'Recommendation poisoning' — deliberate corruption of the data lakes, training sets, and persistent memory banks that agents rely on for purchase/action decisions — emerges as the primary new cybersecurity-marketing vector, blurring the line between di...

'Recommendation poisoning' — deliberate corruption of the data lakes, training sets, and persistent memory banks that agents rely on for purchase/action decisions — emerges as the primary new cybersecurity-marketing vector, blurring the line between digital advertising and unauthorized cyber manipulation. | First publicly-disclosed enterprise recommendation-poisoning incident

Key catalyst: First publicly-disclosed enterprise recommendation-poisoning incident

Watch events: OWASP LLM Top 10 updates; NIST AI-RMF updates; first enterprise-loss from recommendation poisoning

Academic research 2025-2026 documents agent-memory poisoning, prompt-injection attacks, training-data contamination demonstrations. AISI / NIST formal threat taxonomies emerging.

No propagation data yet. Run inference/.venv/bin/python scripts/ops/run_loopy_belief_propagation.py on the droplet, or wait for the Sunday 02:00 UTC weekly cron.

{
  "nia": false,
  "mode": "FORECAST",
  "role": "Cited-Other",
  "context": "Novel cybersecurity vector, bridging marketing and attack frameworks. Couples with CYB_022 (LiteLLM supply chain), 231_017 (open-weight supply chain attack).",
  "to_year": 2029,
  "conv_cues": "coined term; novel attack-vector category",
  "direction": "HAPPEN",
  "from_year": 2026,
  "timeframe": "2026-2029",
  "conv_level": "HIGH",
  "milestones": [
    {
      "kind": "llm_pre_event",
      "label": "Microsoft Security Blog publishes detailed AI Recommendation Poisoning attack analysis",
      "notes": "HIT - Microsoft formally named and described the attack class validating Finn's recommendation poisoning framing.",
      "source": "Microsoft Security Blog - Manipulating AI memory for profit: The rise of AI Recommendation Poisoning",
      "status": "hit",
      "weight": 0.4,
      "ordinal": -9,
      "source_id": null,
      "confidence": 0.99,
      "source_url": "https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/",
      "expected_date": "2026-02-10",
      "observed_date": "2026-02-10",
      "research_origin": "deep_research",
      "measurement_criterion": "Microsoft publishes formal blog/whitepaper documenting AI Recommendation Poisoning targeting persistent agent memory layer"
    },
    {
      "kind": "llm_pre_event",
      "label": "Microsoft identifies 31 companies actively poisoning AI memory via Summarize with AI buttons",
      "notes": "HIT - confirms first publicly-disclosed enterprise recommendation-poisoning incident criterion in spirit. NPM packages reduce barrier to entry to near-zero.",
      "source": "Microsoft Security Blog - AI Recommendation Poisoning",
      "status": "hit",
      "weight": 0.4,
      "ordinal": -8,
      "source_id": null,
      "confidence": 0.95,
      "source_url": "https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/",
      "expected_date": "2026-02-10",
      "observed_date": "2026-02-10",
      "research_origin": "deep_research",
      "measurement_criterion": "Microsoft Security disclosure that 30 or more companies are actively running recommendation-poisoning campaigns against AI agents"
    },
    {
      "kind": "llm_pre_event",
      "label": "Major AI assistant vendor discloses successful e-commerce recommendation-engine manipulation incident",
      "source": "TTMS / Lakera / SNS - Training data poisoning enterprise incident reporting",
      "status": "pending",
      "weight": 0.4,
      "ordinal": -7,
      "source_id": null,
      "confidence": 0.55,
      "source_url": "https://ttms.com/training-data-poisoning-the-invisible-cyber-threat-of-2026/",
      "expected_date": "2026-08-16",
      "research_origin": "deep_research",
      "expected_date_range": {
        "to": "2026-12-31",
        "from": "2026-04-01"
      },
      "measurement_criterion": "OpenAI Anthropic Google Microsoft or major AI agent platform publicly discloses a confirmed enterprise-class recommendation-poisoning breach"
    },
    {
      "kind": "quartile_checkpoint",
      "label": "Q1 window check-in (25%)",
      "status": "pending",
      "weight": 0.05,
      "ordinal": -6,
      "source_id": null,
      "expected_date": "2026-08-29",
      "observed_date": null
    },
    {
      "kind": "llm_pre_event",
      "label": "Standards body publishes formal taxonomy / mitigations for recommendation poisoning",
      "source": "MITRE ATLAS / OWASP LLM Top 10 / NIST AI RMF updates",
      "status": "pending",
      "weight": 0.4,
      "ordinal": -5,
      "source_id": null,
      "confidence": 0.65,
      "expected_date": "2027-03-17",
      "research_origin": "training",
      "expected_date_range": {
        "to": "2027-12-31",
        "from": "2026-06-01"
      },
      "measurement_criterion": "NIST AI Risk Management Framework MITRE ATLAS or OWASP LLM Top 10 publishes named taxonomy entry and mitigation guidance for recommendation-poiso
... (truncated)