Indirect prompt injection (IPI) has emerged as one of the more persistent threat vectors facing AI-integrated productivity platforms. Unlike direct prompt attacks, IPI allows an adversary to embed malicious instructions inside data or tools that an LLM consumes during a task, potentially manipulating the model’s behavior without any direct user interaction. Google’s GenAI Security Team this week published a detailed look at the continuous defense cycle it has built around Workspace with Gemini.

Why IPI Resists a One-Time Fix

Google frames IPI as a permanently evolving problem rather than a discrete vulnerability to patch. The combination of increasingly capable agentic automation, diverse content sources, and a fast-moving adversarial research community means that defenses must be continuously refreshed rather than deployed once and forgotten.

Attack Discovery Pipeline

The team maintains several parallel channels for surfacing new attack techniques:

  • Human red-teaming: Specialized teams simulate attacks based on realistic user profiles, coordinating directly with product teams to resolve identified weaknesses.
  • Automated red-teaming: Machine-learning-driven frameworks algorithmically generate and iterate on attack payloads at scale, covering edge cases that manual testing cannot reach efficiently.
  • AI Vulnerability Rewards Program (VRP): External researchers report novel IPI techniques and are recognized through the program. Google also runs invite-only live hacking events against pre-release features.
  • Open-source intelligence: Social media, blogs, and press releases are monitored for publicly disclosed IPI attacks, which are then reproduced and cataloged internally.

All newly discovered issues flow into a centralized vulnerability catalog maintained by the Google Trust, Security, and Safety teams. Each entry is reproduced, deduplicated, categorized by attack technique and impact, and assigned to the appropriate owners.

Synthetic Data Acceleration

Once a new attack is cataloged, Google uses an internal tool called Simula to generate synthetic variants, expanding coverage for both training and validation datasets. The team reports that this workflow has increased synthetic data generation throughput by 75 percent, enabling faster retraining cycles and more rigorous defense evaluation.

Three Tiers of Defense Refinement

Google organizes its ongoing defenses into three layers, each updated through different mechanisms:

  • Deterministic defenses: Configuration-driven controls including user confirmation prompts, URL sanitization, and tool chaining policies. A centralized Policy Engine allows rapid point fixes, such as regex-based takedowns, that can be deployed faster than a full model refresh cycle.
  • ML-based defenses: Synthetic data is partitioned into training and held-out validation sets to retrain classifiers against new attack variants, with an architecture designed to support future automated model refresh pipelines.
  • LLM-based defenses: System prompt engineering is iteratively refined using new synthetic examples, optimized against agreed-upon defense effectiveness metrics to keep the underlying models resilient as threat techniques evolve.

Practical Implications

The disclosure is notable less for announcing a specific fix and more for illustrating the operational discipline required to manage IPI at enterprise scale. Security teams evaluating AI productivity tools should look for vendors that can articulate a comparable continuous improvement loop, covering discovery, synthetic augmentation, and multi-layer defense updating, rather than point-in-time mitigations.