AI threats in the wild: The current state of prompt injections on the web
2026-07-18T07:23:44Z•56ece53271d8df07ba0791a478492a1eafee2eae47fcc1210e2f02c4a0e9201a
AI safetyAndroid 17Certificate Transparency (CT) optimization','vulnerability-rew'Chrome 146DBSCDNS parserDevice Bound Session CredentialsGoogle WorkspaceIPILLM securityLummaC2MTCMerkle Tree CertificatesPQCPixelRustagentic automationbaseband modemcookie theftindirect prompt injectioninfostealermemory safetypost-quantum cryptographyprompt injectionquantum-safe HTTPS
What happened
Collection of Google Security Blog posts (Apr 2026) covering active and strategic security work: Google Threat Intelligence reports active monitoring and findings for Indirect Prompt Injection (IPI) on the public web and emphasizes IPI as a top LLM/AI attack vector; Google Workspace describes continuous, multi-layered defenses against IPI and adversarial data/tool injection; Chrome and Google Account teams roll out Device Bound Session Credentials (DBSC) to proactively prevent cookie-based session theft (Chrome 146 on Windows, macOS soon) and call out advanced infostealer families (e.g., Lumma
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- 56ece53271d8df07ba0791a478492a1eafee2eae47fcc1210e2f02c4a0e9201a
- Enrichment time
- 2026-07-18T07:23:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.