{"schema_version":"0.8.0","id":"LR-2026-0115","record_version":3,"title":"Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-03","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-03","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend. Over 60 days, researchers reviewing AI-related URLs in email traffic identified 50 distinct examples of prompt-based attempts to influence AI assistant memory, coming from 31 different companies across more than a dozen industries. Microsoft said the effectiveness and persistence of these prompts varied between AI assistants and over time as persistence mechanisms and protections changed. Microsoft described memory poisoning through cross-domain prompt injection seeding persistent memory after a single successful injection, allowing the effect to propagate across subsequent sessions, and outlined memory security controls for Microsoft 365 Copilot including sanitization checks, prompt-injection classifiers, Task Adherence checks, tenant isolation, Customer Lockbox, encryption at rest and audit logging.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate: no cited fact meets a rung's test; the tier is inferred.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.analyticsinsight.net/amp/story/cryptocurrency-analytics-insight/spotex-crypto-exchange-proof-of-reserves-listings-and-key-features","publisher":"news search (Google News index)","date":"2026-10-03","type":"press","title":"SpotEx Crypto Exchange: Proof of Reserves, Listings and Key Features","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_disclosed":"A","event.trigger":"C","event.detection_method":"D","event.incident_class":"D","event.summary":"D","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend."},{"source_index":0,"quote":"One of the key risks is memory poisoning, in which attackers place malicious or misleading information into an agent’s stored context."}],"event.summary":[{"source_index":0,"quote":"Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend."},{"source_index":0,"quote":"Over 60 days, researchers reviewing AI-related URLs in email traffic identified 50 distinct examples of prompt-based attempts to influence AI assistant memory."},{"source_index":0,"quote":"The attempts came from 31 different companies and covered more than a dozen industries, including finance, health, legal services, SaaS, marketing agencies, food and recipe sites, and business services."},{"source_index":0,"quote":"Microsoft said the effectiveness and persistence of these prompts varied between AI assistants and over time as persistence mechanisms and protections changed."},{"source_index":0,"quote":"The company said memory poisoning through cross-domain prompt injection could seed persistent memory after a single successful injection, allowing the effect to propagate across subsequent sessions."}],"impact.severity":[{"source_index":0,"quote":"The attempts came from 31 different companies and covered more than a dozen industries, including finance, health, legal services, SaaS, marketing agencies, food and recipe sites, and business services."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-03"}],"event.trigger":[{"source_index":0,"quote":"The company said memory poisoning through cross-domain prompt injection could seed persistent memory after a single successful injection, allowing the effect to propagate across subsequent sessions."}]},"notes_on_gaps":"No source answers were supplied: the only entry is a news-search index line (headline and date) with no sentences. Every field is therefore left empty rather than inferred. The headline alone suggests prompt-based memory-poisoning attempts against AI assistants across 31 companies, but no source sentence states the system, model, developer, tools, permissions, autonomy, guardrails, deployment context, dates, detection, root cause, impact figures, affected parties, industry, country or regulatory posture, so none of those values can be written. event.trigger, event.date_occurred, event.detection_method, event.incident_class, event.failure_class, event.root_cause, system.autonomy_level, system.deployment_context and impact.severity are all left unwritten because no source states them and none may be defaulted. No loss figure is stated, so no dollar band applies. No judgement was made beyond this omission. system.tier: not set; no operator named and deployment_context is not a lab's. event.incident_class: carried from record_version 1; no stored answer supports a value. event.summary: carried from record_version 1; no stored answer supports a value. impact.severity: carried from record_version 1; no stored answer supports a value. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. event.incident_class: classified from described behaviour. event.summary: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; the trigger a cited sentence states was filled]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}