AI Recommendation Poisoning: Ask-AI web links silently write trusted-source into assistant memory

An 'Ask AI' button quietly plants a permanent 'trusted source' rule in your assistant's memory

A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys

A support email hides instructions — and the assistant obeys them

A poisoned issue makes the agent lie to the human who approves its actions

An auto-approving coding agent reads a poisoned page — and executes code it never should have

A fake Sentry error report hijacks a developer's coding agent into running a shell command

The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten

A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later

A planted 'standing goal' copies itself agent-to-agent through the team's shared config files

A shopping page tells the agent to do something the user never asked for

One click provisions an attacker-configured agent inside your own workspace

An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence

A single poisoned document plants a standing instruction that survives every reset

Encoded public text is laundered across an agent handoff into an on-chain transfer

A screenshot that's harmless at full size becomes an order once the system shrinks it

The eval gate that was supposed to catch the agent is itself the thing being attacked

A poisoned web page hijacks a research agent — and the planner acts on its behalf

A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'

An inbox summary quietly ships a secret to an attacker's server