AI recommendation poisoning — hidden prompt injections in 'Summarize with AI' buttons across 31 companies
Date: 2026-02
Affected: AI assistants processing web content — 31 companies, 12+ industries
Attack vector: prompt-injection
Category: research-demonstrated
Severity: High

Microsoft researchers discovered that 'Summarize with AI' buttons on websites contain hidden prompt-injection instructions that poison AI assistant memory. Over 60 days, 50 distinct examples found from 31 companies across 12+ industries. Altered memory influences later answers in unrelated conversations.

Impact: Cross-session manipulation; persistent behavioral modification; memory-based trust exploitation

Mitigations:
Content integrity verification before memory storage
Memory content sanitization
Session isolation for AI memory

Architectural layers (MAESTRO):
label: Data Operations
notes: Hidden instructions embedded in web content processed by AI
role: origin
label: Agent Frameworks
notes: Poisoned content persists in AI assistant memory across sessions
role: propagation