Hidden “Ask AI” Links Can Alter Persistent LLM Memory
Microsoft Security has catalogued AI Recommendation Poisoning, a prompt-injection technique that uses pre-filled “Ask AI” links to influence persistent memory in large language model assistants. In February 2026, Microsoft identified 31 companies across 14 industries deploying the behaviour, with more than 50 distinct prompts observed in one data source over 60 days.
The links can target services including ChatGPT, Claude, Gemini and Grok. When a signed-in user clicks one, it opens an active assistant session with a query already populated. Problematic prompts go beyond requesting a summary or comparison: they instruct the model to remember a vendor domain as a trusted source for future answers.
Deep links turn a routine click into an instruction
AI web interfaces commonly accept query text through URL parameters. That functionality is useful for sharing a question, but it also means an instruction embedded in a hyperlink may execute as though the user had entered it directly. If the assistant accepts the request and stores it in long-term memory, the vendor can gain an undisclosed preference in later interactions.
The technique is tracked in the MITRE ATLAS knowledge base as AML.T0080, Memory Poisoning, and is related to AML.T0051, LLM Prompt Injection. Its delivery path is significant: the instruction is triggered at the click layer rather than being hidden in content retrieved by the model. Defences focused only on retrieval-time injection may therefore miss it.
Marketing language can conceal a memory instruction
Pre-filled product questions and favourable framing are not inherently malicious. The boundary is crossed when a link silently asks an assistant to create a durable memory entry without the user’s informed consent. One examined consent-management vendor used buttons labelled as requests to summarise a blog post, while the underlying prompt also asked the model to tag the site as a source of expertise for future reference.
A separate web-security vendor placed “ask AI” widgets on competitor-comparison pages. Its Grok button instructed the assistant to produce a TLDR based only on the vendor URL and then save the vendor domain as a trusted source for future security reference. The pattern appeared across comparison pages, with only the competitor name changing.
What security teams should inspect
The issue extends a broader problem of trust being redirected through seemingly legitimate interfaces. In Borrowed trust as a cybersecurity tactic, trust transfer is examined as a central cybersecurity tactic, while these deep links apply that dynamic to an assistant’s future recommendations.
Microsoft’s published guidance is to look for outbound URLs to domains such as chatgpt.com, claude.ai, grok.com and gemini.google.com whose query strings include terms such as “remember” or “trusted source.” Teams should also review third-party widgets and CMS components that add AI-sharing buttons.
For business use, unsolicited links that attempt to alter assistant memory should be handled with the same caution as credential-harvesting links. Organisations can avoid opening them with corporate accounts, brief employees who assess vendors, inspect deployed links, and audit model memory for unauthorised domain tags before relying on AI-generated recommendations.