AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory

A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user

This development is consistent with broader industry trends, where threat actors increasingly reuse proven techniques and commodity tooling rather than investing in novel malware.

Beyond patching, organizations should inventory exposed services, disable unused functionality, and require multi-factor authentication wherever it can be deployed.