Google's web-scale scan finds real prompt injections, mostly crude but rising

Indirect prompt injection (IPI) hides instructions in content an AI agent will later read, such as a web page it is asked to summarise. It has been widely discussed as a primary attack vector against agents. The open question was whether attackers use it in practice. Google's threat intelligence teams set out to measure that on the public web, and their April 2026 write-up is one of the first large-scale looks at the answer.

How Google measured it

The team used Common Crawl, a repository of crawled English-speaking websites with monthly snapshots of 2-3 billion pages each. Detection ran in three stages: pattern matching for signatures such as "ignore … instructions" and "if you are an AI", Gemini-based classification of intent and fit with the surrounding text, and human validation.

Two caveats matter when reading the numbers. Common Crawl skips sites behind login walls or with anti-crawl directives, so most social media is out of scope. Google also says the approach is not exhaustive and may miss uncommon signatures. Many raw hits were false positives, mainly research papers, educational posts and security articles that quote injection strings.

What they found

• Pranks: an invisible injection in a page's source told agents to change their conversational tone.
• Helpful guidance: authors steering AI summaries to add context. Google calls this benign but notes it could turn malicious if it pushed misinformation or redirected users to third-party sites.
• SEO: attempts to make assistants promote one business over its competitors, including more sophisticated versions that appeared to come from automated SEO tools.
• Deterrence: simple "if you are an AI, do not crawl" notices, and one case that lured AI readers to a page streaming endless text that never finished loading, possibly to waste resources or cause timeouts.
• Exfiltration: a small number of attempts, low in sophistication, one of which appeared to be an author's experiment.
• Destruction: prompts trying to delete all files on a user's machine, which Google considered unlikely to succeed and mostly attributed to experiments or pranks.

Why it matters

The most useful finding is the trend. Google reports a relative increase of 32% in the malicious category between November 2025 and February 2026, observed across repeated scans of multiple archive versions. It gives no absolute counts in the article, so this is a direction rather than a measure of volume. Google's reading is that attackers are experimenting but sophistication is limited, and that it expects scale and sophistication to grow. Its stated reasons are that AI systems are becoming more capable and so more valuable targets, and that attackers are using agentic AI to cut the cost of their operations.

Note what was not observed: Google did not see significant use of the advanced exfiltration prompts described in 2025 security research. That is a statement about the public, crawlable web. It says nothing about targeted attacks delivered through email, documents or social media, which this dataset largely excludes.

Practical reading for security teams

Our inference, not Google's: the cheap payloads seen today fail mostly because current deployments are not yet worth attacking carefully. Agents with file access, code execution or outbound network calls change that economics. Treat every fetched page, document and tool result as untrusted data. Constrain what an agent can do after reading it, and test those boundaries with adversarial content rather than assuming a model will refuse.

Google describes its own response as model and product hardening, red teaming of Gemini against adversarial manipulation, an AI Vulnerability Reward Program for external researchers, and real-time data processing to identify and neutralise threats. The article offers no specific guidance for website owners, developers or end users.