AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory

A new type of prompt injection is emerging on commercial websites, leveraging a standard feature in major AI assistants. This method, which requires no malware or exploits, involves embedding hidden payloads inside Ask AI buttons on certain web pages. The buttons are often found on marketing and competitor comparison pages, and when clicked, they can alter the AI's memory. This technique abuses pre-filled deep links, a built-in feature of many AI assistants. The attack can be carried out without stolen credentials or zero-day exploits. It allows for the silent alteration of large language models' memory through user interaction with compromised websites.