On April 23, 2026, Google’s threat intelligence teams published a study on the company’s security blog — “AI threats in the wild: The current state of prompt injections on the web” — the first systematic scan of the public web for real-world indirect prompt injection (IPI) attacks: malicious instructions embedded in pages, waiting for an AI system to come read them.
The timing matters. AI agents increasingly browse, summarize, and act on behalf of users, and they tend to trust whatever they read. This study is effectively the industry’s first measurement of what that new attack surface actually looks like in the wild. The verdict: attackers are still experimenting, but the numbers are climbing.
The Method: Common Crawl Plus Gemini Classification
The team scanned Common Crawl’s web archive — monthly snapshots of roughly 2 to 3 billion mostly static English-language pages: blogs, forums, and comment threads. The pipeline ran coarse to fine: pattern matching against known injection signatures (phrases like “ignore … instructions” and “if you are an AI”), then Gemini-based classification of suspicious text, then human validation. The authors concede plenty of false positives — research papers and security articles are full of these strings — and social media was excluded, reserved for a future study.
Six Shapes of Injection in the Wild
- Harmless pranks — for example, invisible text telling an agent to change its conversational tone
- Helpful guidance — benign instructions meant to improve AI summaries, though the same mechanism turns malicious with one edit
- SEO manipulation — steering AI assistants toward promoting a business, including some automated and fairly intricate prompts
- Deterring AI agents — blocking AI crawling, including luring agents to pages with infinite text streams to burn their resources
- Malicious exfiltration — a small number of data-theft attempts at low sophistication; the advanced exfiltration prompts demonstrated in 2025 research papers were not seen at scale
- Malicious destruction — attempts to delete all files on a user’s machine, judged unlikely to succeed
Malicious Cases Up 32% in Three Months
The study’s one quantitative finding comes from repeated scans across archive versions: the malicious category grew 32% between November 2025 and February 2026. Google’s overall read is that attackers have not yet productionized advanced IPI at scale, but as agents grow more capable and attackers automate, both the scale and the sophistication should be expected to rise.
Google’s Own Defense List
The post closes with Google’s own lines of defense: continued model hardening, red-teaming of Gemini, an AI Vulnerability Reward Program for external researchers, and real-time threat processing. A companion post the same month covers mitigations in Workspace, where agents ingest documents and email. The Register, writing the same week, compared prompt injection to phishing: both humans and language models can be talked out of secrets by a sufficiently well-crafted request, and neither problem is going away soon.
The Engineering Response at the Serving Layer
The industry is also starting to bake mitigations into infrastructure. Fireworks, in an engineering post on April 24, described a lower-level flaw: most open-model serving stacks render the whole conversation into a single string via a Jinja chat template before encoding, so user input that spells out a control token such as im_end gets encoded as the real control token. In their demo, a single user message ends the turn and forges a new system message, flipping Kimi K2.6 from English to Spanish. Fireworks’ fix is a safe_tokenization flag on the Chat Completions API that guarantees no string in user content can ever be encoded as a special token — supported across DeepSeek, Kimi, Qwen, Llama, GLM, and other open models, with negligible overhead.
The reminder for product teams: this class of attack does not need to break the model. It only needs your agent to read a page someone prepared for it. And when a third-party AI tool does get compromised, the costs spill over to its customers — Vercel’s Context AI incident is the most recent example.
Sources
- AI threats in the wild: The current state of prompt injections on the web — Google Security Blog
- Just like phishing for gullible humans, prompt injecting AIs is here to stay — The Register
- How we fixed prompt injection for all models on Fireworks — Fireworks AI
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.