Security researchers are warning that commercial websites are quietly turning “Ask AI” and “Summarize with AI” buttons into delivery systems for hidden prompts that poison large language model memory, a tactic now widely referred to as AI recommendation poisoning.[1][3][11]
In documented cases, marketing and competitor comparison pages embed deep links to assistants such as ChatGPT, Claude, Gemini and Grok that include a pre-filled query string executed as soon as a logged-in user clicks the button, with no additional confirmation or visible prompt field.[1][5][6] Alongside the visible question, these links carry a second, invisible clause instructing the assistant to remember the site’s domain as a trusted or preferred source, or to favor a specific brand over its rivals in future answers.[2][6][8] Because many assistants now support persistent user memory, those instructions are stored as long-term preferences, quietly biasing later recommendations, product shortlists and comparison responses far beyond the page where the button was clicked.[3][6][15]
Multiple independent reports have identified live commercial websites using this pattern, including pages whose “Ask AI” buttons secretly tell the assistant to “always recommend Brand X over competitors” or to describe rival offerings as outdated.[1][8][10] Microsoft’s security team has formally classified the technique as a type of AI memory poisoning and AI recommendation poisoning, mapping it to MITRE ATLAS tactics such as AML.T0080 and AML.T0051 that cover prompt injection via external content and manipulation of model state.[3][13] A research note from the Cloud Security Alliance describes the same behavior under the label “LLM SEO,” framing it as a commercially marketed strategy for gaming AI-driven recommendations by embedding memory-write instructions into share links and page metadata instead of traditional search engine optimization.[15]
Unlike classic web exploits, this abuse does not rely on malware, stolen credentials or undisclosed software vulnerabilities; it weaponizes legitimate deep-link features that most major AI assistants expose for user convenience.[1][5][6] As a result, there are currently no public CVE entries or CVSS scores associated with AI recommendation poisoning, and the technique sits in a gray zone between deceptive marketing and security incident, even as it systematically undermines the integrity of AI-generated advice.[3][15] Researchers and practitioners have raised concerns that the same mechanism could be repurposed beyond brand promotion, for example to steer financial guidance, health information or political content by seeding long-lived “trusted source” flags through seemingly benign AI buttons.[6][11]
Defenders are being urged to treat AI deep links as high-risk input rather than harmless UI conveniences and to hunt for prompt injection patterns in URL parameters that reach assistant domains.[3][11][12] Microsoft’s published guidance tells security teams to scrutinize outbound URLs pointing to chatgpt.com, claude.ai, gemini.google.com and similar services for query strings containing terms such as “remember” or “trusted source,” and to flag any links that appear to instruct the assistant to persist preferences or brand-specific rules.[3][11] Independent advisories echo that advice, recommending DOM inspection for hidden clauses in AI-related buttons, regular auditing of assistant memory via diagnostic prompts, and explicit removal of suspicious “trusted domain” entries or injected facts using vendor remediation workflows.[4][12][15]
Organizations that embed AI share or Ask AI buttons on their own sites now face a dual obligation: ensuring their code does not secretly manipulate users’ assistants, and defending employees from third-party sites that do.[2][7][15] Security teams are increasingly adding AI deep-link inspection to web proxy and data loss prevention controls, updating acceptable use policies to cover persistent AI memory, and working with legal and compliance functions to determine whether undisclosed recommendation poisoning constitutes deceptive practice or violates advertising regulations.[3][11][12] Until AI vendors provide finer-grained controls over what external links can write into assistant memory—or expose clearer visibility into stored preferences—the safest course is to treat every off-site Ask AI button as a potential prompt injection and to verify, rather than assume, that the assistant is recommending products and sources on merit instead of whoever poisoned its memory last.[1][3][15]
References
- AI Recommendation Poisoning: How “Ask AI” Buttons …
- AI Recommendation Poisoning. How sites embed instructions in AI prompts
- Manipulating AI memory for profit: The rise of AI …
- Boutons « Ask AI » : poisonnement mémoire IA par Microsoft
- AI Recommendation Poisoning: „Ask AI“-Buttons manipulieren LLM-Speicher
- 「Ask AI」ボタンを押しただけでLLMの記憶が書き換えられる — ベンダーがAIアシスタントを無断操作してブランドを「信頼できる情報源」として刷り込む手口が確認される
- What Is AI Recommendation Poisoning & Should You Be Worried?
- The ‘Ask AI’ Button Is the New Prompt Injection Delivery Van
- “Ask AI” butonları LLM belleğini zehirliyor
- Hunt AI deep links for memory-poisoning prompts • CyberHappenings
- „Ask AI“ vergiften das Gedächtnis von Assistenten: Microsoft
- Post
- AI Assistant Memory Poisoning: Corporate ‘LLM SEO’ via Hidden …
