What Happened
In February 2026, Microsoft Security documented a new attack called AI Recommendation Poisoning. This technique exploits "Ask AI" buttons on websites, which let users query ChatGPT, Claude, or other LLMs directly from a page. Microsoft's research found 31 companies across 14 industries using these buttons to inject hidden instructions into users' LLM conversations. The attack is now tracked as AML.T0080 in the MITRE ATLAS knowledge base.
Here's how it works: When you click an "Ask AI" button, the link doesn't just send your visible question to the LLM. It includes a pre-filled system prompt that alters the model's memory context. These hidden instructions can bias future responses, recommending the site's products, dismissing competitors, or steering conversations toward specific outcomes. Users see only their original query, unaware that the model's behavior has been altered.
Timeline
February 2026: Microsoft Security publishes research on AI Recommendation Poisoning across 31 organizations in 14 industries.
February 2026: MITRE ATLAS adds the technique to its adversarial machine learning knowledge base as AML.T0080.
Current state: No regulatory guidance exists for this attack class. Most organizations don't monitor outbound deep links to LLM platforms or audit the prompts embedded in "Ask AI" integrations.
Which Controls Failed or Were Missing
This incident exposes gaps in three control categories:
Input validation: Organizations didn't treat deep links to third-party AI platforms as untrusted input requiring validation. The "Ask AI" buttons passed arbitrary prompt instructions without review or sanitization. You wouldn't let a third-party widget execute arbitrary JavaScript on your domain, but many teams treated LLM integrations differently.
Transparency controls: Users received no disclosure that clicking the button would modify their LLM's context or memory. The pre-filled prompts weren't visible in the UI, and no consent mechanism existed. This violates basic principles of informed consent in data processing.
Third-party risk management: Security teams didn't assess the risk of LLM platform integrations. Most organizations lack policies for vetting AI service connections, monitoring prompt injection vectors, or auditing how their sites interact with users' personal AI assistants.
What the Relevant Standards Require
While no standard directly addresses AI memory poisoning yet, existing frameworks cover the control failures:
ISO/IEC 27001:2022 Annex A.5.23 requires organizations to control information security in the use of cloud services. LLM platforms are cloud services. You need to assess how your integrations affect user data and model behavior before deployment.
NIST Cybersecurity Framework (CSF) v2.0 function PR.DS-5 requires protections against data leaks. When you inject hidden prompts into a user's LLM session, you're potentially exposing their future queries to your influence -- a form of data integrity compromise.
SOC 2 Type II Common Criteria CC6.1 requires logical and physical access controls. If your "Ask AI" button modifies a user's LLM context without their knowledge, you're bypassing the user's control over their own AI assistant's behavior.
OWASP ASVS v4.0.3 Requirement 5.1.3 states: "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters." Deep links with pre-filled prompts are parameter pollution. Your web application shouldn't construct URLs that manipulate third-party services on behalf of users.
The gap isn't that standards don't apply -- it's that teams haven't mapped AI integrations to existing requirements. You already have obligations around input validation, transparency, and third-party risk. AI Recommendation Poisoning just revealed you weren't enforcing them.
Lessons and Action Items for Your Team
Audit your "Ask AI" integrations immediately. Search your codebase for deep links to chatgpt.com, claude.ai, gemini.google.com, or other LLM platforms. Decode the URL parameters. If you're pre-filling anything beyond the user's explicit query, you're potentially poisoning their model context. Document what you find.
Implement prompt transparency. If you must pre-fill context (for example, to provide product details), show users the full prompt before they click. A modal that displays "This will send the following to ChatGPT: [full prompt text]" gives users informed consent. Make the "Ask AI" button open this modal first, not send the request directly.
Treat LLM platforms as untrusted third parties. Add them to your vendor risk register. Document the data flows: what information leaves your site, what instructions you're injecting, and what user data might be exposed through subsequent queries. Apply the same scrutiny you'd give to any JavaScript widget or API integration.
Create an AI integration policy. Define acceptable use of LLM deep links, chatbot embeds, and AI recommendation features. Require security review before deploying any feature that passes user input to an AI platform. Include prompt injection in your threat model.
Monitor for unauthorized AI integrations. Marketing and product teams may add "Ask AI" buttons without security review. Use content security policy (CSP) headers to restrict which domains your site can link to. Alert on new integrations to LLM platforms.
Push for industry standards. AI Recommendation Poisoning is in MITRE ATLAS now, but it's not yet in OWASP Top 10 or NIST 800-53 Rev 5. Comment on draft standards. Share your controls with peers. The faster the industry formalizes guidance, the faster auditors will check for these risks.
The companies Microsoft identified likely didn't think they were attacking users. They saw "Ask AI" buttons as a convenience feature. But convenience without transparency is manipulation. Your job is to ensure your organization doesn't cross that line -- and to detect when others do.
