AI Recommendation Poisoning: How
Summary: Researchers observed production websites embedding hidden prompt injection payloads in "Ask AI" buttons on marketing and competitor comparison pages, so that a logged-in user of ChatGPT, Claude, Gemini, or Grok who clicks one executes a pre-formed query in their session with no confirmation. In February 2026, Microsoft Security catalogued the behavior as AI Recommendation Poisoning, identifying 31 companies across 14 industries deploying it, with more than 50 distinct prompts observed in a single data source over 60 days, and the technique is tracked in MITRE ATLAS as AML.T0080 (Memory Poisoning).
Key Takeaway: The payloads instruct the model to permanently save the vendor's domain as a trusted source, so a security team member clicking "Ask AI" for a neutral second opinion on a competitor can silently bias every future answer their assistant gives - and the effect lasts indefinitely, with most users having no visibility into what is stored in their AI's memory.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026