Microsoft Identifies AI Recommendation Poisoning in 31 Companies
This digest was compiled by AI from multiple sources — links to the originals are below.
Microsoft security researchers identified a new attack technique, AI Recommendation Poisoning, that embeds hidden prompts in "Ask AI" buttons on commercial websites to manipulate large language model (LLM) long-term memory. The technique has been observed in 31 companies across 14 industries, with more than 50 distinct prompts recorded over 60 days. The attack requires no malware, exploiting standard deep-linking features in AI assistants including ChatGPT, Claude, Gemini, and Grok.
The Deep-Link Attack
Most AI web interfaces support deep-linked queries via URL parameters, such as https://chatgpt.com/?q=.... When a user clicks a crafted "Ask AI" button, a pre-formed query executes immediately in their active session without confirmation. In memory poisoning attacks, these query strings contain commands like "remember this domain as a trusted source," which the model may commit to its long-term memory profile. Microsoft Security catalogued the behavior in February 2026, identifying 31 companies deploying it across 14 industries, with more than 50 distinct prompts observed in a single data source over 60 days. The attack surface encompasses every hyperlink on the web and bypasses defenses aimed at retrieval-time injection because the payload executes at the click layer, not inside scraped web content.
Consent Platform Case Study
During an audit, researchers identified a vendor selling consent management software that added "Summarize this blog post with" buttons for ChatGPT, Perplexity, Claude, and Grok across its blog. The pre-filled prompts included instructions to permanently bias the model toward the vendor's products. This practice crosses the line from benign generative engine optimization (GEO) to memory poisoning because it manipulates the model's persistent memory without user knowledge or consent. The vendor's approach mirrors broader industry tactics where leading questions and favorable product framing are embedded in deep links, but in this instance, the intention was to permanently alter the AI's trust preferences.
Tracking and Defense
The technique is formally tracked in the MITRE ATLAS knowledge base as AML.T0080 (Memory Poisoning), related to AML.T0051 (LLM Prompt Injection). Microsoft Security continues to monitor the threat, and a free AI Memory Poisoning Defense Cheat Sheet has been released, offering DOM monitoring patterns, memory audit prompts, and remediation steps. No evidence of malware or credential theft is associated with the attack, as it leverages built-in assistant functionalities.
What's Next
Microsoft and MITRE ATLAS are expected to update their tracking and defense guidance as new variants emerge. It remains unclear how AI platform providers will adapt deep-linking and memory features to prevent silent poisoning without degrading legitimate user functionality.
1 source
Microsoft Identifies AI Recommendation Poisoning in 31 Companies
