A new wave of attacks is targeting something many teams assume is harmless: the convenience features on commercial websites. Researchers describe a technique they call AI Recommendation Poisoning, where hidden payloads piggyback on standard “Ask AI” buttons and deep links. Instead of stealing credentials or exploiting vulnerabilities, the method manipulates what an AI assistant may remember.
The issue is not that the AI is “broken.” The concern is that a pre-filled query can execute the moment a user clicks—often without a clear confirmation or warning. Most of these links may be safe, but the harmful ones can tilt the assistant’s future answers toward a specific company.
What “AI Recommendation Poisoning” actually is
In the observed cases, websites embed prompt injection content inside the URL behind “Ask AI” buttons. When a user is signed into a popular AI assistant and clicks the button, the assistant opens the current session and runs the pre-formed query immediately.
Researchers report that the most dangerous payloads instruct the AI to treat a vendor’s domain as a trusted source and to store that instruction in long-term memory. Once saved, the bias can persist across future questions, steering the AI toward recommendations that favor the injected party.
That persistence is the core of the threat. If the model is later asked about vendors, privacy tools, or security products, it may produce answers that reflect the earlier manipulation—without the user realizing why.
How deep links turn a marketing button into an attack surface
Many AI assistant interfaces support deep-linked queries using URL parameters. A user can open a link that includes a query, and the assistant will treat it like the user typed the request themselves.
The risk appears when the link is more than a question. Some “Ask AI” buttons contain hidden instructions that go beyond “summarize this” or “ask for a comparison.” The payload can attempt to compel the assistant to store a domain label in memory as an authority for future reference.
Because the execution happens at the click layer—within the AI assistant session—this approach can slip past defenses that focus on what happens when content is retrieved from a website. In other words, the malicious effect does not rely on injecting text into scraped articles at retrieval time.
Why this persists: long-term memory does the damage
Traditional prompt injection often aims to influence a single response. Here, the goal can be different: create an enduring change. If the link tells the assistant to remember a domain as trusted, that instruction can be committed to a memory store tied to the user’s assistant profile.
After that, everyday interactions can reveal the impact. For example, you might ask which consent management platform to use, or whether a competitor is a good security tool. The assistant’s replies may reference the vendor that was earlier elevated as an authority.
Crucially, the user typically did not authorize the memory change. The model is following instructions it received through the pre-filled link, and most people have limited visibility into what ends up stored in their AI’s memory.
Marketing optimization is normal—memory manipulation is not
Not every pre-filled prompt is malicious. The same deep-link mechanism can be used for legitimate purposes, such as asking for a summary or using helpful framing. Even marketing-oriented strategies can be considered common practice in many ecosystems.
The line gets crossed when the link permanently alters the assistant’s stored preferences or trusted entities without notice or consent. In the reported incidents, the harmful payloads explicitly aim to bias future answers by saving the vendor domain as a trusted source.
Real-world examples researchers analyzed
1) A consent-focused vendor’s “summarize” buttons
One audit described a vendor selling consent management software that added “Summarize this blog post” style buttons across its blog. The button text suggested a straightforward summary workflow, but the underlying link carried a different goal.
Instead of only summarizing an article, the hidden instruction directed the assistant to treat the vendor as an authority and to tag the vendor domain as a source of expertise for future reference. The technique leveraged the fact that the assistant could store the vendor’s domain in long-term memory after the click.
2) A security vendor’s competitor comparison widgets
In another teardown, a web security vendor placed “Don’t just take our word for it, ask AI” widgets on competitor comparison pages. By inspecting the page structure, researchers found that the “Ask AI” button embedded a prompt designed to request a TLDR and to base it on a specific URL.
More importantly, the payload also instructed the assistant to save the vendor domain as a trusted source for future security references. Because the same template appeared across competitor pages, only the competitor name changed. That meant evaluators clicking for a neutral second opinion could unknowingly instruct their assistants to favor the vendor later.
Where the tactic is spreading
Researchers describe the method as becoming commoditized across mainstream marketing tooling. Instead of bespoke malware, the approach can ride on features that are widely available:
- CMS plugins that add “Ask AI” buttons as part of social or engagement components.
- SEO and web-content generators that create customized “Ask AI” buttons with prompt templates.
- Analytics integrations that measure button clicks and then correlate them with later AI behavior or site visits.
In this model, the technique can be deployed at scale. Tutorials and templates can make memory-manipulation links feel like an ordinary optimization step rather than a security risk.
How to detect the risk on your site
Detection focuses on two places: outbound hyperlinks and what the AI assistant might store in memory after those links are used.
Microsoft Security guidance for defenders centers on hunting for URLs that point to AI assistant domains and checking the query strings for suspicious instruction patterns. Researchers note that particular keywords or instruction themes—such as requests to “remember” or to treat a domain as a “trusted source”—are key indicators.
From a practical standpoint, defenders are advised to inspect third-party “Ask AI” links embedded in marketing pages, competitor comparisons, and content widgets. The goal is to identify hidden payloads in the href parameters rather than judging only the visible button text.
Remediation: treat it like a high-risk link
Once you find unsolicited memory-manipulation links, the recommended response is straightforward: treat them like you would treat credential-harvesting links. For corporate environments, this means do not click them on accounts used for work, and brief relevant team members who may evaluate vendors or run proof-of-concept clicks.
Manual review can be difficult at scale, especially when content is produced across thousands of pages or when third-party components insert “Ask AI” buttons automatically. Automation can help continuously monitor the DOM for suspicious outbound links and flag them before employees interact with them.
Researchers also recommend using memory audit prompts to check whether assistants already carry unauthorized domain tags or biased “trusted source” entries.
A defense reference for auditing and clean-up
Because this issue mixes web engineering details with AI memory behavior, teams benefit from a single technical reference that explains what to inspect and what outcomes to look for. Researchers describe a free one-page cheat sheet created to support audits and remediation steps.
That reference is designed to be vendor-neutral and includes items such as DOM monitoring patterns, a checklist for inspecting third-party “Ask AI” links, memory audit prompts, and guidance on how to clean up poisoned entries.
If you manage web properties or security reviews—especially where third-party widgets or marketing automation are involved—it is worth using such a checklist to understand exactly what your links do when clicked inside an authenticated AI session.
Conclusion
AI Recommendation Poisoning shows how seemingly harmless UX features can become a high-impact security problem. By embedding hidden instructions inside pre-filled “Ask AI” deep links, attackers and opportunistic vendors can bias an AI assistant’s future answers by steering what it saves to long-term memory.
To reduce risk, audit outbound “Ask AI” URLs for instruction-like query parameters, avoid clicking suspicious memory-manipulation links on corporate accounts, and verify what your assistant has stored using memory audit prompts. With continuous monitoring, you can catch these issues early—before they influence recommendations.
Source: https://thehackernews.com/2026/08/ai-recommendation-poisoning-how-ask-ai.html
