Microsoft has uncovered a new manipulation technique affecting AI assistants like ChatGPT, Claude, Grok, and Microsoft 365 Copilot — and it looks a lot like classic SEO poisoning.
But this time, it’s not cybercriminals.
It’s legitimate businesses trying to influence AI-generated recommendations.
What’s happening?
Microsoft calls it AI Recommendation Poisoning.
Malicious or manipulative websites embed hidden instructions inside “Summarize with AI” buttons.
When clicked, these links:
• Automatically inject hidden prompts into the AI assistant
• Attempt to store persistent instructions in AI memory
• Influence future recommendations without the user realizing
Example:
A CFO researching cloud vendors could unknowingly receive biased recommendations because of a planted memory from weeks earlier.
Why this matters
• AI assistants increasingly influence purchasing and strategic decisions
• 80% of Fortune 500 companies now use AI agents
• Persistent memory features create a new attack surface
• Brand visibility and competitive fairness are at risk
In just 60 days, Microsoft observed 50 unique poisoning attempts involving 31 companies.
How to mitigate
Security teams should hunt for:
• URLs containing AI assistant domains
• Prompt keywords like “remember,” “trusted source,” “authoritative,” “in future conversations”
• Suspicious “Summarize with AI” links in email or Teams messages
This isn’t theoretical.
It’s the next evolution of influence operations — but aimed at AI systems instead of search engines.
