AI threats in the wild: The current state of prompt injections on the web
2026-06-01T07:23:41Z•4b02170f6157c13da11c8c1b508063da1117b2060a5ec0effa95ee99a5833594
AI securityAndroidCertificate TransparencyDBSCDNS parserGeminiGoogle WorkspaceIPILLM safetyMTCMerkle Tree CertificatesPQCPixel securityRustVulnerability Rewards Programbaseband modemcookie theftdevice bound session credentialsindirect prompt injectioninfostealermemory safetypost-quantum cryptographyquantum-safe HTTPSremote code executionsession hijacking
What happened
Collection of Google Security Blog posts (Apr 2026) covering active and emerging threats and mitigations: investigations into real-world Indirect Prompt Injection (IPI) and ongoing hardening of Google Workspace/Gemini against IPI; Device Bound Session Credentials (DBSC) rolling out to prevent cookie/session theft from infostealer malware; use of Rust to add a memory-safe DNS parser in Pixel modem/baseband firmware to reduce memory-safety vulnerabilities; updates on Post‑Quantum Cryptography (PQC) adoption in Android and Chrome’s work on quantum‑safe HTTPS (Merkle Tree Certificates) to address,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- 4b02170f6157c13da11c8c1b508063da1117b2060a5ec0effa95ee99a5833594
- Enrichment time
- 2026-06-01T07:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.