What Happened
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user
Why It Matters
The report describes hidden prompt injection payloads embedded in "Ask AI" or similar deep-link buttons on websites, which can auto-execute in major AI assistants and attempt to write persistent instructions into assistant memory. Microsoft’s guidance characterizes this as AI recommendation poisoning / memory poisoning via URL prompt parameters, where attacker-supplied instructions like "remember" or "trusted source" bias future answers.[1][3][4] RealGround analysis: this is best treated as an indirect prompt injection risk because the malicious instruction is delivered through content a user clicks or processes, so organizations should audit outbound AI links, validate prompt parameters, and red-team any assistant flows that accept pre-filled prompts.
RealGround Analysis
This signal maps to indirect prompt injection. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/08/ai-recommendation-poisoning-how-ask-ai.html