Summary: Google threat intelligence published the first systematic web sweep for indirect prompt injection on April 23, 2026, using Common Crawl, Gemini classification, and human validation. The study found pranks, SEO manipulation, AI-blocking attempts, limited exfiltration, and destructive prompts, and reported malicious cases growing 32% between November 2025 and February 2026. Google says attackers remain experimental but scale should be expected to rise.
For the first time, the public web has been swept systematically for indirect prompt injection (IPI) attacks that genuinely exist out there — hostile instructions tucked into webpages, lying in wait for whichever AI system happens to read them. Google’s threat intelligence teams stand behind the effort; their study, “AI threats in the wild: The current state of prompt injections on the web”, went up on the company’s security blog on April 23, 2026.
The timing is part of the story. AI agents are doing ever more of the web’s reading on a user’s behalf — browsing, summarizing, carrying out tasks — and they tend to take whatever they encounter at face value. In effect, the industry now has its first real-world measurement of this new attack surface. The verdict in brief: attackers remain in an experimental phase, but the numbers are trending upward.
How the Scan Worked: Common Crawl In, Gemini in the Middle
The raw material came from Common Crawl’s web archive — monthly snapshots of roughly 2 to 3 billion pages, predominantly static English-language content: blogs, forums, and comment threads. The pipeline moved from coarse to fine: pattern matching first caught text fitting known injection signatures (“ignore … instructions” and “if you are an AI” among them), then Gemini classified the suspicious remainder, and humans closed out the process with validation. The authors are upfront that false positives abound — research papers and security articles are stuffed with these very strings — and social media was left out of scope, set aside for a later study.
Six Patterns Spotted in the Wild
- Pranks with no agenda — invisible text, for example, instructing an agent to change how it talks
- Guidance in good faith — directions intended to help AI summarize better; bend the same mechanism slightly and it turns into an attack
- SEO manipulation — coaxing AI assistants into promoting a particular business, some of it via complex, automatically generated prompts
- Keeping AI agents away — blocking AI from crawling content, even dragging agents into bottomless text streams purely to drain their resources
- Malicious data exfiltration — only a handful of theft attempts, and none of them sophisticated; the advanced exfiltration prompts shown off in 2025 papers were nowhere to be found at scale
- Destructive attacks — plots to wipe every file off a user’s machine, rated unlikely to work
A 32% Jump in Malicious Cases Across Three Months
The study’s sole quantitative finding comes from rescanning the archive across successive versions: between November 2025 and February 2026, the malicious category grew 32%. Google’s overall reading: attackers have yet to put advanced IPI into scaled production, but as agents gain capability and attacks get automated, both scale and sophistication should be expected to climb.
The Defenses Google Says It Runs
The post ends by laying out Google’s own lines of protection: continued hardening at the model level, red-team testing of Gemini, an AI Vulnerability Reward Program that draws in outside researchers, and real-time handling of threats. Another post published that month digs into Workspace, addressing the injection risk while agents take in documents and email. The Register, commenting that same week, likened prompt injection to phishing: a request worded well enough can talk a person — or a language model — into handing over secrets, and neither problem is expected to disappear anytime soon.
What the Serving Layer Is Doing About It
Mitigation is also moving into the infrastructure itself. In an engineering post dated April 24, Fireworks pointed at a deeper flaw: in most serving stacks for open models, the conversation is flattened into one long string by a Jinja chat template before any encoding happens — so user input that spells out the literal form of a control token, im_end say, is encoded as the genuine control token. Their demonstration showed a single user message cutting a turn short and fabricating a system message, with Kimi K2.6 speaking Spanish in place of English as a result. Fireworks’ answer is a safe_tokenization flag on the Chat Completions API, ensuring no string inside user content can ever be turned into a special token during encoding — supported across DeepSeek, Kimi, Qwen, Llama, GLM, and other open models, at a negligible overhead cost.
For product teams the message bears repeating: this attack does not require defeating the model — a rigged webpage that your agent reads is all it takes. And when a third-party AI tool is compromised, the fallout lands directly on its customers — Vercel’s Context AI incident is the most recent illustration.