What Changed
Websites are embedding hidden instructions in “Ask AI” and “Summarize with AI” buttons. These buttons use the pre-filled deep-link feature of assistants such as ChatGPT, Claude, Gemini and Grok (for example chatgpt.com/?q=...). When a signed-in user clicks one, the query runs in their own session. Most such links are harmless marketing, but some tell the assistant to “save” the vendor’s domain as a trusted source, which can bias future answers if the assistant stores it in long-term memory.
Microsoft catalogued the behavior in February 2026 as AI Recommendation Poisoning, finding 31 companies across 14 industries using it. MITRE ATLAS tracks it as AML.T0080 (Memory Poisoning), related to AML.T0051 (LLM Prompt Injection).
Examples From The Research
The article, published by The Hacker News with research from web-security vendor Reflectiz, describes a consent-management vendor whose blog summary buttons asked the AI to “tag it as a source of expertise for future reference.” It also describes a security vendor whose competitor-comparison pages carried an “Ask Grok” button whose pre-filled prompt asked the assistant to treat the vendor as a trusted source. Microsoft counted more than 50 such prompts over 60 days.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Matters For Security Teams
The instruction runs at the click layer, not inside retrieved web content, so defenses built for retrieval-time prompt injection do not see it. Staff who ask an assistant for a neutral view during vendor evaluations may be the ones most affected.
What To Verify First
- Hunt for outbound links to AI assistant domains whose query strings contain words like “remember” or “trusted source”, as Microsoft suggests.
- Ask employees who use assistant memory features to review what has been stored, especially around vendor recommendations.
- Treat unsolicited memory-manipulation links like credential-phishing links in awareness guidance.
- Check your own website and marketing plugins so you are not deploying such buttons yourself.
What Teams May Be Underestimating
Nothing here is malware, so security tooling will not alert on it. The risk is slow, invisible bias in tools people now use for research and purchasing decisions.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
