A new attack vector exploits "Ask AI" buttons embedded across commercial websites to inject malicious prompts into large language models without requiring malware, credential theft, or zero-day vulnerabilities. Security researchers identified production websites hiding prompt injection payloads inside these buttons, which use pre-filled deep links to automatically populate LLM conversation contexts.
The attack works by embedding malicious instructions within the URLs behind "Ask AI" functionality. When users click these buttons, the injected prompts execute silently, poisoning the model's responses without detection. The attacker gains influence over what the AI recommends, believes, or outputs to the user, effectively corrupting the LLM's "memory" for that session.
This technique requires no technical sophistication from attackers. It leverages standard browser functionality and the trust users place in AI assistance features deployed by legitimate brands. Marketing pages and competitor comparison sites present ideal targets, as they already contain calls-to-action prompting users to seek AI opinions.
The risk extends beyond individual users. Enterprises deploying internal AI assistants face poisoning of their own systems if employees interact with compromised external links. E-commerce platforms could see product recommendations skewed toward competitors. Customer service chatbots could deliver fabricated information about policies or pricing. Financial advisory systems could deliver biased guidance.
Organizations relying on AI for decision support lack straightforward defenses. Traditional content security policies do not catch prompt injection. Most LLM providers do not sanitize deep link parameters. Rate limiting offers partial protection but fails against low-volume, targeted attacks.
The problem stems from treating LLM inputs as trusted data when they originate from user-controllable sources. Deep links, in particular, bypass the visual inspection users normally perform before interacting with AI systems. Users cannot easily distinguish a poisoned prompt from a legitimate one, as both produce natural-looking responses.
Mitigation requires