ATLAS AML.T0130: AI Agent Response Biasing

An AI assistant that has been told to treat one source as trusted will keep recommending it, and the user will read that advice as neutral. MITRE ATLAS AML.T0130 AI Agent Response Biasing covers adversaries manipulating an AI assistant so that it favours sources or content they choose, presenting promotional or self-serving material as a reasoned answer. ATLAS added it in version 2026.09 under the Impact tactic (AML.TA0011), rates it Realized, and lists Generative AI and Agentic AI as its platforms. The impact is on integrity: skewed answers on health, finance or security topics that the user has no reason to doubt. This page is for security teams running enterprise assistants and agents, and covers the case behind the technique, how to hunt for it, and how to harden memory and outputs. For poisoning of public AI search results more broadly, see LLM Grooming and AI Search Poisoning.

Key takeaways

Response biasing is an impact, not an entry point. The bias arrives through another technique, such as a crafted assistant link (AML.T0131) or poisoned memory (AML.T0080.000), and shows up later as skewed answers.
The reference case was commercial, not criminal. Microsoft found more than 50 distinct memory-manipulation prompts from 31 companies, all legitimate businesses, in about 60 days of email traffic.
Memory makes it persistent. A single click can write a durable memory entry naming a domain as authoritative, which then shapes unrelated later conversations.
It can be hunted. Assistant URLs whose prompt parameter contains words such as remember, trusted or authoritative are visible in email, chat, click and proxy logs.
Memory hardening is the core control. ATLAS AML.M0031 calls for scoped, authorised memory writes, provenance on every update and rollback of suspicious entries.

What the technique is

ATLAS describes an adversary injecting instructions such as treating a named source as trusted or recommending it first, so the assistant's outputs lean toward the adversary's interests. The result degrades the integrity of answers on topics users rely on, without the user knowing the advice was skewed. ATLAS names two contributing paths: delivery through crafted AI assistant links, and persistence through poisoned agent memory.

It differs from neighbouring techniques by where the harm lands:

Technique	What is manipulated	Where the harm shows
AML.T0130 AI Agent Response Biasing	The assistant's preference for sources or content	Recommendations that favour the adversary, presented as neutral
AML.T0080.000 AI Agent Context Poisoning: Memory	Persistent memory entries	Any later behaviour that reads the poisoned memory; biasing is one outcome
AML.T0131 Crafted AI Assistant Links	The first prompt of a session, via URL parameters	Whatever the supplied prompt asks for, including a memory write
AML.T0070 RAG Poisoning	Documents in a retrieval index	Answers grounded on planted content
AML.T0067 LLM Trusted Output Components Manipulation	Citations, links and other elements users trust in the output	Output that looks verified or sourced when it is not

See AML.T0131 Crafted AI Assistant Links, MITRE ATLAS AML.T0080 AI Agent Context Poisoning and MITRE ATLAS AML.T0067 LLM Trusted Output Components Manipulation for those techniques in depth.

Case: AI Recommendation Poisoning (AML.CS0072)

The Microsoft Defender Security Research Team published research on 10 February 2026 describing a pattern it named AI Recommendation Poisoning. Many AI assistants accept a pre-filled prompt through a URL query parameter such as ?q= or ?prompt=, so whoever controls a link can write the first turn of a user's conversation. Operators placed such links behind "Summarize with AI" buttons and share widgets on their websites, and in some cases sent them by email.

Each link paired a genuine summarisation request with an added instruction to remember the operator's domain as a trusted or authoritative source for future conversations. When the user clicked, the assistant opened with the prompt populated and, where memory was enabled, stored a durable entry. ATLAS records the chain step by step: obtaining publicly available tooling (AML.T0016), embedding links in the operators' own web properties (AML.T0079), the crafted link itself (AML.T0131), concealment behind a benign button label (AML.T0068), the memory write (AML.T0080.000) and finally response biasing (AML.T0130), where later unrelated conversations surfaced the operator's product as a neutral recommendation.

Scale: reviewing AI assistant URLs in email traffic over about 60 days, Microsoft identified more than 50 distinct prompts from 31 companies; ATLAS records them across 14 industries.
Actors: every case was attributed to a legitimate business, using tooling marketed as search optimisation for language models, including an npm package and a web-based link generator.
Targets: ATLAS lists users of assistants with persistent memory features, including Microsoft 365 Copilot, ChatGPT, Claude, Perplexity and Grok. Several prompts targeted health and financial advice.
Outcome: Microsoft reported that effectiveness varied by platform and that some behaviours could no longer be reproduced as vendor protections evolved.

The lesson for defenders is that the attacker does not need to compromise anything. A marketing button and one user click are enough, so the controls sit in link hygiene, memory governance and output review rather than in perimeter defences.

Where else biasing can come from

Shared or team memory: where an agent's memory is shared across users, one poisoned entry biases answers for everyone. See the AI Agent Memory Security Guide.
Retrieved content: web pages or documents an agent reads can carry the same "prefer this source" instruction without any memory write, biasing that session only.
Agent configuration: a changed system prompt or agent instruction file can hard-code a preference. See MITRE ATLAS AML.T0081 Modify AI Agent Configuration.
Agents that act on recommendations: procurement, research or coding agents that choose suppliers, packages or sources turn a biased answer into a biased action, which raises the stakes beyond advice.

Detection and hunting

Microsoft's research describes hunting for AI assistant URLs whose prompt parameters contain memory-related keywords, such as remember, trusted, authoritative, future, citation and cite, and provides Defender for Office 365 Advanced Hunting queries for three tables. The same logic can be adapted to web proxy, endpoint and browser telemetry.

Source	What to look for	Follow-up
Email URL data (`EmailUrlInfo` in Defender for Office 365)	Links to assistant domains with a prompt parameter containing memory keywords	Identify senders and recipients; block or rewrite the URL pattern
Teams message URLs (`MessageUrlInfo`)	The same pattern shared in chat	Identify who shared and who received it
Click events (`UrlClickEvents`, requires Safe Links)	Users who actually opened such links	Review those users' assistant memories
Web proxy and browser logs	Requests to assistant domains with long or instruction-like query strings, referred from third-party sites	Find websites hosting the buttons
Assistant memory and audit logs	Memory writes that name a domain, brand or product as trusted or preferred	Quarantine and remove; trace the session that wrote it
Output monitoring on internal agents	A sudden rise in one domain or vendor appearing in recommendations across users	Check memory, retrieval sources and configuration for a common cause

Mitigations

As of ATLAS 2026.10, AML.M0020 Generative AI Guardrails is the ATLAS mitigation formally mapped to AML.T0130; the others below are our mapping of related ATLAS mitigations that apply in practice.

AML.M0031 Memory Hardening: authenticate and authorise memory writes within the right user, tenant, agent and session scope; record the source of every memory update and keep known-good versions; quarantine or roll back suspicious records; and monitor unusual update frequency. For deployed agents, block memory writes that originate from URL-supplied or retrieved content rather than from the user's own typed request.
AML.M0020 Generative AI Guardrails: filter prompts for instructions that try to set trust or preference for named sources. ATLAS notes guardrails do not replace memory access control, provenance and recovery.
AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data: treat a memory write as a tool action and require user confirmation when untrusted content is in context.
AML.M0033 Input and Output Validation for AI Agent Components: for agents that select suppliers, packages or sources, validate choices against an approved list or require a stated, checkable reason.
AML.M0018 User Training: teach users to hover over "Summarize with AI" links, to review saved memories and delete ones they do not recognise, and to ask the assistant to explain and cite the basis for a recommendation. In Microsoft 365 Copilot, Microsoft documents saved memories under Settings, Chat, Copilot chat, Manage settings, Personalization, Saved memories.
Link policy: treat assistant links from untrusted sources with the caution given to downloads, and consider mail-flow or proxy rules that flag assistant URLs carrying long prompt parameters.

For the full memory incident process, use the AI Agent Memory Poisoning Response Playbook.

How to test

Build a benign test link: in a test tenant, create an assistant link whose prompt asks the assistant to remember a fictitious test domain as trusted. Use a domain you control and no real brand.
Check the write path: open it as a test user and confirm whether a memory entry is created, whether the user is asked to confirm, and whether the write is logged with its source.
Check the effect: in a new session, ask a related question and record whether the test domain is favoured.
Check detection: confirm the hunting query, proxy rule or memory audit flags the link, the click and the write.
Clean up and repeat: delete the entry, confirm removal takes effect, and repeat after assistant or policy updates, since vendor behaviour changes.

Metrics

Number of assistant URLs with memory keywords seen in email, chat and proxy logs per month, and the share blocked or rewritten.
Share of enterprise assistants and agents with memory write provenance logged.
Time from detection of a biasing memory entry to its removal across affected users.
Number of users who clicked flagged links and had memories reviewed.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.T0130 AI Agent Response Biasing; tactic AML.TA0011 Impact; case AML.CS0072	The technique itself
MITRE ATLAS (chain)	AML.T0131, AML.T0080.000, AML.T0068, AML.T0079, AML.T0016	Delivery, persistence and concealment steps in the case
OWASP Top 10 for LLM Applications 2025	LLM01:2025 Prompt Injection; LLM09:2025 Misinformation	Injected instructions; credible-looking misleading output
OWASP Top 10 for Agentic Applications	ASI06 Memory and Context Poisoning	Persistent memory as the carrier
NIST SP 800-53 Rev 5	SI-10 Information Input Validation; SI-7 Software, Firmware, and Information Integrity	Validating inputs to memory; integrity of stored state

See the OWASP LLM Top 10 LLM09 Misinformation Guide and OWASP Agentic Top 10 ASI06 Guide.

Common failure patterns

Treating it as marketing, not security. Because the actors were legitimate companies, reports may be dismissed, yet the effect on decisions is the same as a malicious injection.
Memory on with no provenance. Entries cannot be traced to the session or link that wrote them, so clean-up is guesswork.
Clearing one user, not the population. A link sent in a newsletter reaches many users; every clicker needs review.
Letting agents act on unverified recommendations. A biased choice of supplier, library or source becomes an action without review.
Relying on vendor fixes alone. Microsoft noted behaviour varies across platforms and changes over time; internal tests need repeating.

Practitioner checklist

Hunt email, chat, click and proxy logs for assistant URLs with memory keywords.
Enable memory audit and provenance for enterprise assistants where offered.
Require confirmation for memory writes triggered by links or retrieved content.
Review and clean memories of users who clicked flagged links.
Validate agent choices of suppliers, packages and sources against approved lists.
Train users to review saved memories and question one-sided recommendations.
Test with a benign link after every assistant or policy change.

AML.T0130 AI Agent Response Biasing: Finding and Fixing Skewed Assistant Recommendations