Prompt injection on the web: Google's crawl finds attackers experimenting, not yet at scale

Indirect prompt injection is widely discussed as a primary route for attacking AI agents. Google's Threat Intelligence teams set out to measure whether attackers are actually using it today. Their April 2026 write-up is one of the first public attempts to put real-world data behind the question.

What IPI is, and how Google looked for it

In an IPI attack the attacker is a third party. They plant instructions in content an AI system later processes, such as a website, email or document. The system may then follow those instructions instead of the user's original intent.

Google's source was Common Crawl, a public archive of the English-speaking web. Each monthly snapshot holds roughly 2-3 billion pages. The pipeline worked from coarse to fine:

1. 1Pattern matching for signatures such as "ignore … instructions" and "if you are an AI".
2. 2Classification with Gemini to judge intent and whether the text fits the page's narrative.
3. 3Human validation of what remained.

Google flags the limits itself. Common Crawl skips login-walled and anti-crawl sites, so most social media is excluded. The approach is not exhaustive and may miss uncommon signatures. Many raw matches were research papers or security articles about prompt injection rather than attacks.

What the crawl found

• Pranks: for example, an invisible injection telling agents to change their conversational tone.
• Helpful guidance: authors steering AI summaries towards extra context. Google calls this benign but notes it could become malicious if used for misinformation or redirection to third-party sites.
• SEO manipulation: injections meant to make AI assistants promote one business over its competitors. Some looked more sophisticated and appeared to come from automated SEO tools.
• Deterring agents: simple "if you are an AI, do not crawl this website" notices, plus a more hostile case that lures agents to a page streaming endless text to waste resources or cause timeouts.
• Data exfiltration: a small number of attempts. The example appeared to be a site author running an experiment.
• Destruction: several attempts to delete all files on a user's machine, which Google considers unlikely to succeed.

The trend matters more than the current severity

Google judges overall sophistication to be low. It saw no significant use of the advanced exfiltration prompts described in 2025 security research. Its reading is that attackers "have yet not productionized this research at scale". Most activity looked like individual authors running experiments or pranks.

The direction of travel is less comfortable. Across multiple archive versions, Google observed a relative 32% increase in the malicious category between November 2025 and February 2026. It gives no absolute counts, so the figure is a growth rate, not a measure of volume. Google expects growth in scale and sophistication as AI systems become more capable and agentic AI lowers the cost of attacking them.

What practitioners should take from it

This is evidence of attacker interest, not of widespread compromise, and it does not cover social media. Still, the SEO and agent-deterrence cases show that page authors already write for AI readers. Anything an agent browses can carry hostile instructions.

• Treat fetched web content as data, never as instructions, and keep it separated from the system prompt in your design.
• Apply least privilege to agent tools. File deletion and outbound data transfer are the capabilities the observed payloads targeted.
• Add timeouts and output limits so agents cannot be stalled by endless-content pages.
• Include indirect injection through browsed pages in AI red-team scope, not only direct jailbreaks.