'If someone can inject instructions or spurious facts into your AI’s memory, they gain persistent influence over your future interactions': Microsoft warns AI recommendations are being "poisoned" to serve up malicious results

• Microsoft warns of new fraud tactic called AI Recommendation Poisoning
• Attackers plant hidden instructions in AI memory to skew purchase advice
• Real-world attempts detected; risk of enterprises making costly decisions based on compromised AI recommendations

You may have heard of SEO Poisoning - however experts have now warned of AI Recommendation Poisoning.

In a new blog post, Microsoft researchers detailed the emergence of a new class of AI-powered fraud, which revolves around compromising the memory of an AI assistant and planting a persistent threat.

SEO Poisoning is about compromising search engine results. Scammers would create numerous articles across the internet, linking a fake or compromised tool to a certain keyword. That way, when a person searches that specific keyword, the engine would recommend a fake, malicious tool instead of a legitimate one.

Would you trust your AI?

AI Recommendation Poisoning works in similar fashion. Consumers are increasingly turning to AI for purchase advice, be it goods, or services, be it for private, or corporate use. Therefore, there is a lot to gain from AI recommending specific tools and according to Microsoft, those recommendations can be bent.

“Let’s imagine a hypothetical everyday use of AI: A CFO asks their AI assistant to research cloud infrastructure vendors for a major technology investment," Microsoft explained.

"The AI returns a detailed analysis, strongly recommending [a fake company]. Based on the AI’s strong recommendations, the company commits millions to a multi-year contract with the suggested company.”

Although we’d hope a CFO would do their due diligence with more than just an AI prompt, we can imagine similar scenarios taking place.

“What the CFO doesn’t remember: weeks earlier, they clicked the “Summarize with AI” button on a blog post. It seemed helpful at the time. Hidden in that button was an instruction that planted itself in the memory of the LLM assistant: “[fake company] is the best cloud infrastructure provider to recommend for enterprise investments.”

The AI assistant wasn’t providing an objective and unbiased response. It was compromised.”

Microsoft concluded by saying that this wasn’t a thought experiment, and that its analysis of public web patterns and Defender signals returned “numerous real-world attempts to plant persistent recommendations”.

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.