# AI threats in the wild: The current state of prompt injections on the web

DevFeed: [AI threats in the wild: The current state of prompt injections on the web](<https://devfeed.tech/articles/ai-threats-in-the-wild-the-current-state-of-prompt-injections-on-the-web-19817.md>)

Original publisher: [Read original article](<http://security.googleblog.com/2026/04/ai-threats-in-wild-current-state-of.html>)

Author: Kimberly Samra (noreply@blogger.com)

Published: 2026-04-23T21:38:00Z

Content type: article

Language: en

Sources: [Google Online Security](<https://devfeed.tech/sources/google-online-security.md>)

Topics: [prompt injection](<https://devfeed.tech/topics/prompt-injection.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Security](<https://devfeed.tech/topics/security.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Google](<https://devfeed.tech/topics/google.md>), [AI Chat](<https://devfeed.tech/topics/ai-chat.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [google](<https://devfeed.tech/tags/google.md>), [none](<https://devfeed.tech/tags/none.md>), [prompt](<https://devfeed.tech/tags/prompt.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [snapshots](<https://devfeed.tech/tags/snapshots.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Google Threat Intelligence teams describe a public-web investigation into indirect prompt injection, an attack in which malicious instructions embedded in websites, emails, or documents can redirect an AI system away from the user's intent. The article examines whether real-world attackers are operationalizing these attacks and uses Common Crawl snapshots to study known patterns.

## Source excerpt

Posted by Thomas Brunner, Yu-Han Liu, Moni Pande At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today - and if so, how? To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. The threat of indirect prompt injection Unlike a direct injection where a user "jailbreaks" a chatbot, IPI occurs when an AI system processes content--like a website, email, or document--that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent. This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed our work in this area and researchers have further highlighted the evolving nature of these vulnerabilities. Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks? Proactive monitoring at GoogleThe landscape of IPI on the web There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them. Public research confirms these attacks are