AI threats in the wild: The current state of prompt injections on the web
2026-05-12T19:23:41Z•546e24d48439c0ca42f7c1fc3bececa3b911f3bea01011b93c9e8fa3a6b45387
AI securityAndroid 17Certificate TransparencyDBSCDNS parserGenAIGoogle WorkspaceIPIMerkle Tree CertificatesPLANTS working groupPQCPixel basebandRustVRPcookie theftdevice bound session credentialsindirect prompt injectioninfostealermemory safetypost-quantum cryptographyprompt injectionquantum-safe HTTPSsession hijackingvulnerability rewards program
What happened
Collection of Google Security Blog updates (Apr–Mar 2026) covering multiple defensive initiatives and threat assessments: 1) Indirect Prompt Injection (IPI) — Google Threat Intelligence scanned the public web for IPI patterns, highlighting IPI as a top-priority attack vector and documenting real-world abuse and ongoing mitigation work; Workspace-specific continuous mitigations and GenAI hardening are being rolled out. 2) Pixel baseband hardening — Pixel team integrated a memory-safe Rust DNS parser into modem firmware to reduce memory-safety vulnerabilities in the baseband (mitigates classes e
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- 546e24d48439c0ca42f7c1fc3bececa3b911f3bea01011b93c9e8fa3a6b45387
- Enrichment time
- 2026-05-12T19:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.