Google published a detailed breakdown of how it continuously battles indirect prompt injection attacks inside Workspace and Gemini.
Indirect prompt injection (IPI) is an attack where a bad actor embeds malicious instructions in data an AI model reads - a calendar invite, an email, a shared document - rather than typing commands directly. Gemini processes that content, and if the attack lands, it follows the hidden instructions instead of the user's intent. Google's post describes a layered discovery-and-response pipeline: human and automated red teams identify new attack patterns, a vulnerability catalog tracks them, and an internal tool called Simula generates synthetic variants that feed back into ML model retraining and LLM prompt refinement. The company says this synthetic data workflow has accelerated by 75%, allowing faster evaluation cycles. Defenses span three layers: deterministic rules like URL sanitization and tool-chaining policies, ML model retraining, and LLM prompt engineering - plus a separate model-hardening process that trains Gemini itself to recognize and ignore injected instructions.
Unlike a traditional software vulnerability, IPI doesn't get patched once. Attackers adapt to new model behavior, forcing continuous iteration - a treadmill Google openly acknowledges rather than papers over. The stakes rise further with agentic AI, where the model takes actions on a user's behalf: a successful injection could theoretically send emails, access files, or exfiltrate data the user never meant to share.
Google closes with the line "every day you're safer with Google" - confident, and quietly honest that the threat never fully stops. Notably absent: any actual numbers on current attack success rates, before or after the improvements.