie". We identify this Trust Gap: agents are evaluated for performance, not for skepticism. We formalize this vulnerability as Adversarial Environmental Injection (AEI), a threat model where adversaries compromise tool outputs to deceive agents. AEI constitutes environmental deception: constructing a "fake world" of poisoned search results and fabricated reference networks around unsuspecting agents. We operationalize this via POTEMKIN, a Model Context Protocol (MCP)-compatible harness for plug-and-play robustness testing. We identify two orthogonal attack surfaces: The Illusion (breadth attacks) poison retrieval to induce epistemic drift toward false beliefs, while The Maze (depth attacks) exploit structural traps to cause policy collapse into infinite loops. Across 11,000+ runs on five frontier agents, we find a stark robustness gap: resistance to one attack often increases vulnerability to the other, demonstrating that epistemic and navigational robustness are distinct capabilities.

Keywords

Cite

@article{arxiv.2604.18874,
  title  = {How Adversarial Environments Mislead Agentic AI?},
  author = {Zhonghao Zhan and Huichi Zhou and Zhenhao Li and Peiyuan Jing and Krinos Li and Hamed Haddadi},
  journal= {arXiv preprint arXiv:2604.18874},
  year   = {2026}
}

Comments

Accepted to Findings of the Association for Computational Linguistics: ACL 2026

R2 v1 2026-07-01T12:27:19.350Z