Executive Summary
Websites are embedding hidden prompt injection in 'Ask AI' buttons that use pre-filled deep links to AI assistants, silently altering the assistant's memory to favour the site in future recommendations.
What Happened
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user
Vulnerability / Attack Technique
Recommendation poisoning via pre-filled assistant deep links
Technical Mechanism
Clicking the button opens the assistant with a pre-filled prompt containing hidden instructions to store biased memories, affecting later answers.
AI Security Category
LLM04:2025 Data and Model Poisoning
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Assistant memory is becoming a marketing target. RealGround analysis: users and companies should review what assistants have remembered, and assistants should confirm memory writes.
Recommended Controls
- Review and clear AI assistant memories periodically
- Require confirmation before assistants save memories from links
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/ai-recommendation-poisoning-how-ask-ai.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.