AI threats in the wild: The current state of prompt injections on the web
2026-08-16T01:23:32Z•09fe7b4df1a59509df0b24ee8bf2e034c3c689ba3b8d1ca6ffb5eaebcec7cdb4
AI agentsAI securityAndroidCertificate TransparencyChromeDNS parserGoogle Workspace GeminiHTTPSLLM securityLummaC2PQCPixel modemRustbaseband securitycookie theftdevice-bound session credentialsindirect prompt injectioninfostealer malwarememory safetypost-quantum cryptographyprompt injectionremote code executionsession theftvulnerability rewards
What happened
Google Security Blog posts covering emerging security issues and mitigations, including real-world indirect prompt injection attacks against AI agents and Workspace Gemini, memory-safe Rust adoption in Pixel modem firmware, device-bound session credentials to prevent stolen-cookie abuse, vulnerability reward program activity, and post-quantum cryptography deployments for Android and HTTPS. The most directly security-relevant threats are indirect prompt injection and session-cookie theft; no specific CVE identifiers are provided.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- 09fe7b4df1a59509df0b24ee8bf2e034c3c689ba3b8d1ca6ffb5eaebcec7cdb4
- Enrichment time
- 2026-08-16T01:23:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.