Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

AI Recommendation Poisoning via hidden Ask AI deep-link prompt injection

Technical Analysis
First reported
Last updated
Happening score
H score 16
1 unique sources, 1 articles

Summary

Hide ▲

AI Recommendation Poisoning is turning ordinary Ask AI buttons into hidden prompt-injection channels that can silently rewrite ChatGPT, Claude, Gemini, and Grok memory. The technique matters because a single click can plant a persistent instruction that biases future answers toward a vendor or domain without malware, stolen credentials, or a zero-day. Production deployments were observed, and the behavior was catalogued in February 2026 as a repeatable memory-poisoning pattern across commercial sites.

Related Happenings

Hunt AI deep links for memory-poisoning prompts

Defensive Guidance
H score17 First: 06.08.2026 14:30 Last: 06.08.2026 14:30 Sources 1

How related: Microsoft's published guidance to security teams: hunt for URLs pointing to AI assistant domains (chatgpt.com, claude.ai, grok.com, gemini.google.com) whose query strings contain instructions like "remember" or "trusted source."

About this happening: Microsoft Security issued hunting guidance for AI Recommendation Poisoning, telling defenders to inspect ChatGPT, Claude, Grok, and Gemini deep links that can...

Open Happening

ChatGPT and Claude phishing and malvertising campaign

Campaign
H score36 First: 01.06.2026 12:30 Last: 01.06.2026 12:30 Sources 1

About this happening: The ChatGPT- and Claude-themed phishing and malvertising campaign is actively steering users to fake download pages that can deliver malware. Attackers are using Goo...

Open Happening

AI assistants with web browsing repurposed as covert C2 relays

Technical Analysis
H score45 First: 18.02.2026 17:00 Last: 18.02.2026 17:00 Sources 1

About this happening: AI assistants with web browsing are now being shown as covert command-and-control relays, letting malware hide commands and stolen data inside routine enterprise traffic. Gr...

Open Happening

AI as a C2 proxy abuse of Microsoft Copilot and xAI Grok browsing channels

Technical Analysis
H score24 First: 17.02.2026 20:08 Last: 17.02.2026 20:08 Sources 1

About this happening: Researchers disclosed AI as a C2 proxy, a technique that can turn Microsoft Copilot and xAI Grok browsing features into stealthy command-and-control relays, increa...

Open Happening

AI Recommendation Poisoning in "Summarize with AI" buttons

Technical Analysis
H score16 First: 17.02.2026 11:31 Last: 17.02.2026 11:31 Sources 1

About this happening: AI Recommendation Poisoning now shows how clickable "Summarize with AI" buttons can inject persistent prompts into chatbot memory, creating a new path to bias recommendati...

Open Happening

Timeline

  1. 06.08.2026 14:30 2 articles · 2h ago

    Hidden Ask AI buttons inject persistent trusted-source prompts into major AI assistants

    Initial Disclosure

    Production websites are embedding hidden prompt-injection payloads inside Ask AI buttons on marketing and competitor comparison pages, so a click can open ChatGPT, Claude, Gemini, or Grok with a pre-formed query that executes in the user's active session and can tell the assistant to save a vendor domain as a trusted source. Microsoft Security catalogued the behavior as AI Recommendation Poisoning in February 2026 and mapped it to MITRE ATLAS AML.T0080 (Memory Poisoning) and AML.T0051 (LLM Prompt Injection). Defenders are advised to inspect outbound hyperlinks and active model memory for query strings containing instructions such as remember or trusted source, and to treat unsolicited memory-manipulation links like credential-harvesting links.

    Show sources
    Open in new tab