{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1608.007","id":"T1608.007","name":"AI Result Poisoning","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1608/007","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"f4f84c11e1e62333a33dbfd601c2696911853796164042571da7eae23dd825dd","description":"Adversaries may manipulate publicly accessible web content to influence generative AI systems or AI-powered search engines into retrieving, citing, or recommending attacker-controlled information.(Citation: Digiday AI Result Poisoning)(Citation: Netcraft AI Summaries)\n\nUnlike traditional [SEO Poisoning](https://attack.mitre.org/techniques/T1608/006), which primarily attempts to influence the ordering of conventional search results, AI Result Poisoning targets systems that synthesize information from multiple sources and provide a direct answer to the user. Adversaries may create malicious or misleading websites, publish fabricated claims, generate supporting articles, or establish multiple apparently independent sources that reinforce the same information. These sources may then be retrieved by AI systems using web search or retrieval-augmented generation and incorporated into generated responses. \n\nAdversaries may use this technique to recommend or link to phishing sites, fraudulent online stores, malicious downloads, impersonation pages, or other attacker-controlled infrastructure.(Citation: dev.to Abusing AI Chatbot Recommendations)(Citation: darkreading geo poisoning)(Citation: darkreading ai result poisoning) It can also be used to promote misinformation or fabricated claims without requiring access to the underlying AI model, system prompt, or application infrastructure.(Citation: Lasso Security AI Engine Poisoning) Because the malicious content can resemble ordinary marketing, editorial, or informational material, traditional prompt injection and malware-focused detections may not identify the activity. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1608/007","external_id":"T1608.007"},{"source_name":"darkreading geo poisoning","description":"Alexander Culafi. (2025, December 10). ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery. Retrieved September 18, 2026.","url":"https://www.darkreading.com/vulnerabilities-threats/clickfix-style-attack-grok-chatgpt-malware"},{"source_name":"darkreading ai result poisoning","description":"Alexander Culafi. (2025, December 10). ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery. Retrieved September 18, 2026.","url":"https://www.darkreading.com/vulnerabilities-threats/clickfix-style-attack-grok-chatgpt-malware"},{"source_name":"dev.to Abusing AI Chatbot Recommendations","description":"Dennis Kim. (2026, May 27). Cryptojacking Abusing AI Chatbot Recommendations — A New Delivery Vector Beyond Search Poisoning. Retrieved September 18, 2026.","url":"https://dev.to/denniskim/cryptojacking-abusing-ai-chatbot-recommendations-a-new-delivery-vector-beyond-search-poisoning-1cmb"},{"source_name":"Lasso Security AI Engine Poisoning","description":"Eliya Saban. (2026, June 24). Exploiting GEO to Push Harmful Claims into AI-Generated Answers. Retrieved September 18, 2026.","url":"https://www.lasso.security/blog/exploiting-geo-to-push-harmful-claims-into-ai-generated-answers"},{"source_name":"Netcraft AI Summaries","description":"Ginny Spicer. (2026, August 3). Threat Actors are Finding Their Way into Your AI Summaries. Retrieved September 18, 2026.","url":"https://www.netcraft.com/blog/threat-actors-are-finding-their-way-into-your-ai-summaries"},{"source_name":"Digiday AI Result Poisoning","description":"Sam Bradley. (2026, July 6). WTF is AI poisoning?. Retrieved September 18, 2026.","url":"https://digiday.com/marketing/wtf-is-ai-poisoning/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","parent":{"key":"enterprise/T1608","id":"T1608","name":"Stage Capabilities","domain":"enterprise","level":"technique","parent_id":null,"tactics":["resource-development"],"platforms":["PRE"],"environments":["external-services"],"page":"techniques/enterprise/T1608/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required"],"telemetry_tags":["Response Content"],"telemetry_references":[{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"}],"detections":{"page":"detections/enterprise/T1608/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"anomaly_types":[]},"detection_status":"rule_source_available","anomaly_tags":[],"tool_tags":[],"tool_references":[],"visibility":"source_mapped","telemetry_status":"mapped","classification":"cannot_simulate_yet","candidate_count":0,"implementation":"not_integrated","methods":[]},"children":[],"telemetry":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input","category":"External context and intelligence","description":"External observations that may contextualize adversary preparation but do not show access to a victim.","collection_focus":"Retain source provenance, confidence and temporal bounds; explicitly label observations outside victim visibility.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["indicator","source_record","confidence","victim_access_observed"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input","category":"External context and intelligence","description":"Audit records controlled by an external provider that may only be available through an authorized disclosure or account-owner export.","collection_focus":"Document legal/account-owner access and provider coverage before ingestion. Preserve original IDs, timestamps and disclosure limits; do not seek unauthorized access.","providers":[{"name":"Authorized provider/account-owner audit exports","scope":"Available only with the provider or account owner’s lawful access and supported export.","source_id":"cloudtrail"},{"name":"CloudTrail in an owned lab account","scope":"A concrete lab-side example; it does not grant access to adversary-controlled accounts.","source_id":"cloudtrail"}],"configuration":["Establish the authorized account, record owner and export mechanism before collection. Without access, mark this input unavailable rather than simulating defender visibility.","Preserve source event IDs, account/resource IDs, original timestamps and the authorized disclosure/export record.","Document which events the provider actually exposes and compare delivered records to the request scope. Keep lab-side actions separate from victim-side evidence."],"configuration_example":null,"required_fields":["provider_record_id","access_basis","action","victim_network_observation"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Customer-accessible audit APIs do not expose arbitrary third-party accounts. A synthetic provider event cannot establish access, attribution or detection coverage in a real investigation.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1608.007","id":"T1608.007","name":"AI Result Poisoning","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1608/007","technique_page":"techniques/enterprise/T1608.007/","page":"detections/enterprise/T1608.007/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0922","name":"Detection of AI Result Poisoning","url":"https://attack.mitre.org/detectionstrategies/DET0922","stix_id":"x-mitre-detection-strategy--93aad346-455d-4de1-ae61-b11fd5456263","relationship_id":"relationship--a5961132-44a5-43b0-bc7a-50856e80e36c","description":"","analytics":[{"id":"AN2068","name":"Analytic 2068","guidance":"No target-side behavioral analytic. A defender cannot reliably distinguish an adversary intentionally staging public content to manipulate future AI retrieval from ordinary publishing, SEO, inaccurate information, duplicated content, or legitimate coordinated publication using target-enterprise telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0922#AN2068","platforms":["PRE"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","tag":"Proposed: External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input"},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","tag":"Proposed: Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input"}],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","tool_references":[],"related_parent":{"key":"enterprise/T1608","id":"T1608","name":"Stage Capabilities","page":"detections/enterprise/T1608/","note":"Related parent research only. Not inherited rule or anomaly coverage for this sub-technique."},"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--e1a94631-1c8e-40c5-bc80-086515efba39","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1608.006":"/ttp-simulation/techniques/enterprise/T1608.006/","T1608.007":"/ttp-simulation/techniques/enterprise/T1608.007/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1608.007","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}}]}}