Prompt injection in the wild: what Google's web scan shows

Indirect prompt injection (IPI) is when an AI system processes content such as a website, email or document that contains malicious instructions. It has been a leading theoretical risk for agents. Google's Threat Intelligence team has now published the first large-scale look at whether attackers are using it on the open web.

How Google looked for it

The team scanned Common Crawl, an archive of crawled English-language sites. Each monthly snapshot covers roughly 2-3 billion pages. They compared snapshots from November 2025 and February 2026, using three stages:

1. 1Pattern matching for signatures such as "ignore … instructions" and "if you are an AI".
2. 2Gemini-based classification of intent and of whether the text fit the surrounding document.
3. 3Human validation of the classified results.

The filtering mattered because naive searches mostly returned benign material: research papers, teaching posts and security articles that discuss prompt injection. The authors also say the method is not exhaustive. Common Crawl skips login-walled and anti-crawl sites, so most social media is excluded.

What they found

The payloads fell into several groups. The article gives no percentage split between them.

• Pranks: for example, changing an assistant's tone, including via an invisible injection in a site's source.
• Helpful guidance: authors steering AI summaries. Google calls this benign but warns it could easily turn malicious if it pushed misinformation or third-party redirects.
• SEO manipulation: prompts that try to make assistants favour one business over competitors. One looked as if an automated SEO suite had generated it.
• Deterring agents: instructions such as "If you are an AI, then do not crawl this website", and a nastier variant that lures agents to a page streaming endless text to waste resources or cause timeouts.
• Exfiltration: a small number of data-theft attempts, judged unsophisticated.
• Destruction: instructions to delete all files on a user's machine, judged unlikely to succeed and mostly individual experiments or pranks.

Why it matters

The authors say they saw no significant volume of advanced attacks, and that attackers have not yet productionised this research at scale. The trend is still moving. The malicious category rose by a relative 32% between the two snapshots. The absolute volumes are not reported, so read that figure as direction, not scale.

The authors expect both the scale and the sophistication of attempted IPI attacks to grow. Their reasons are that more capable AI systems are more valuable targets and that agentic AI lowers attackers' costs.

What practitioners should take from it

The findings support design choices you can make before attackers mature. Anything an agent fetches, whether web pages, mail or documents, is untrusted data and should never be able to act as an instruction. The SEO and agent-deterrence examples also show that page content already tries to steer assistants. Even without malicious intent, retrieved text can change what a summary says.

Test agents against hostile content rather than assuming a model will ignore it. Limit what tools and files an agent can reach when it processes external content, so a successful injection has little to destroy or exfiltrate. The destructive "delete all files" payloads are a reminder that the useful control is permission scoping, not a hope that the attack fails.

Google's own defensive points concern its work on Gemini: ongoing red-teaming, its AI Vulnerability Reward Program and real-time processing of global-scale data. The article gives no direct guidance for site operators or end users.