A new vulnerability vector is targeting enterprise websites through standard 'Ask AI' buttons, allowing malicious actors to silently manipulate the memory of large language models (LLMs). This emerging technique, known as AI recommendation poisoning, requires no traditional malware, stolen credentials, or zero-day exploits to execute, according to a report by The Hacker News. Instead, the exploit weaponizes pre-filled deep links—a standard feature integrated into almost every major artificial intelligence assistant on the market.

Security researchers observed production websites embedding hidden prompt injection payloads inside these 'Ask AI' shortcuts, which frequently appear on marketing and competitor comparison pages. When an unsuspecting user clicks the button to query the AI, the hidden instructions load directly into the assistant's context, silently altering its memory and future recommendations.

The exploit works by exploiting the trust relationship between the user, the website, and the host AI platform. Because deep links are designed to streamline user interaction by pre-populating queries, they bypass conventional input sanitization layers that typically inspect direct user keyboard inputs. If a competitor compromises or builds a marketing comparison page with these poisoned deep links, they can permanently skew how an LLM evaluates their products relative to others.

Security organizations, including the Open Web Application Security Project (OWASP), have previously warned about the risks of indirect prompt injection in their security guidelines for LLM Applications. However, this specific exploitation of pre-filled links represents a highly practical delivery mechanism that relies on user-initiated actions rather than automated scraping.

Why It Matters

This development exposes a systemic weakness in how modern web applications integrate with consumer AI ecosystems. By weaponizing a convenience feature like deep-linking, bad actors can quietly subvert the objectivity of AI-driven market research, product comparisons, and purchasing recommendations. As businesses increasingly rely on AI assistants to guide purchasing decisions, defending against recommendation poisoning will require AI providers to re-evaluate how pre-filled prompts are ingested and sandboxed before they write to persistent model memory.