AI threats in the wild: The current state of prompt injections on the web
2026-05-23T07:23:40Z•b9b33724cca29005ba1a88857e729910cf40970a49474cce3b68522b51040405
DBSCIPILLM-securityPKIPQCVRPandroidandroid-17basebandcertificate-transparencychromecookie-theftdevice-bound-session-credentialsdns-parsergeminigoogle-workspaceindirect-prompt-injectioninfostealermemory-safetymerkle-tree-certificatespixelpost-quantumrustsession-theftvulnerability-rewards-program
What happened
This collection of Google Security Blog posts covers multiple high-impact security topics and defenses. Key points: (1) Indirect Prompt Injection (IPI) is a prioritized, actively observed threat against LLM-based agents; Google performed broad web sweeps and is continuously improving defenses (Workspace/Gemini-focused mitigations). (2) Device Bound Session Credentials (DBSC) are entering public availability (Chrome 146 on Windows; macOS rollout forthcoming) to proactively prevent stolen browser cookies from being usable by attackers, mitigating infostealer session-theft scenarios. (3) Pixel is
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- b9b33724cca29005ba1a88857e729910cf40970a49474cce3b68522b51040405
- Enrichment time
- 2026-05-23T07:23:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.