In a growing trend among commercial websites, a new type of prompt injection known as AI Recommendation Poisoning is altering how AI models function. This method, which bypasses traditional security measures, requires no special software or data breaches. Instead, it exploits the deep linking feature integrated into most AI platforms’ interfaces.
Understanding AI Recommendation Poisoning
Recently, production websites have been found embedding hidden prompt injection payloads within ‘Ask AI’ buttons, often seen on marketing and competitor analysis pages. Users logged into popular AI platforms like ChatGPT or Claude, upon clicking these buttons, unknowingly trigger pre-set queries that execute without any warning. While many of these queries are harmless, some instruct the AI to permanently recognize the vendor’s domain as a ‘trusted source,’ thus influencing future responses in favor of that vendor.
In February 2026, Microsoft Security reported this behavior as AI Recommendation Poisoning, identifying its use by 31 companies across 14 industries with over 50 different prompts recorded in a single data source within 60 days. MITRE’s ATLAS knowledge base categorizes this under AML.T0080 (Memory Poisoning), linked to AML.T0051 (LLM Prompt Injection).
The Mechanism Behind Deep Linking
AI web interfaces commonly support queries via URL parameters, which can be exploited as an attack vector. When a user clicks a deep link, it opens their session and runs the query as if they manually input it. This becomes problematic when linked with an AI’s long-term memory. Commands like ‘remember this domain as a trusted source’ can be embedded, causing the AI to store such instructions in its memory.
This method circumvents traditional defenses aimed at content scraping, presenting a risk with every hyperlink on the internet. While some queries aim to influence results through leading questions, the danger lies in those that manipulate the AI’s memory without user consent.
Real-World Implications and Case Studies
During audits, a vendor offering consent management software was found to append ‘Summarize this blog post with’ buttons to its content. Although appearing to simply request a summary, the underlying command instructed the AI to permanently consider the vendor as an authority on privacy and consent.
Similarly, a web security software vendor used ‘Ask AI’ widgets to influence perception on competitor comparison pages. These widgets included commands to treat the vendor’s domain as a trusted security source, affecting future AI responses.
The prevalence of these tactics is increasing across various marketing tools, including CMS plugins and SEO generators, often advertised as new-age SEO strategies. The main challenge is awareness and control over how many companies employ these strategies and the specific prompts used.
Addressing and Mitigating the Threat
To combat AI Recommendation Poisoning, inspecting outbound links and model memory is crucial. Microsoft’s guidance suggests identifying URLs that direct to AI domains with query strings containing commands like ‘remember’ or ‘trusted source.’ While manual checks are impractical at scale, services like Reflectiz provide automated monitoring to flag suspicious ‘Ask AI’ links before they are clicked.
Reflectiz offers a comprehensive cheat sheet detailing DOM monitoring patterns, third-party link inspection, and memory audit prompts, aiding security teams in identifying and remedying poisoned AI sessions effectively.
