Your AI agent just got a task. Hidden in the page was a fake button that would send it somewhere it shouldn't go. But it didn't get hacked — it got talked into it.
That's the finding from TRAP (Task-Redirecting Agent Persuasion Benchmark), a new study from SoftServe and the University of Oxford.
Researchers tested six leading AI models on realistic copies of everyday work and e-commerce websites. Each agent had a routine task, such as checking a calendar, reviewing a job candidate, or booking a delivery. But somewhere on the page — in a comment, a bio, or a fake notice — hid an instruction that tried to direct it elsewhere.
On average, 25% of those attempts worked. Not through a hack or clever code, but through seven persuasion tactics identified by psychologist Robert Cialdini: authority, reciprocity, scarcity, liking, social proof, consistency, and a sense of belonging.
For AI, this looks like a fake "admin notice" that tells the agent they can't continue unless they agree to certain terms. Or a comment claiming "others already did this and it worked fine." Or a note thanking the agent in advance for taking a "quick shortcut."
Researchers call this class of attack “prompt injection” — burying instructions inside content an AI agent reads, so persuasive framing does the work a technical exploit would otherwise have to do. TRAP set out to measure exactly how often that persuasion succeeds, and how far a single successful attempt can travel once it works. TRAP's most important discovery? The way the weakness travels.
In addition to measuring how often AI fell for an attack, researchers also checked whether an attack that fooled one model would fool the others. The pattern they found was one-sided. Take an attack that worked on GPT-5 — the hardest model to fool in the study, tricked only 13% of the time. That same attack went on to fool Claude Sonnet 3.7 90% of the time, DeepSeek-R1 89% of the time, and GPT-OSS-120B 81% of the time. Yet, an attack that worked on DeepSeek-R1 — the easiest model to fool, tricked 43% of the time — fooled GPT-5 only 26% of the time.
In plain terms, a line that misleads your strongest model works almost like a master key for your weaker ones. But a line that tricks your weakest model tells you almost nothing about whether it will work on your strongest one.
This turns the usual security thinking upside down. Most teams look for the weakest link — the smallest, cheapest, or least-tested model in their lineup — and assume that's where the danger lies. TRAP suggests attackers see it the other way around. They don't need to test every model in a company's stack for its own specific weak spot. They only need a single line of persuasion to beat the toughest, best-defended model. Perfect the attack once, against the hardest target, and it spreads through the rest of the system for free.
Small changes in how the fake instruction is shown — a button instead of a link, one word changed — doubled the frequency with which it worked in TRAP's tests. Fake buttons worked more than three times as often as the identical message written as a link.
Which type of persuasion works best also depends on the model. Social proof and consistency were GPT-5's biggest weaknesses, authority for DeepSeek-R1 and GPT-OSS-120B, and reciprocity for Gemini. That variation means agents can't defend against persuasion by memorizing the exact wording that fooled them before. They would have to defend against entire categories of persuasion, not individual phrases.
For organizations, the practical implication is clear: testing a single model reveals only a fraction of the risk. What matters is how an attack spreads across the rest of the stack. After all, most companies run a mix of models — a flagship product built on a top-tier one, plus a long tail of pilots, internal tools, and cheaper models handling most of the work.
Defending against this means giving agents the same skepticism you'd give a stranger who shows up with an urgent claim. An agent that checks every "admin notice," every "others already did this," and every embedded button will be much harder to persuade. As AI models keep getting smarter, the habit of doubting a webpage that claims authority needs to get smarter along with them.
