# Google Workspace's continuous approach to mitigating indirect prompt injections

DevFeed: [Google Workspace's continuous approach to mitigating indirect prompt injections](<https://devfeed.tech/articles/google-workspace-s-continuous-approach-to-mitigating-indirect-prompt-injections-19819.md>)

Original publisher: [Read original article](<http://security.googleblog.com/2026/04/google-workspaces-continuous-approach.html>)

Author: Kimberly Samra (noreply@blogger.com)

Published: 2026-04-02T16:00:00Z

Content type: opinion

Language: en

Sources: [Google Online Security](<https://devfeed.tech/sources/google-online-security.md>)

Topics: [prompt injection](<https://devfeed.tech/topics/prompt-injection.md>), [Google](<https://devfeed.tech/topics/google.md>), [Security](<https://devfeed.tech/topics/security.md>), [Adversarial attacks](<https://devfeed.tech/topics/adversarial-attacks.md>), [Machine Learning, Security Attacks](<https://devfeed.tech/topics/machine-learning-security-attacks.md>), [Machine learning](<https://devfeed.tech/topics/machine-learning.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Google AI](<https://devfeed.tech/topics/google-ai.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [automated](<https://devfeed.tech/tags/automated.md>), [discovery](<https://devfeed.tech/tags/discovery.md>), [google](<https://devfeed.tech/tags/google.md>), [llms](<https://devfeed.tech/tags/llms.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [none](<https://devfeed.tech/tags/none.md>), [prompt](<https://devfeed.tech/tags/prompt.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [red-teaming](<https://devfeed.tech/tags/red-teaming.md>), [research](<https://devfeed.tech/tags/research.md>), [safety](<https://devfeed.tech/tags/safety.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

Google describes its ongoing approach to mitigating indirect prompt injection attacks against Workspace with Gemini. The approach includes discovering new attack vectors, human and automated red-teaming, and collaboration with external researchers through the Google AI Vulnerability Rewards Program.

## Source excerpt

Posted by Adam Gavish, Google GenAI Security Team Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user's query. This may even be possible without any input directly from the user. IPI is not the kind of technical problem you "solve" and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That's why Google takes a sophisticated and comprehensive approach to these attacks. We're continuously improving LLM resistance to IPI attacks and launching AI application capabilities with ever-improving defenses. Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini. In our previous blog "Mitigating prompt injection attacks with a layered defense strategy", we reviewed the layered architecture of our IPI defenses. In this blog, we'll share more detail on the continuous approach we take to improve these defenses and to solve for new attacks. New attack discovery By proactively discovering and cataloging new attack vectors through internal and external programs, we can identify vulnerabilities and deploy robust defenses ahead of adversarial activity. Human Red-Teaming Human Red-Teaming uses adversarial simulations to uncover security and safety vulnerabilities. Specialized teams execute attacks based on realistic user profiles to exploit weaknesses, coordinating with product teams to resolve identified issues. Automated Red-Teaming Automated Red-Teaming is done via dynamic, machine-learning-driven frameworks to stress-test environments. By algorithmically generating and iterating on attack payloads, we can mimi