Researchers published a security evaluation of manifest-assisted retrieval in AI search. They audited 39 sources through August 2026 and updated through October 14. A study of 15 tools found no automatic requests in 45 trials at one endpoint. A log study showed 97% of domains with detected files received no requests in May 2026. They defined five operational threat paths and paired security-utility estimands. The team used 30 parser fixtures for pre-model controls. A pilot ran 24 tasks across eight sites with five conditions and 120 model responses. Frozen scoring found attacker-target adoption in 21 of 24 raw adversarial responses. One adversarial response remained unresolved. The URLs-only condition had no known adoptions and one unresolved response. The work separates publication, fetch, model use, and action in its analysis. The paper was accepted at IEEE FLLM 2026.
What it unlocks
Distinguishing manifest-content effects from publication, discovery, and downstream execution in AI search security evaluations.
- 39 sources audited by Aug 16 2026
- 45 trials at one endpoint
- 97% of domains with files received no requests in May 2026
- 24 tasks across 8 sites
Sources