AI threats in the wild: The current state of prompt injections on the web

Collection of Google Security Blog posts covering multiple platform- and ecosystem-level security advances and active threats: (1) analysis of real-world indirect prompt injection (IPI) activity and ongoing mitigation work for AI agents and Google Workspace/Gemini to reduce IPI risk; (2) rollout of Device Bound Session Credentials (DBSC) to Chrome (Windows, expanding to macOS) to proactively prevent session-cookie theft by infostealers; (3) integration of a memory-safe Rust DNS parser into Pixel modem/baseband firmware to reduce memory-safety vulnerabilities; (4) Google VRP 2025 program recap;