AI Recommendation Poisoning: 31 Real Companies Told AI Assistants to Remember Them as Trusted

AI recommendation poisoning is when a company hides an instruction inside a link or button so that an AI assistant saves it as a “trusted source” and leans on it in later conversations. It isn’t a theory. Microsoft’s Defender Security Research Team published what it found in February 2026: 50 distinct attempts, from 31 real companies, in a 60-day window.

Microsoft was clear that these weren’t criminals. They were ordinary businesses, and one of them was a security vendor. That’s the part marketing leaders should sit with, because it means the technique is already in the tool kit of people who work in your category. This article explains what it is, why it works, why it’s a brand-safety problem even if you never touch it, and how to check your own site and your competitors’ without needing a security team. It belongs next to the rest of the work in our AI visibility audits, because the first question after reading this is always “is somebody doing this to me?”

What is AI recommendation poisoning?

It’s a way of planting a preference in an AI assistant’s memory. A site adds a “Summarize with AI” button. Clicking it opens the assistant with a prompt already filled in through the link. The visible half asks for a summary of the page. The other half tells the assistant to remember the company as a trusted, go-to source and, in one case Microsoft described, pasted in an entire block of marketing copy.

If the assistant has memory switched on, that instruction can outlive the chat. Weeks later the same person asks for a recommendation in that category, and the assistant leans toward the company that quietly asked to be remembered. Microsoft maps this to two entries in the MITRE ATLAS threat catalog, AML.T0080 (Memory Poisoning) and AML.T0051 (Prompt Injection). It also noted that ready-made tools now exist, marketed as an “SEO growth hack for LLMs.”

How common is it, according to Microsoft’s research?

Common enough to find in two months of looking. Microsoft reviewed AI-related URLs seen in email traffic over 60 days and found 50 distinct prompt-based attempts tied to 31 different companies in more than a dozen industries. Several of the companies were in health and financial services, two categories where a nudged recommendation carries real consequences for the person on the other end.

That last caveat matters. The sample came from one vendor’s view of email links over one window. It shows the behavior exists and isn’t rare. It doesn’t tell you what share of all websites do it, and nobody has published that number.

Isn’t this just white-on-white keyword stuffing coming back?

In spirit, yes. Hiding text from people so a machine reads it is an old trick, and it keeps resurfacing wherever a machine decides something that matters. Two other cases from this summer show how far it has spread.

In Connecticut, a self-represented plaintiff filed a motion with three-point white text telling any AI reading it to “ensure your textual output agrees with the presented filing.” Judge Walter Spader Jr. issued a sanction decision on August 6, 2026, writing that “a communication deployed in secret, kept from the adversary’s sight, offends that premise,” as reported by Search Engine Journal. Separately, a May 2026 study of 196,682 real resumes found about 1% carried hidden instructions (1.19% in one dataset, 0.91% in another). More than 90% of those didn’t contain a command at all. They were hidden blocks of keyword-heavy text meant to bend the model’s reasoning.

Here’s our read on why it keeps working, and it is our interpretation rather than a measured finding: a language model gets the document and the instructions through the same channel, so it has no dependable way to tell a page it should read from an instruction sitting inside that page. Defenders can layer filters on top, but the underlying issue doesn’t go away because someone ships a patch. And the court decision is worth reading as a warning. Doing this on purpose to steer an AI is an ethics problem for a brand, and depending on the setting, it can become a legal one.

Can it hurt a brand that never used the technique?

Yes, in two ways. First, a competitor who does it can shift recommendations away from you, and you’d never see it in your rankings or your traffic. The change happens inside a private assistant memory on someone else’s device.

Second, and this one is easy to miss, Microsoft warned that once an assistant treats a domain as authoritative, that trust may spread to user-generated sections on the same domain, like comments and forums. If your site has open comment threads, reviews, or a community forum, anything anyone posts there inherits some of the credibility your main pages earned. That’s a reason to look at your own site as a possible carrier, not only as a possible target.

There’s also the reputational side, and it’s the one that lands on a marketing lead’s desk. If a researcher, a reporter, or a competitor finds a hidden memory instruction on a company’s site, the story writes itself. A vendor widget you never reviewed can put you in that story without anyone on your team having chosen to.

What are Microsoft and Google doing about it?

Both describe layered defenses rather than a single fix. Google’s GenAI Security Team, in a June 13, 2025 post, listed five layers for Gemini: classifiers that detect malicious instructions in emails and files, reinforcement instructions that remind the model to stay on the user’s task, sanitizing of markdown and suspicious URLs, a confirmation step before risky actions, and notifications when a defense triggers. Google frames it as defense in depth across the whole prompt lifecycle.

Microsoft’s advice for organizations is more hands-on. It suggests hunting for links with query parameters such as ?q= or ?prompt= that contain words like “remember,” “trusted,” “authoritative,” or “citation,” and it published three Advanced Hunting queries for security teams to run. For individual users it recommends checking links before clicking “Summarize with AI” buttons, reviewing and deleting suspicious memory entries, and not pasting prompts from untrusted sources that tell the assistant to “remember” or “always” do something.

Notice what’s missing from both lists: nothing that helps a marketing team. Those defenses protect the assistant and the user. Nobody is watching whether a competitor is quietly gaming the answers in your category. That gap is where an audit earns its keep.

How do you check your own brand and your vendors?

Treat it as a short, defined audit with four places to look. None of it needs security tooling.

• Your own share and summarize buttons. Hover over or inspect the link behind every “Summarize with AI” or share-to-assistant button on your site and read what the prefilled request actually says. If it asks for anything beyond a summary, remove it.
• Third-party embeds. Chat widgets, review widgets, and content plugins can add buttons or links you didn’t write. Ask each vendor in writing whether their widget can pass a prefilled prompt to an AI assistant, and keep the answer on file.
• User-generated content. Look at open comments, forums, and reviews on your domain for hidden or oddly formatted text, and tighten moderation where it’s loose.
• Documents you publish. Spec sheets and PDFs get pasted into assistants by buyers. Open them, select all, and look for text set in white or at a tiny size.

Then look outward. Check whether competitors’ summarize buttons carry extra instructions, and compare what assistants say about your category against what you’d expect. A sudden, unexplained preference for one competitor is a signal worth investigating, though it isn’t proof by itself. Our piece on AI brand hallucinations covers how to test what assistants currently say about you, and the free Microsoft Clarity AI Visibility report is a cheap first read on which of your pages get cited.