Prompt injection attacks target AI recommendation buttons and LLM memory

Cybercriminals are exploiting a new class of prompt‑injection techniques that embed hidden instructions in web pages and in "Ask AI" buttons. The hidden directives can cause large language models (LLMs) to recommend malicious links, request personal data, or mark a domain as a trusted source for future queries. Microsoft Security has identified 31 companies across 14 sectors that were targeted by these "AI Recommendation Poisoning" attacks, which manipulate the persistent memory of LLMs via deep‑link URL parameters. The attacks bypass traditional defenses that monitor content before it is fed to the model, allowing the malicious prompt to execute immediately when a user clicks the button. Experts advise users to avoid following AI‑generated links, verify URLs directly, and refrain from entering credentials on pages suggested by AI responses.