AI threats in the wild: The current state of prompt injections on the web
2026-05-09T01:23:39Z•b51bc213803a72a17914a773a4f030430cee51d8a749af0ece6fea4e529dbd84
AI securityAndroid 17DBSCDNS parserDevice Bound Session CredentialsGeminiGoogle WorkspaceIPILLM securityLummaC2PQCPixel basebandRustVRPVulnerability Rewards Programcookie theftindirect prompt injectioninfostealermemory‑safetymodem hardeningpost‑quantum cryptographyprompt injectionprompt‑engineeringquantum‑safe TLS','Certificate Transparency','Merkle Tree Certs'session hijacking
What happened
Collection of Google Security Blog posts (Apr–Mar 2026) covering multiple high‑impact security topics: empirical research showing real‑world occurrences and monitoring of Indirect Prompt Injection (IPI) against LLMs and mitigation work across Google Workspace/Gemini; Pixel modem hardening by integrating a Rust DNS parser to reduce memory‑safety vulnerabilities in baseband firmware; Device Bound Session Credentials (DBSC) rolling to public availability on Chrome (Windows, soon macOS) to block cookie/session‑theft by infostealer malware; Vulnerability Rewards Program (VRP) 2025 review; Android’s
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- b51bc213803a72a17914a773a4f030430cee51d8a749af0ece6fea4e529dbd84
- Enrichment time
- 2026-05-09T01:23:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.