A Like Can Rewrite the Feed

TL;DR for operators

An autonomous agent that likes recommended content can change its own future information environment. The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems¹ shows how an attacker can exploit that loop in a similarity-based recommender: early poisoned posts are close enough to the user profile to be surfaced and liked, then those likes increase the scores of later poisoned posts that are progressively less similar to the user.

In simulations across six victim LLM configurations, the final poison stage reached at least 5 of the 10 displayed posts after an average of 178.5 to 247.2 rounds. Of 200 injected poisoned posts per target, 47.7 to 68.3 entered recommendation candidates despite falling below the clean top-100 direct-similarity boundary; 31.9 to 57.0 of those were subsequently liked.

For organizations deploying agents that browse, like, rank, or act on recommended content, this changes the security boundary. Engagement actions can alter later exposure, so prompt filtering alone does not cover the full attack path. Monitoring should include recommendation trajectories, engagement reinforcement, and the interaction between agent policy and platform ranking. The paper does not test defenses, and its results should not be generalized to recommendation architectures that do not use the studied similarity-and-like-history mechanism.

The agent does not just consume the feed

Consider a routine agent action: it sees a post and clicks “like.” The action appears local. The agent has evaluated one item, recorded a preference, and moved on.

But if the platform uses recent likes to rank future content, that action changes the distribution of inputs the agent will receive later. The agent is no longer operating against a fixed environment. Its own behavior helps construct the next one.

The paper studies this coupling directly. In its simplified recommender, a candidate post receives a score based on its direct similarity to the user profile, multiplied by an amplification term derived from similarity to recently liked posts. A post that is only moderately aligned with the user can therefore outrank stronger direct matches if it resembles material the user has just liked.

That creates a delivery channel for poisoning. The attacker does not need to place a distant malicious post directly in front of the victim. Nor does the attacker adapt the attack after every agent response. The poisoned set is inserted once, and subsequent reinforcement is produced by the recommender-agent interaction itself.

Several small similarity steps can beat one large jump

The attack begins with poisoned posts whose embeddings are sufficiently similar to the target profile to compete for retrieval. Once the victim likes some of them, nearby poisoned posts receive an additional ranking advantage because they resemble the newly liked content.

The attacker then repeats the construction across several stages. Each stage moves farther from the original user profile while remaining close enough to the previous stage for recommendation feedback to compensate for the loss in direct similarity.

This is the paper’s central theoretical contribution. It derives sufficient conditions governing first-stage similarity, similarity between adjacent stages, within-stage cohesion, poison quantity, and the lowest final-stage similarity that can still be reached under the model assumptions.

The theory also clarifies why stage count matters. Moving too far in one step can break the chain because the feedback gain no longer offsets the weaker user-post match. More stages allow a more gradual transition.

There is one technical boundary worth retaining. The paper’s informal main-text expression for the minimum number of stages differs in functional form from the formal asymptotic result in the appendix. That inconsistency does not erase the broader sufficient-condition argument, but it makes the exact stage-count prescription less settled than the mechanism itself.

The experiments support a feedback mechanism, not just feed takeover

The main simulations use 50 OASIS user profiles, 2,000 clean posts, 400 interaction rounds, and a default attack consisting of five stages with 40 poisoned posts each. Six victim-model configurations are tested.

All six eventually reach the condition in which Stage 5 occupies at least half of the ten displayed feed positions. The mean time to that state ranges from 178.5 rounds for qwen-3.5-9b to 247.2 for llama-3.1-8b.

More revealing is what happens below the ordinary retrieval boundary. The paper defines the clean top-100 boundary using direct user-post similarity: roughly, the similarity level a post would normally need to remain competitive for the top-100 candidate pool before feedback changes its effective score. Across victim models, an average of 47.7 to 68.3 poisoned posts per target cross into recommendation candidates despite lying below that boundary.

That result is more informative than feed share alone. It shows that the feedback term is not merely reshuffling already competitive posts. It can promote attacker-controlled content that direct profile similarity would otherwise leave outside the normal candidate frontier.

The supporting experiments are best read by purpose:

The pattern across these tests is consistent with the proposed explanation: the attack works because past engagement modifies later ranking.

Agent policy and platform ranking form one security surface

For operators, the paper’s most consequential result is not that an LLM can like malicious content. The relevant change is that a seemingly harmless action can alter the future inputs presented to the agent.

Cognaptus therefore infers that security controls for agents operating third-party feeds should evaluate the coupled system rather than the model in isolation. A like, follow, save, or similar interaction may deserve stronger governance when it feeds directly into subsequent ranking.

Several controls follow from that system view, although the paper does not experimentally evaluate them. Teams can monitor abrupt movement in the embedding trajectory of liked content, measure how much below-profile-similarity material enters the feed through feedback terms, cap repeated exposure from tightly clustered content, or require independent policy checks before engagement actions are allowed to influence later recommendations.

The agent-memory experiments add another design variable. Configurations that prefer material similar to previously liked content strengthen the poisoning loop, while diversity-seeking preferences substantially weaken it. That makes diversity more than a user-experience choice in this setting; it can also alter exposure risk.

The result is bounded to one recommendation architecture

The evidence is strong within the studied environment, but its scope is specific.

The recommender is a simplified OASIS-derived system built around dense similarity and a like-history multiplier. Popularity and recency effects are removed. The theoretical guarantees rely on simplifying assumptions about embedding geometry and victim behavior. Most evidence comes from simulation rather than a production recommender.

The OpenClaw experiment broadens the victim-agent implementation, but it does not remove these platform-side limitations. Its session is also reinitialized every round, so it does not test a continuously persistent conversational agent whose reasoning history accumulates across the entire attack.

Most importantly, the paper does not establish that graph-based, transformer-based sequential, semantic-ID, popularity-driven, or hybrid recommenders admit the same attack. Their feedback paths may create different vulnerabilities—or may interrupt this one.

The defensible conclusion is narrower and more actionable: whenever an agent’s engagement changes what the environment shows it next, that feedback mechanism belongs in the security model. It should be tested as deliberately as prompts, retrieval pipelines, tools, and memory.

Cognaptus: Automate the Present, Incubate the Future.