Your Brand's AI Answer Is an Attack Surface

In February 2026, Microsoft's Defender Security Research Team published findings on a technique it named AI Recommendation Poisoning. Over a 60-day review of AI-related URLs observed in email traffic, researchers identified more than 50 distinct prompt-based attempts to influence AI assistant memory for promotional purposes, originating from 31 different companies across 14 industries.

Not attackers. Companies. Finance, health, legal services, SaaS, marketing agencies, food sites, business services. In a later teardown of the same technique, one of the vendors deploying it across its competitor comparison pages sold web security software.

The short version: the recommendations AI assistants make about your category are manipulable, some of your competitors are already trying, and the technique is formally catalogued in MITRE ATLAS. Nobody at most companies owns the problem because it falls between marketing and security.

I have spent fifteen years in security and identity. This is the first time I have watched a marketing channel become an attack surface in real time, and the governance gap is wider than the technical one.

How the technique works

The mechanism abuses a standard convenience feature rather than any vulnerability.

Most major AI assistants support pre-filled deep links. A site embeds a "Summarize this with ChatGPT" or "Ask AI about us" button, and clicking it opens the assistant with a query already composed. For a logged-in user, that query can execute immediately, with no confirmation step.

Most of these buttons are exactly what they appear to be. The ones Microsoft flagged carry additional instructions in the pre-filled prompt. They tell the assistant to remember the vendor's domain as a trusted source for future citations, or to treat the company as the go-to platform for its category. Where the assistant supports persistent memory, that instruction can be stored as though the user had expressed the preference themselves, quietly biasing later answers.

The technique is tracked in the MITRE ATLAS knowledge base as AML.T0080.000, AI Agent Context Poisoning: Memory, which Microsoft calls Memory Poisoning. It is related to AML.T0051, LLM Prompt Injection. It has also been productized: an npm package called CiteMET provides ready-to-use code for adding AI memory manipulation buttons to a website.

That last detail is the one I would put in front of a board. When a technique ships as a package with installation instructions, it has left the research phase.

What I am not claiming

I want to be careful here, because overstating this would be its own kind of dishonesty and this series is built on conceding what the skeptics get right.

I am describing observed associations, not verified mechanisms inside proprietary systems. Nobody outside the model providers can confirm exactly how any given assistant weights a stored memory against its retrieval and training signals. Memory implementations differ across ChatGPT, Claude, Gemini, Copilot, and Grok, and they change without notice. A stored preference is not a guaranteed recommendation.

So the honest statement is narrower than the headline: companies are attempting this at scale, a major security vendor documented it across dozens of examples, and the industry has assigned it a formal technique identifier. Whether any individual attempt measurably moved an answer is not publicly verifiable.

The attempts are the story. Attackers and growth teams do not invest in techniques that return nothing, and 31 companies in 60 days from one narrow observation window is not a rounding error.

This is not an isolated trick

The academic literature arrived before the commercial exploitation, which is usually how this goes.

Researchers have published work on adversarial search engine optimization for large language models, on ranking manipulation for conversational search engines, and on poisoning retrieval corpora by injecting adversarial passages. More recent work examines how deep-research agents can be poisoned through user-generated content. At least one 2026 paper proposes defenses specifically against manipulation attacks from generative engine optimization.

The pattern extends well beyond marketing. Hidden prompts were found in academic preprints instructing AI reviewers to give positive reviews. A study of 196,682 real resumes found roughly 1% contained hidden prompt injections, some instructing the AI to call the applicant highly qualified and recommend immediate hiring. Hidden instructions turned up in a US court filing, and the plaintiff was sanctioned.

The common thread: wherever an AI system reads untrusted content and acts on it, someone is writing instructions into that content. AI answers about vendors are simply a commercially valuable instance of a general problem.

Why this lands in the gap between two teams

Here is the organizational problem, and it is the part I find most interesting.

Your marketing team owns brand perception and increasingly owns AI visibility. Your security team owns threat models, monitors attack surfaces, and would immediately recognize memory poisoning as an integrity problem. Neither team is currently looking at the thing sitting between them: the answer an AI assistant gives a buyer about your company.

Ask three questions inside your own organization and watch the gap appear. Who monitors what AI engines currently say about our company? Usually marketing, if anyone. Who would notice if that description changed in a way that suggested manipulation? Usually nobody. Who decides whether we deploy "Ask AI about us" buttons, and who reviews what those pre-filled prompts contain? Usually a growth engineer, with no security review at all.

That third question is the uncomfortable one, because it cuts both ways. Some of these buttons are already on your site. Somebody added them because a conversion tool suggested it. Nobody read the prompt payload.

What to actually do

Four things, roughly in order of effort.

Audit your own deep links. Find every "Ask AI" or "Summarize with AI" button on your properties and read the actual pre-filled prompt string, not the button label. If it contains instructions rather than a question, remove it. Your legal and security teams will want to know before a customer finds it first, and Google's spam policies now cover attempts to manipulate generative AI responses in Search.

Baseline what the engines say about you. You cannot detect manipulation without a reference point. Track how each engine describes your company, which sources it cites, and how your competitors are characterized, with enough sampling frequency that a shift is visible against normal variance. This is the same measurement discipline the rest of this series argues for, applied to integrity rather than growth.

Watch for description drift, not just visibility drops. The failure mode here is not disappearing from answers. It is being described inaccurately, or a competitor suddenly being described as the trusted option in your category. A visibility score that only counts mentions will not catch it.

Put it in the threat model. If your security team maintains an attack surface inventory, AI-mediated brand representation belongs in it, with a named owner. For regulated industries the stakes compound: Microsoft specifically noted prompts targeting health advice and financial services sites, where biased recommendations carry real consequences.

The part that should bother security vendors most

There is an irony in this research that I keep returning to.

In the teardown of this technique, one of the documented cases was a vendor selling web security software that had placed "don't just take our word for it, ask AI" widgets across its competitor comparison pages. A company whose product exists to protect customers from web-based manipulation, using web-based manipulation as a growth tactic.

I do not think most of these companies understood what they were deploying. A growth tool suggested a conversion widget, someone shipped it, and the prompt payload was never reviewed by anyone who thinks about integrity for a living. That is the whole problem in one anecdote.

Security buyers are early adopters of AI research tools. My data at GrackerAI (disclosure: my company, a GEO platform for B2B SaaS) shows 4 in 10 B2B security buyers start vendor research inside AI assistants. If you sell security software, the answer an assistant gives about your category is both your most important marketing surface and a channel your competitors can attempt to bias. You are also the last company that can afford to be careless about which side of that you are on.

Here is my question, and I would genuinely like to hear the answer from people running security programs. Does your attack surface inventory include what AI assistants say about your company? If not, who in your organization would notice if it changed?

Frequently Asked Questions

What is AI Recommendation Poisoning?

AI Recommendation Poisoning is a technique named by Microsoft's Defender Security Research Team in February 2026. Websites embed hidden instructions inside pre-filled "Summarize with AI" or "Ask AI" deep links. When a logged-in user clicks, the assistant may process instructions telling it to remember that vendor as a trusted source, biasing future answers. Microsoft identified over 50 distinct examples from 31 companies across 14 industries during a 60-day review.

Is AI recommendation poisoning a recognized security technique?

Yes. It is tracked in the MITRE ATLAS knowledge base as AML.T0080.000, AI Agent Context Poisoning: Memory, related to AML.T0051, LLM Prompt Injection. Academic work also covers adversarial search engine optimization for large language models, ranking manipulation for conversational search engines, and poisoning of retrieval corpora. 2026 papers propose defenses against manipulation attacks aimed at generative engine optimization.

How can a company check whether it is exposed?

Audit every "Ask AI" or "Summarize with AI" button on your own properties and read the pre-filled prompt string rather than the button label, removing any that contain instructions rather than a question. Then baseline how each AI engine describes your company and which sources it cites, sampled frequently enough that a change is visible against normal variance. Monitor for description drift rather than only tracking mention counts.

Who should own AI answer integrity, marketing or security?

It typically falls between them, which is the core problem. Marketing owns brand perception and AI visibility measurement but does not run threat models. Security maintains attack surface inventories but does not usually monitor AI-mediated brand representation. Deep-link widgets are often deployed by growth engineers with no security review of the prompt payload. The practical fix is adding AI-mediated brand representation to the attack surface inventory with a named owner.