Microsoft finds promotional instructions inside AI-summary links

Microsoft reported on 10 February that some AI-summary buttons embedded instructions intended to influence an assistant’s memory and future recommendations. Researchers described more than 50 distinct prompts associated with 31 companies across 14 industries. The account calls this recommendation poisoning. Those counts concern the observed prompts and companies, not confirmed successful compromises.

The reported aim was to make an assistant prefer a particular company later, after the original page had disappeared from the conversation. Microsoft said mitigations were evolving and that some previously reported behaviours could no longer be reproduced. The security question is therefore whether an assistant treats content encountered during research as an instruction to change persistent preferences. A convenient summary button is still an external source of input.