AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
Summary
A new class of prompt injection attacks, termed "AI Recommendation Poisoning," is affecting commercial websites by abusing pre-filled deep links within "Ask AI" buttons. These attacks do not require malware, stolen credentials, or zero-day exploits, instead silently altering Large Language Model (LLM) memory through standard website features.
IFF Assessment
This vulnerability allows attackers to manipulate AI model behavior and memory through user interaction with standard website features, posing a risk to data integrity and AI functionality.
Defender Context
Defenders need to be aware of this new prompt injection technique that leverages pre-filled deep links. It highlights the need for robust input validation and sanitization for any AI features integrated into websites, especially those that interact with LLMs or maintain user-specific memory.