Cases › security breach › LR-2026-0115
Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies
Severity moderate: no source gives a fact that decides the level; we set it from the description
Earliest source we hold 2026-10-03
Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend. Over 60 days, researchers reviewing AI-related URLs in email traffic identified 50 distinct examples of prompt-based attempts to influence AI assistant memory, coming from 31 different companies across more than a dozen industries. Microsoft said the effectiveness and persistence of these prompts varied between AI assistants and over time as persistence mechanisms and protections changed. Microsoft described memory poisoning through cross-domain prompt injection seeding persistent memory after a single successful injection, allowing the effect to propagate across subsequent sessions, and outlined memory security controls for Microsoft 365 Copilot including sanitization checks, prompt-injection classifiers, Task Adherence checks, tenant isolation, Customer Lockbox, encryption at rest and audit logging.
Risk grouping: AI attacked
| Who caused it | A person or organisation “One of the key risks is memory poisoning, in which attackers place malicious or misleading information into an agent’s stored context.” source |
|---|---|
| Intended or not | Intended “Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend.” source |
| Before or after release | After release “Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend.” source |
| The AI's part | Attacked “One of the key risks is memory poisoning, in which attackers place malicious or misleading information into an agent’s stored context.” source |
What the sources state
- What set it off hidden instructions in its input
Show every field, with its source and grade
What happened
Impact
LR-2026-0115 · version 3 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON