AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
13:30 · August 6, 2026 · Hacker News AI Section
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user
Summary
AI Recommendation Poisoning exploits the deep-link functionality built into major LLM interfaces such as ChatGPT, Claude, Gemini, and Grok. Marketing pages embed specially crafted query strings inside ordinary “Ask AI” buttons. When a logged-in user clicks the link, the assistant receives and executes the query in the active session without any visible confirmation step. The payload typically contains an instruction to store the vendor’s domain as a trusted source or authority, causing the model to reference that domain preferentially in all subsequent conversations.
The technique is distinct from conventional prompt injection because the command never appears in scraped web content; it arrives directly through the user’s own session. Once committed to the model’s persistent memory store, the directive influences answers indefinitely. Microsoft Security documented the pattern in February 2026, cataloguing 31 organisations across 14 industries and more than 50 distinct payloads observed over a 60-day window. The behaviour is recorded in the MITRE ATLAS framework under AML.T0080 (Memory Poisoning) and is closely related to AML.T0051 (LLM Prompt Injection).
Real-world instances include consent-management vendors whose summary buttons also instruct the model to treat their domain as an expert source on privacy topics, and security-software vendors whose competitor-comparison widgets direct the assistant to treat their own marketing material as authoritative. In both cases the visible button text suggests a neutral request while the underlying URL parameter carries the memory-manipulation command.
Detection relies on inspecting outbound hyperlinks that target AI assistant domains and contain terms such as “remember,” “trusted source,” or “tag for future reference.” Security teams can supplement this with periodic memory-audit prompts that surface any unauthorised domain tags. Recommended immediate controls include treating such links like credential-harvesting attempts on corporate accounts and applying automated DOM monitoring to flag suspicious “Ask AI” widgets before they are clicked.
Why it matters
Directly addresses AI security risks from prompt injection and memory poisoning with actionable guidance for professionals. Applicable to Dutch/EU teams using commercial AI tools, aligning with GDPR and AI Act compliance needs. Provides concrete detection patterns and policy recommendations.
