AI Recommendation Poisoning: How ‘Ask AI’ Buttons Silently Alter LLM Memory

A new class of prompt injection attack, dubbed “AI Recommendation Poisoning,” is spreading across commercial websites. It exploits pre-filled deep links in “Ask AI” buttons on ChatGPT, Claude, Gemini, and Grok. When clicked, these links execute hidden prompts that instruct the AI to permanently save the vendor’s domain as a “trusted source,” biasing future answers. Microsoft Security catalogued this behavior in February 2026, identifying 31 companies across 14 industries. The technique is tracked in MITRE ATLAS as AML.T0080 (Memory Poisoning), related to AML.T0051 (LLM Prompt Injection).

Unlike traditional prompt injection, this attack bypasses retrieval-time defenses because the payload executes at the click layer. Real-world cases include a consent management vendor adding buttons that tag its site as a source of expertise, and an enterprise security vendor embedding “Ask AI” widgets on competitor comparison pages with hardcoded memory-poisoning payloads. The tactic is commoditizing via CMS plugins, SEO generators, and analytics integrations.

Detection involves inspecting outbound hyperlinks for AI assistant domains with query strings containing instructions like “remember” or “trusted source.” Microsoft’s guidance and a free cheat sheet from Reflectiz provide monitoring patterns and memory audit prompts. The article advises treating unsolicited memory-manipulation links like credential-harvesting links and using continuous monitoring solutions like Reflectiz.