AI threats in the wild: The current state of prompt injections on the web
2026-05-04T01:23:44Z•f924dfa02adf739cad5ca5ec7e50e59e00c367f1a30829be755f273319b2de93
ai-threatsandroid-17chromedbscdevice-bound-session-credentialsdns-parsergenai-securitygoogle-workspaceindirect-prompt-injectioninfostealerllm-securitymemory-safetymerkle-tree-certificatespixel-basebandpost-quantum-cryptographypqcprompt-injectionquantum-safe-httpsrustsession-theftvrpvulnerability-reward-program
What happened
A set of Google Security Blog posts (Apr–May 2026) covering active AI-targeted threats and multiple platform hardening efforts. Google’s Threat Intelligence highlights indirect prompt injection (IPI) as a top AI attack vector and reports a web-wide sweep to monitor IPI patterns, while Workspace and GenAI teams describe continuous, layered defenses against IPI. Chrome and Google Account teams are rolling out Device Bound Session Credentials (DBSC) to proactively prevent cookie/session theft (Windows available in Chrome 146; macOS forthcoming). The Pixel team integrated a memory-safe Rust DNS 解析
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- google_security_blog
- Record identifier
- f924dfa02adf739cad5ca5ec7e50e59e00c367f1a30829be755f273319b2de93
- Enrichment time
- 2026-05-04T01:23:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.