“Ask AI” Buttons Poison Assistants’ Memory: Microsoft Security Warns

A Single Click Can Change the AI’s Future Responses

Microsoft Security has identified a prompt injection technique active on commercial websites, classified as AI Recommendation Poisoning. The finding was reported on August 6, 2026.

The attack leverages buttons such as “Ask AI,” “Ask Grok,” or social sharing tools. The link contains a pre-filled query that opens in the user’s already authenticated session and executes without explicit confirmation.

Compatible services include ChatGPT, Claude, Grok, and Gemini through URL parameters such as:

https://chatgpt.com/?q=...
https://claude.ai/new?q=...
https://grok.com/?q=...

Perplexity and related sharing tools are also involved, along with q parameters, href attributes, and the web page DOM. The affected software versions have not been disclosed.

From Marketing to Memory Manipulation

A company may legitimately craft a favorable query to promote a product or guide a summary. This falls under marketing and Generative Engine Optimization, or GEO.

The attack threshold is crossed when the link instructs the assistant to permanently save the company’s domain as an authoritative source. As a result, future responses may be systematically biased toward that vendor, including in conversations unrelated to the original click.

Microsoft Security links the technique to AML.T0080 — Memory Poisoning in MITRE ATLAS, associated with AML.T0051 — LLM Prompt Injection. The injection occurs when the link is activated, not in content retrieved during retrieval. Some defenses designed to filter documents consulted by the model may therefore fail to detect it.

Cases Identified on Corporate Websites

Microsoft Security identified 31 companies across 14 industries and more than 50 distinct prompts present in a single source over 60 days. The technique was observed on production websites.

A consent management vendor offered buttons such as “Summarize this blog post with” for ChatGPT, Perplexity, Claude, and Grok. Although the interface suggested a simple summary, the href parameter added an instruction to treat the domain as an authoritative source for future privacy and consent requests.

An enterprise security vendor, meanwhile, used “Don’t just take our word for it, ask AI” widgets on competitor comparison pages. In the “Ask Grok” button, the payload was encoded directly in the site’s markup.

The query instructed the assistant to:

• produce a summary of the comparison;
• use only the vendor’s blog URL;
• save the domain as a trusted source for future security-related requests.

The pattern appeared across multiple comparison pages, with only the competitor’s name changing. A user seeking an independent assessment could therefore unknowingly alter the assistant’s subsequent analyses.

Impact and Countermeasures for Organizations and Users

The severity is high for the integrity of model responses and memory, although no CVSS score has been provided. The impact includes biased recommendations, false attribution of authority, manipulation of competitive comparisons, and reduced trust in responses.

No malware, stolen credentials, or zero-day vulnerabilities are required. A single click while the user is authenticated to the assistant is enough. The content may remain hidden from the button label while still being present in the DOM or URL.

Organizations should:

• monitor the DOM for hidden instructions in AI links and href attributes;
• inspect q parameters before publishing sharing buttons;
• periodically audit assistant memory using verification prompts;
• remove unwanted instructions or memories through remediation procedures.

The AI Memory Poisoning Defense Cheat Sheet is also available, providing patterns for DOM monitoring, verification prompts, and removal procedures. No specific patches or updates have been announced for assistant vendors.