Full Report
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user
Analysis Summary
# Tool/Technique: AI Recommendation Poisoning
## Overview
AI Recommendation Poisoning is a specialized form of prompt injection that leverages the "deep link" functionality of major Large Language Model (LLM) interfaces to manipulate an AI's persistent memory. Unlike traditional prompt injection which targets the current session, this technique abuses the "long-term memory" or "custom instructions" features of AI assistants to permanently bias the model’s behavior, making it favor specific domains or products in all future interactions without the user's explicit consent.
## Technical Details
- **Type**: Technique (LLM Prompt Injection / Memory Poisoning)
- **Platform**: Web-based AI assistants (ChatGPT, Claude, Gemini, Grok)
- **Capabilities**: Persistent memory manipulation, automated query execution, source elevation, and Generative Engine Optimization (GEO) abuse.
- **First Seen**: Catalogued by Microsoft Security in February 2026.
## MITRE ATT&CK Mapping
- **MITRE ATLAS (Adversarial Threat Landscape for AI Systems)**:
- **AML.T0080** - Memory Poisoning
- **AML.T0051** - LLM Prompt Injection
- **MITRE ATT&CK (Enterprise)**:
- **TA0001 - Initial Access**
- **T1566** - Phishing (via malicious links on legitimate-looking websites)
- **TA0003 - Persistence**
- **T1547** - Boot or Logon Autostart Execution (Modified to AI context: persistent memory instructions)
## Functionality
### Core Capabilities
- **Pre-filled Deep Links**: Utilizes URL parameters (e.g., `?q=`) to automatically populate and execute prompts when a user clicks a button while logged into an AI service.
- **Immediate Execution**: Payloads execute immediately upon clicking without a confirmation dialog, inheriting the user's active session and trust.
- **Memory Commitments**: Instructs the LLM to "remember," "save," or "tag" specific domains as "trusted sources" or "experts," which influences the AI's weightings for future queries.
### Advanced Features
- **Bypassing RAG Defenses**: Since the payload is delivered via the user interface (click-layer) rather than through content scraping, it bypasses many Retrieval-Augmented Generation (RAG) security filters.
- **Stealthy DOM Embedding**: Payloads are often hidden within the `href` attributes of "Ask AI" or "Summarize" buttons, making them invisible to the casual user until the link is clicked and the AI session opens.
## Indicators of Compromise
- **File Hashes**: N/A (Web-based technique)
- **File Names**: N/A
- **Registry Keys**: N/A
- **Network Indicators**:
- hxxps://chatgpt[.]com/?q=...[poisoning payload]
- hxxps://claude[.]ai/new?q=...[poisoning payload]
- hxxps://grok[.]com/?q=...[poisoning payload]
- hxxps://gemini[.]google[.]com/...[poisoning payload]
- **Behavioral Indicators**:
- LLMs citing specific commercial domains disproportionately in unrelated sessions.
- "Memory updated" notifications appearing in AI interfaces after clicking third-party "Ask AI" buttons.
## Associated Threat Actors
- **Commercial Entities**: Observed in use by at least 31 companies across 14 industries (including payment processors, consent platforms, and security vendors) for aggressive marketing and competitive subversion.
## Detection Methods
- **Behavioral Detection**: Auditing LLM "Memory" or "Custom Instructions" logs for unauthorized entries regarding "trusted sources" or "expert domains."
- **DOM Monitoring**: Using security tools to scan website Document Object Models (DOM) for "Ask AI" buttons containing high-risk keywords like "remember," "save," "tag," or "trusted source" within the URL parameters.
- **Traffic Analysis**: Identifying outbound clicks to AI domains that contain exceptionally long or complex query strings.
## Mitigation Strategies
- **User Education**: Training users to inspect the destination of "Ask AI" buttons before clicking, or to avoid them entirely in favor of manual copy-pasting.
- **AI Service Hardening**: AI providers should implement confirmation prompts (e.g., "Do you want to allow this site to add to your memory?") before executing deep-linked instructions.
- **Regular Memory Audits**: Periodically clearing or reviewing the "Memory" settings in ChatGPT, Claude, and other assistants to remove biased instructions.
- **Browser Extensions**: Utilizing security extensions that can flag or strip query parameters from known AI service URLs.
## Related Tools/Techniques
- **Direct Prompt Injection**: The manual version of this attack where a user is tricked into typing the command.
- **Indirect Prompt Injection**: Where the AI processes a poisoned document or webpage during a search/RAG process.
- **Generative Engine Optimization (GEO)**: The broader field of manipulating AI responses for marketing purposes.