In May 2026, three researchers at Cornell Tech published a preprint with a plain title: Deep-Research Agents Can Be Poisoned via User-Generated Content. Tingwei Zhang, Harold Triedman and Vitaly Shmatikov built an attack they named WARP, for Web Agent Retrieval Poisoning, and then demonstrated something that should concern anyone whose customers ask an AI for advice.
They appended roughly 13 words of promotional text to a single community page. In test runs where that page was retrieved, the AI research agent named the promoted product in 38 to 51 percent of cases. Spreading the same bait across a few threads raised it to around 62 percent. In one example, 15 words added to a thread about cryptocurrency were enough to make an agent recommend a coin that did not exist, citing the tampered post as its source.
The mechanism is what matters. These agents run many related queries in one session, and for a given topic they keep pulling the same handful of community pages. The researchers call this retrieval overlap. Tamper with one frequently retrieved thread and you do not influence one answer. You influence the answer to an entire category of questions.
The researchers never posted any of it publicly. They ran the attack in a sandbox specifically to avoid contaminating the live web, which they argue is the only ethical way to study the problem.
Six weeks later, Reddit published an update on how it is fighting spam and manipulation. The two documents are the same story told from opposite ends.
What Reddit actually announced
Reddit's 2026 enforcement changes are two separate actions: an identity and labelling programme announced in March, and an enforcement report published in July describing detection at a scale the platform has not previously disclosed.
March 2026. Steve Huffman announced that accounts showing signs of automation may be required to verify that a human is behind them. The verification is deliberately narrow. Reddit says the aim is to confirm a person exists, not to learn who that person is, and it routes through third-party methods such as device passkeys rather than through Reddit holding identity documents. This is not sitewide identity verification and it does not apply to most accounts. Separately, from the end of March, automated accounts operating within the rules began carrying an [App] label so that a reader can see when a reply came from software. Reddit reported removing roughly 100,000 bot and spam accounts per day.
July 2026. Reddit published its detection numbers. Between January and March 2026 it reduced users' exposure to spam by about 20 percent against the prior quarter, with a further 10 to 15 percent drop in exposure to spam accounts. It is catching around 25,000 new spammy posts and comments daily. It is blocking roughly 23 million spam views per day before a human reads them. It is revoking close to 2 million inauthentic votes per day. Enforcement time on hateful or violent content fell from hours to under five seconds. Reddit notes that it has been dealing with bots for 21 years and that AI slop was preceded by ordinary slop.
The detection now begins at account creation, using signals present before anything is posted, and uses language models to find coordinated patterns that earlier systems missed. Note the phrase Reddit uses for what it is looking for: fake behaviour and artificial hype.
Context for the timing. Digg shut down its app shortly before the March announcement, citing an inability to control bot activity. Cloudflare projects that bot traffic will exceed human traffic across the internet by 2027. Reddit is not tightening rules because manipulation is a hypothetical risk. It is tightening them because its product is human conversation and the supply of that is under threat.
The thing Reddit cannot catch
Reddit's detection is built to find automation, and the Cornell paper describes an attack that requires none.
Look at what the enforcement signals actually are. Account creation patterns. Posting velocity. Phrasing repeated across multiple communities. Accounts created in clusters around a campaign window. Coordinated voting. Every one of those is a machine-detectable pattern produced by operating at scale.
Now look at what WARP needs. One sentence. Posted once. On a thread that already exists and already ranks. Written to resemble the question a person would ask, because the researchers found that a snippet of 11 to 15 words closely mirroring the query is particularly persuasive to a language model.
One of the researchers put the detection problem plainly to 404 Media: separating poisoned text from a genuine user's text is difficult. There is no velocity signal, no cluster, no repetition. A single well-written sentence from an account with real history looks exactly like a person sharing an opinion, because at the level of the text, it is indistinguishable from one.
So the enforcement pressure falls entirely on the detectable class of behaviour. Which produces a conclusion most Reddit marketing guides have not stated.
The crackdown is not a threat to brands participating through real accounts with genuinely useful comments. It is a direct threat to the operating model of every brand that scaled community presence with automation, account networks or briefed participants. Those are the exact patterns the new detection was built to find. Approaches that worked in 2023 now trip signals designed specifically for them.
There is an uncomfortable second half to that, and it should be said. The reason there is a crackdown is that brands are doing this. The Cornell paper is not a warning about a future risk. It is a description of a practice already widespread enough that a research team built a formal attack model for it. Any brand entering community engagement in 2026 is entering a channel under active suspicion, by both the platform and its moderators. The only durable position is one that would survive being audited.
Does Reddit allow AI-generated content?
Yes. Reddit permits AI-generated content sitewide, and individual communities set their own rules about it. The platform's restrictions target automation, concealment and manipulation, not the use of a tool to help write something.
That sentence contradicts what most marketing coverage implies, so it is worth being precise about where the actual lines sit.
What Reddit restricts: automated accounts that do not disclose themselves, accounts that cannot demonstrate a person behind them when flagged, coordinated inauthentic behaviour across accounts, vote manipulation, and spam. The [App] label exists precisely so that legitimate automation can operate visibly rather than be treated as deception.
What individual subreddits restrict: anything they choose. Many have explicit rules on promotion, on disclosure of affiliation, and increasingly on AI-written content. A subreddit rule is the binding constraint in practice, and it is enforced by moderators long before Reddit's systems become involved.
What the endorsement rules restrict, separately from the platform: undisclosed material connections. If someone is compensated to post on a brand's behalf, that relationship requires disclosure, and the brand carries primary liability for what is said. Drafting assistance does not move that liability anywhere.
Which leaves a genuine question that a thoughtful reader will ask, so here is a direct answer. If an AI drafts a comment and a person at the brand reads it, edits it, approves it and posts it from their own account, is that participation or is that pollution?
The honest test is not about the tool. It is this: would this comment be useful to the person who asked, if no machine ever read it?
If the answer is yes, the tool used to draft it is a production detail, and there is a named person who read it and would stand behind it. If the answer is no, if the comment exists to be retrieved rather than to be read, then it is poisoning regardless of who typed it. A human can write spam. That test also happens to be a reasonable proxy for what a moderator is deciding when they look at a brand's reply.
Why this matters more in women's health than almost anywhere else
Retrieval poisoning in a women's health category is not a marketing problem. It is a health information problem, because of what the answers are used for.
Set the numbers next to each other. OpenAI reported in January 2026 that more than 40 million people ask ChatGPT healthcare questions daily, and that most health conversations happen outside clinic hours. Clinicians reported in May 2026 that social media misinformation about perimenopause is already driving women to request hormone therapy they do not need and to stop contraception prematurely, with unintended pregnancies and missed diagnoses among the consequences. A BMJ Open analysis of the 180 most visible posts making hormone therapy claims found a conflict of interest in 117 of them.
Now add the Cornell finding. Thirteen words in one frequently retrieved thread can influence the answer to a whole cluster of related questions.
A woman at two in the morning, trying to work out whether her symptoms warrant a doctor's appointment, is asking a system that assembles its answer partly from community threads. The integrity of those threads is not an abstraction to her.
This gives women's health brands an interest that a consumer electronics brand does not have. In most categories, a poisoned thread costs a competitor a sale. In this one, it can cost someone a correct diagnosis. Brands in this category have a direct commercial stake in the credibility of the channel they depend on, which means they have a reason to hold themselves to a standard higher than the enforceable minimum, rather than to work out how close to the line they can operate.
What to do about it
Six things, in order of how much they matter.
- Use real accounts with real histories, and no networks. One brand account and named employees. No clusters, no unbranded accounts created for a campaign, no briefed third parties posting without disclosure. Account networks are the pattern Reddit's detection was built to find.
- Claim a verified brand profile. Reddit launched verified profiles for brands, publishers and creators in late 2025, specifically to help their contributions gain acceptance in relevant communities. Being visibly who you are is now an asset rather than a liability.
- Read the subreddit rules first, every time. They are the binding constraint. Moderator removal happens long before platform enforcement, and a removal record follows a brand.
- Put a named human on every reply, with a record of who approved what. This covers the platform requirement that a person is behind the account, the endorsement requirement for disclosure and substantiation, and the tonal risk that no policy addresses.
- Apply the reader test before posting. Would this be useful to the person who asked, if no machine ever read it. If the honest answer is no, do not post it. Most of the highest-reach threads in any health category are moments where the useful answer contains no product mention at all.
- Measure reception, not volume. Comment score, whether the original poster responded, moderator removals, and account standing. A programme that reports posting volume has already stopped paying attention to whether the community accepts it.
A note on what we do
We build and run the Ayana Agent for brands in categories where this is difficult. It monitors the communities where a category's decisions get made, drafts replies with genuine command of the product detail, and routes every draft to a named human on the client's team who approves, edits or discards it before anything is posted. Nothing publishes unread, and every approval is recorded.
We built it that way in 2024 because it was the only responsible way to operate in maternal health. The platform rules moving in this direction was not something we predicted. We are stating our interest plainly: the standard proposed in this article is one we would like to be measured against, and we think brands should ask any vendor in this space how they perform against it.
Frequently asked questions
See whether your category is one we can help with.
A fit call is a short, direct conversation about your communities, your compliance constraints, and whether a human-approved agent is the right instrument for the channel.
Platform policies change frequently. Figures and rules described here are current as of July 2026. Check Reddit’s published policies before acting on any of it.