AI threats in the wild: The current state of prompt injections on the web
2026-05-02T19:23:40Z•b3972965cf53c8288335ae28344cf3ac757d23c233bdcd5f8034a6bf13f4afa2
Android 17Certificate Transparency (CT) / PLANTSChromeDBSCDNS parserDevice Bound Session CredentialsGeminiGoogle WorkspaceIPILLM securityLummaC2MTCMerkle Tree CertificatesPQCPost-Quantum CryptographyRustThreat intelligenceVRPVulnerability Rewards Programbaseband modemcookie theftindirect prompt injectioninfostealermemory safetyquantum-safe HTTPS
What happened
A set of Google Security Blog posts (Apr 2026) covering active AI/LLM risks and platform defenses, secure engineering advances, and crypto preparedness. Key points: Google Threat Intelligence observed and analyzed real-world indirect prompt injection (IPI) patterns and details continuous mitigations for Workspace/Gemini; Device Bound Session Credentials (DBSC) are entering public availability on Chrome (Windows) to mitigate cookie/session theft from infostealer malware; Pixel team integrated a memory-safe Rust DNS parser into modem firmware to reduce memory-safety vulnerabilities; VRP 2025 rec
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- b3972965cf53c8288335ae28344cf3ac757d23c233bdcd5f8034a6bf13f4afa2
- Enrichment time
- 2026-05-02T19:23:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.