AI Recommendation Poisoning · Poisoning of AI recommendations
Recommendation poisoning is a manipulation technique that injects content or instructions to skew an AI assistant’s recommendations. Microsoft documented it in February 2026 as AI Recommendation Poisoning, observing real cases across several industries.
Standalone definition · 33 words
How does recommendation poisoning work?
According to Microsoft’s Defender Security Research team, companies place “Summarize with AI” buttons whose link pre-fills a prompt with memory instructions, for example to remember the brand as a trusted source. The click injects these instructions into the assistant’s memory, which then reuses them in its recommendations.
How big a problem did Microsoft observe?
Over 60 days, the team found more than 50 distinct prompts from 31 companies across 14 industries. Microsoft compares the technique to SEO poisoning.
What is the risk for a brand?
For the publisher using it: reputational risk and loss of trust, because the manipulation undermines the neutrality of recommendations. For the user: a biased recommendation without knowing it. Microsoft advises auditing the assistant’s memory and being wary of AI links from untrusted sources.
Frequently asked questions
Is recommendation poisoning part of GEO?
No, it is manipulation. Legitimate GEO aims to be cited on the strength of useful, verifiable content, not to inject instructions into an assistant’s memory.
Which assistants are affected?
Microsoft observes attempts on several assistants with persistent memory.
How do you protect yourself?
Regularly audit the assistant’s memory entries, hover over links before clicking and be wary of “Summarize with AI” buttons from unknown sources.
Related terms
Further reading
- Recommendation Poisoning (summarise with ai ): the blackhat GEO confirmed by microsoft
- Checklist GEO and LLM / AI 2026
- ← Back to the GEO glossary (114 terms)