AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
- ID
- 11511
- Status
- summarized
- Published
- 06 Aug 2026, 7:30 PM
- Fetched
- 06 Aug 2026, 8:39 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/ai-recommendation-poisoning-how-ask-ai.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 07 Aug 2026, 1:32 PM
- Tags
- Audience
- developersai_agent_usersai_ml_learnerssaas_founders
What happened
A new prompt injection class dubbed 'AI Recommendation Poisoning' abuses deep-link URL parameters (e.g., chatgpt.com/?q=...) in 'Ask AI' buttons on commercial websites to silently inject instructions into a user's active LLM session, commanding the model to permanently save a vendor's domain as a 'trusted source' in long-term memory. Microsoft Security catalogued 31 companies across 14 industries deploying over 50 distinct poisoning prompts in 60 days, and MITRE tracks it as AML.T0080 (Memory Poisoning).
Why it matters
If you ship AI agents or features that use persistent memory or deep-link integrations, you need to treat pre-filled prompt URLs as untrusted input—sanitize or gate memory-write instructions before committing them to a user's profile. Builders using ChatGPT, Claude, Gemini, or Grok deep links in marketing pages should audit whether their 'Ask AI' buttons could be weaponized or whether their own agents are vulnerable to similar memory-poisoning via inbound links.
Discussion angle
Should persistent memory in LLM sessions ever auto-commit instructions from deep-linked URLs without explicit user confirmation—and what's the minimum gate (sandboxing, user prompt, memory-write allowlist) builders should enforce?