Google Online Security Blog

http://googleonlinesecurity.blogspot.com/atom.xml (RSS订阅地址)

AI threats in the wild: The current state of prompt injections on the web

Posted by Thomas Brunner, Yu-Han Liu, Moni Pande<div> </div><div>At Google, our Threat Intelligence teams are dedicated to staying ahead of real-world adversarial activity, proactively monitoring emerging threats before they can impact users. Right now, Indirect Prompt Injection (IPI) is a top priority for the security community, anticipating it as a primary attack vector for adversaries to target and compromise AI agents. But while the danger of IPI is widely discussed, are threat actors actually exploiting this vector today – and if so, how?To answer these questions and to uncover real-world abuse, we initiated a broad sweep of the public web to monitor for known indirect prompt injection patterns. This is what we found. <h1 dir="ltr" style="line-height: 1.38; margin-bottom: 10pt; margin-top: 20pt;">The threat of indirect prompt injection</h1>Unlike a direct injection where a user "jailbreaks" a chatbot, IPI occurs when an AI system processes content—like a website, email, or document—that contains malicious instructions. When the AI reads this poisoned content, it may silently follow the attacker's commands instead of the user's original intent.This is not a new area of concern for us and Google has been working tirelessly to combat these threats. Our efforts involve cross-functional collaboration between researchers at Google DeepMind (GDM) and defenders like the Google Threat Intelligence Group (GTIG). We have previously detailed <a href="https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html" style="text-decoration: none;">our work in this area</a> and <a href="https://bughunters.google.com/blog/task-injection-exploiting-agency-of-autonomous-ai-agents" style="text-decoration: none;">researchers have further highlighted</a> the evolving nature of these vulnerabilities.Despite this collective focus, a fundamental question remains: to what degree are real-world malicious actors currently operationalizing these attacks?<h1 dir="ltr" style="line-height: 1.38; margin-bottom: 10pt; margin-top: 20pt;">Proactive monitoring at Google</h1><h2 dir="ltr" style="line-height: 1.38; margin-bottom: 8pt; margin-top: 18pt;">The landscape of IPI on the web</h2>There are many channels through which attackers might try to send prompt injections. However, one location is particularly easy to observe - the public web. Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them.Public <a href="https://greshake.github.io/" style="text-decoration: none;">research</a> confirms these attacks are possible; consequently, we should expect real-world adversaries to exploit these vulnerabilities to cause harm.Thus, we ask a basic question: What outcomes are real attackers trying to achieve today?For ease of access and reproducibility, we chose to use <a href="https://commoncrawl.org/" style="text-decoration: none;">Common Crawl</a>, which is a large repository of crawled websites from the English-speaking web. Common Crawl provides monthly snapshots of 2-3 billion pages each. These are mostly static websites, which includes self-published content such as blogs, forums and comments on these sites, but as a caveat it does not contain most social media content (e.g., LinkedIn, Facebook, X, …) as Common Crawl skips websites with login walls and anti-crawl directives.This means that, while prompt injections have been observed on social media, we reserve these for an upcoming separate study. For a first look, we can observe prompt injections even in standard HTML, for which Common Crawl conveniently provides not just the source, but also the parsed plaintext.<h2 dir="ltr" style="line-height: 1.38; margin-bottom: 8pt; margin-top: 18pt;">The challenge of false positives</h2>The task of scanning large amounts of documents for prompt injections may sound simple, but in reality is hindered by an overwhelming number of false positive detections.Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content. Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic. <img height="224" src="https://imgproxy.citrusreader.com/pPK76t0rPMidrJcBkkOg-FN4FVSNKUqratuDimn6gV0/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VqZHVNRVBXa0dfd3dPNjROTEZicVJlWlNEUFFUTWsxdC1UWEk3RWNOSE5MSHhHa05Ec0NqX2M4VFRVSzk4MXFxWERPLUZBdUhTMnExUXNiR205NzRsWVo5R1NTbEQ5d0lrUVV2eENPS0VGcmdBWVlhODZFMEFDMEp2V1R4dUZBSjBQTDFBckVVMXN5aFdUVmNOVll6MmEzTjJTdWJrWEtzcHlZM3BxdHFrdS05MEF3SzBjZnRoZVh3Nm5EZEhX" style="margin-left: 0px; margin-top: 0px;" width="608">False positives: Most prompt injections in web content tend to be education material for researchers. <a href="https://swisskyrepo.github.io/PayloadsAllTheThings/Prompt%20Injection/#tools" style="text-decoration: none;">(Source: GitHub/swisskyrepo)</a> When searching for prompt injections naively, the majority of detections are benign content – false positives in our case. Therefore, we opted for a coarse-to-fine filtering approach:<ul style="margin-bottom: 0px; margin-top: 0px; padding-inline-start: 48px;"><li aria-level="1" dir="ltr" style="font-family: Arial, sans-serif; font-size: 11pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Pattern Matching: We initially identified candidate pages by searching for a range of popular prompt injection signatures, like “ignore … instructions”, “if you are an AI”, etc.</li><li aria-level="1" dir="ltr" style="font-family: Arial, sans-serif; font-size: 11pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">LLM-Based Classification: These candidates were then processed by Gemini to classify the intent of the suspicious text, and to understand whether they were part of the overall document narrative or suspiciously out of place.</li><li aria-level="1" dir="ltr" style="font-family: Arial, sans-serif; font-size: 11pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Human Validation: A final round of manual review was conducted on the classified results to ensure high confidence in our findings.</li></ul>While this approach is not exhaustive and might miss uncommon signatures, it can serve as a starting point for understanding the quality of prompt injections in the wild. <h1 dir="ltr" style="line-height: 1.38; margin-bottom: 10pt; margin-top: 20pt;">What we found</h1>Our analysis revealed a range of attempts that, if successful, would try to manipulate AI systems browsing the website. Most of the prompt injections we observed fall into these categories:<ul style="margin-bottom: 0px; margin-top: 0px; padding-inline-start: 48px;"><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Harmless pranks</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Helpful guidance</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Search engine optimization (SEO)</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Deterring AI agents </li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;">Malicious</li><ul style="margin-bottom: 0px; margin-top: 0px; padding-inline-start: 48px;"><li aria-level="2" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; font-weight: 700; list-style-type: circle; vertical-align: baseline; white-space: pre;">Data exfiltration</li><li aria-level="2" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: circle; vertical-align: baseline; white-space: pre;">Destruction</li></ul></ul><h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 16pt;">Harmless Prank</h3>This class of prompt injection aims to cause mostly harmless side effects in AI assistants reading the website. We found many instances of this – consider the source code of this website, which contains an invisible prompt injection that instructs agents reading the website to change their conversational tone:<img height="119" src="https://imgproxy.citrusreader.com/MOsqVN_ITVLxEZIUsdEeXn-bfnEAxjfI3IeOljO_Dz0/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VndWZwZmpjWU1Lb3VGV2F0Z2pwQnFNa280WXRLVHNLaTV2Y1JGUGFzR3B4STdBNWlhREdaSzBnQ0REV09OMkVGeE84OTNKN3BEV250TDJvUk5mdE9QdUk2cXJJYTRQUV96Qm1DeFY1MUhSSTNnVGN1TVZqYUJhSEJ2ZUJIN29ORU8wTUN3akZWUUhUeGFON2c2VWVtckNTdlZRQ2Nsd1RYWUs4R3BrSTZBamsxTlRDZ0J4UnNwaUpXN1RyRlZB" style="margin-left: 0px; margin-top: 0px;" width="694"> <h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 10pt;">Helpful Guidance</h3>We also observed website authors who wanted to exert control over AI summaries in order to provide the best service to their readers. We consider this a benign example, since the prompt injection does not attempt to prevent AI summary, but instead instructs it to add relevant context.We note that this example could easily turn malicious if the instruction tried to add misinformation or attempted to redirect the user to third party websites.<img height="117" src="https://imgproxy.citrusreader.com/zwNeTJ4Ei8TfWVb981rmAmzTMAlCAcwj8wNd-_RVYgQ/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VqSFdWWEh5Wk1mVFh5RnJodEZhcGF6YUhSbmVsaTFkdjZJclJsVnNNYU9ZSF9xdWV3c1RTSHRnTFVIc0Z1Q2xqWGlkaTRkekp6Ym1YTzhpcERmNUhFekxJZXpMQ3hZZnpUQ1RYVTZDX0RUQXU3bWVwbVhraTRuN2ZZcUZVYS03Rm9qR2tiY21EeDRJSE5tWV9remJKRzVsQ0o2VFpiSkJGZEdwd1NOdDcxdEpUQk5mY0lBbmZrZXFCRXFyZXdE" style="margin-left: 0px; margin-top: 0px;" width="700"><h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 16pt;">Search Engine Optimization (SEO)</h3><h3 dir="ltr" style="line-height: 1.38; margin-bottom: 10pt; margin-top: 0pt;">Some websites include prompt injections for the purpose of SEO, trying to manipulate AI assistants into promoting their business over others:</h3><h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 0pt;"><img height="81" src="https://imgproxy.citrusreader.com/AWkjExsiZXwBmVEqd7Lj10n3arhkVUgUYLK4CgqNs2s/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0Voam9LMjdkZkxoYXViQnNPVmZZYkFzazdMbl9adl9RaG0xMUN5LWdSeUpFbkpxNW91aFpVaEZYN0FsRjFWUTdnV2xWWG5KLU9mclRRZDVJbDBMdkxxZGE2NVA1UjB4S19qX0RFcDJsQUlEVEMxMVZBSTNKYzhkOEI2Yl9KV2U1OHZQWjIyNWtRLTRBME9pclpQV21PRjVYTVBOQUdFUVhKVkpJLVRpX3J0NllGeUtqWkQ5eWtjdEtpRjQ0LWxy" style="margin-left: 0px; margin-top: 0px;" width="685"></h3> <h3 dir="ltr" style="line-height: 1.38; margin-bottom: 10pt; margin-top: 0pt;">While the above example is simple, we have also started to see more sophisticated SEO prompt injection attempts. Consider the intricate prompt below, which was seemingly generated by an automated SEO suite and inserted into website text:</h3><h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 16pt;"><img height="255" src="https://imgproxy.citrusreader.com/l0ReEm69cGj5Fa1ivTcvJ5DTO4lJNHOp7stvcO6tZOU/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoMWtEelZMTmpQVTFYVXlqeXZ3UjB1LWxZdm1LWUtYSWo2d0c4Yzh6QTRuWldGS2hoWXlmRXZ3MFFVc1V5bzRYVkpfNFhyY0tMSGlIQzdNQUlDR2pwRnRTX1BKWnJwRXlad0xHeE4zdWRyRnpzajRhV2JCbFpXVWVCa0dfNGtUWktuX2RaOXZ2YTN4ZFVNU3pfWjJWbVpCM0xsbW9FT1NsMUMzakhUM2lXclpnbGpaSmdhbW9mcHdCRkxmN0NE" style="margin-left: 0px; margin-top: 0px;" width="686"></h3><h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 16pt;">Deterring AI agents</h3>Some websites try to prevent retrieval by AI agents via prompt injection. There exist many examples of “If you are an AI, then do not crawl this website”. However, we also observed more insidious implementations: <img height="247" src="https://imgproxy.citrusreader.com/oSZvweMp6h6bbD4HAKgSfGj79Dh2J8OVshBsNKVJFVg/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoSmZnQkpicDdkdWdaU2xLSHRsUE15X0tLV1hnREJORk43RFAxZTNiN19kWUFheUtzYS1tYjhJazdNU0Q0aTZmVVg0enp5bHczekJwUHZTcFBrcjU4ekg3LVlHenZsWWFtV0xweEpiVHc4bzA2NFpTZXJnb0hoS2ZEWG5LMFRValp5QUg1Yk81dDRudXJaSmN3NUhMVVlNWFdveDh4R0JMWVdfTTQ3UC01X0tOYnZ0MktHcnhXc3lkcTFXNUk3" style="margin-left: 0px; margin-top: 0px;" width="683"> This injection tries to lure AI readers onto a separate page which, when opened, streams an infinite amount of text that never finishes loading. In this way, the author might hope to waste resources or cause timeout errors during the processing of their website.<h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 16pt;">Malicious: Exfiltration</h3>We were able to observe a small number of prompt injections that aim at theft of data. However, for this class of attacks, sophistication seemed much lower. Consider this example: <img height="113" src="https://imgproxy.citrusreader.com/qXyhKoJn4RxuwwSw-NgQvMjcHjgArrnFXbUzsSrZCBg/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VpcnRjWS03cE00YllDQU45aW1LSDk2RlBPMjBfOGVvejNXN3dpemZNM2VCR1hQWGVWTEJlQ1pZOFVEdnNZX2dPMVhnYjA5YWFIWmlhMkh2V1psVXlHX0xJMkhzWWRSZWMwdFpydDNIbUlDdkxJR1BzLXhSdzN6SFdnQjlobHFhY2prTkthMjg4MXZwRWNJMXphSjRNMWJKZ21sY0RVY0poNVBhRzFyQ29DNkRGZWhNTURyZkQ5Z25xbTdhWm5B" style="margin-left: 0px; margin-top: 0px;" width="680">As we can see, this is a website author performing an experiment. We did not observe significant amounts of advanced attacks (e.g. using known exfiltration prompts published by security researchers in 2025). This seems to indicate that attackers have yet not productionized this research at scale.<h3 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 16pt;">Malicious: Destruction</h3>Finally, we observed a number of websites that attempt to vandalize the machine of anyone using AI assistants. If executed, the commands in this example would try to delete all files on the user’s machine:<img height="177" src="https://imgproxy.citrusreader.com/JsQTSacNKGXi1NPu8hqZZ-SBXPvwUjf7TIenglUdQIo/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0Vpcm8tOTY0QjlpUkxYUnRVd0NYNm1DWm9OenFSR3gtQVRDYXNVUVJVRTV4b1liY2lLS2NWbGJjaFB4MlNKZmg0cEJyYm5GR1k0Q2pkVlpBV0RJNEFuTWR4c1RVTmNzS1Y4aU9uX2V1TlVsN0pkREIyLWlWX0tTaW1mVklhMzBScnhCamZFM2R4RnpqN2hpTmIwNVpUUGlaWFA4cnhUak5OVFBYbThWVUxLalNpTFdhU1duQWVONHlpeElHRklz" style="margin-left: 0px; margin-top: 0px;" width="685"> While potentially devastating, we consider this simple injection unlikely to succeed, which makes it similar to those in the other categories: We mostly found individual website authors who seemed to be running experiments or pranks, without replicating advanced IPI strategies found in recently published research. <h2 dir="ltr" style="line-height: 1.38; margin-bottom: 8pt; margin-top: 18pt;">What does this mean?</h2>Our results indicate that attackers are experimenting with IPI on the web. While the observed activity suggests limited sophistication, this might be only part of the bigger picture.For one, we scanned only an archive of the public web (CommonCrawl), which does not capture major social media sites. Additionally, even though sophistication was low, we observed an uptick in detections over time: We saw a relative increase of 32% in the malicious category between November 2025 and February 2026, repeating the scan on multiple versions of the archive. This upward trend indicates growing interest in IPI attacks. In general, threat actors tend to engage based on cost/benefit considerations. In the past, IPI attacks were considered exotic and difficult. And even when compromised, AI systems often were not able to execute malicious actions reliably.We believe that this could change soon. Today’s AI systems are much more capable, increasing their value as targets, while threat actors have simultaneously begun automating their operations with agentic AI, bringing down the cost of attack. As a result, we expect both the scale and sophistication of attempted IPI attacks to grow in the near future.<h1 dir="ltr" style="line-height: 1.38; margin-bottom: 10pt; margin-top: 20pt;">Moving forward</h1>Our findings indicate that, while past attempts at IPI attacks on the web have been low in sophistication, their upward trend suggests that the threat is maturing and will soon grow in both scale and complexity.At Google, we are prepared to face this emergent threat, as we continue to invest in hardening our AI models and products. Our dedicated red teams have been relentlessly pressure-testing our systems to ensure Gemini is robust to adversarial manipulation, and our <a href="https://bughunters.google.com/about/rules/google-friends/ai-vulnerability-reward-program-rules" style="text-decoration: none;">AI Vulnerability Reward Program</a> allows external researchers to participate. Finally, Google’s established ability to process global-scale data in real-time allows us to identify and neutralize threats before they can impact users. We remain committed to keeping the Internet safe and will continue to share intelligence with the community.To learn more about Google’s progress and research on generative AI threat actors, attack techniques, and vulnerabilities, take a look at the following resources:<ul style="margin-bottom: 0px; margin-top: 0px; padding-inline-start: 48px;"><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://security.googleblog.com/2026/04/google-workspaces-continuous-approach.html" style="text-decoration: none;">Google Workspace’s continuous approach to mitigating indirect prompt injections</a> (blog post) from Google’s GenAI security team</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html" style="text-decoration: none;">Mitigating prompt injection attacks with a layered defense strategy</a> (blog post) from Google’s GenAI security team</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://www.youtube.com/watch?v=IAhU1AAqxcY" style="text-decoration: none;">Beyond Speculation: Data-Driven Insights into AI and Cybersecurity</a> (RSAC 2025 conference keynote) from Google’s Threat Intelligence Group (GTIG)</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use?e=48754805" style="text-decoration: none;">AI Threat Tracker</a> (report) from Google’s Threat Intelligence Group (GTIG)</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://research.google/pubs/an-introduction-to-googles-approach-for-secure-ai-agents/" style="text-decoration: none;">Google's Approach for Secure AI Agents</a> (white paper) from Google’s Secure AI Framework (SAIF) team</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://deepmind.google/discover/blog/advancing-geminis-security-safeguards/" style="text-decoration: none;">Advancing Gemini's security safeguards</a> (blog post) from Google’s DeepMind team</li><li aria-level="1" dir="ltr" style="font-family: Arial, sans-serif; font-size: 12pt; font-variant: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><a href="https://storage.googleapis.com/deepmind-media/Security%20and%20Privacy/Gemini_Security_Paper.pdf" style="text-decoration: none;">Lessons from Defending Gemini Against Indirect Prompt Injections</a> (white paper) from Google’s DeepMind team</li></ul> </div>

2026/4/23

Bringing Rust to the Pixel Baseband

Posted by Jiacheng Lu, Software Engineer, Google Pixel Team Google is continuously advancing the security of Pixel devices. We have been focusing on hardening the cellular baseband modem against exploitation. <a href="https://security.googleblog.com/2023/12/hardening-cellular-basebands-in-android.html">Recognizing the risks</a> associated within the complex modem firmware, Pixel 9 shipped with <a href="https://security.googleblog.com/2024/10/pixel-proactive-security-cellular-modems.html">mitigations</a> against a range of memory-safety vulnerabilities. For Pixel 10, Google is advancing its proactive security measures further. Following our previous discussion on <a href="https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html">"Deploying Rust in Existing Firmware Codebases"</a>, this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware. The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying the foundation for broader adoption of memory-safe code in other areas. Here we share our experience of working on it, and hope it can inspire the use of more memory safe languages in low-level environments. <h3>Why Modem Memory Safety Can’t Wait</h3> In recent years, we have seen increasing interest in the cellular modem from attackers and security researchers. For example, Google's Project Zero <a href="https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html">gained remote code execution</a> on Pixel modems over the Internet. Pixel modem has tens of Megabytes of executable code. Given the complexity and remote attack surface of the modem, other critical memory safety vulnerabilities may remain in the predominantly memory-unsafe firmware code. <h3>Why DNS?</h3> The DNS protocol is most commonly known in the context of browsers finding websites. With the evolution of cellular technology, modern cellular communications have migrated to digital data networks; consequently, even basic operations such as call forwarding rely on DNS services. DNS is a complex protocol and requires parsing of untrusted data, which can lead to vulnerabilities, particularly when implemented in a memory-unsafe language (example: <a href="https://nvd.nist.gov/vuln/detail/cve-2024-27227">CVE-2024-27227</a>). Implementing the DNS parser in Rust offers value by decreasing the attack surfaces associated with memory unsafety. <h3>Picking a DNS library</h3> DNS already has a level of support in the open-source Rust community. We evaluated multiple open source crates that implement DNS. Based on <a href="https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html#:~:text=Existing%20Crate">criteria shared in earlier posts</a>, we identified <a href="https://crates.io/crates/hickory-proto">hickory-proto</a> as the best candidate. It has excellent maintenance, over 75% test coverage, and widespread adoption in the Rust community. Its pervasiveness shows its potential as the de-facto DNS choice and long term support. Although hickory-proto initially lacked <code>no_std</code> support, which is needed for Bare-metal environments (see our <a href="https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html#:~:text=Bare%2Dmetal%20Environments">previous post</a> on this topic), we were able to add support to it and its dependencies. <h2>Adding <code>no_std</code> support</h2> The work to enable <code>no_std</code> for hickory-proto is mostly mechanical. We shared the process <a href="https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html#:~:text=Porting%20a%20std%20Library%20to%20no_std">in a previous post</a>. We undertook modifications to hickory_proto and its dependencies to enable <code>no_std</code> support. The upstream <code>no_std</code> work also results in a <code>no_std</code> URL parser, beneficial to other projects. <ul> <li><a href="https://github.com/hickory-dns/hickory-dns/pull/2104">https://github.com/hickory-dns/hickory-dns/pull/2104</a></li> <li><a href="https://github.com/servo/rust-url/pull/831">https://github.com/servo/rust-url/pull/831</a></li> <li><a href="https://github.com/krisprice/ipnet/pull/58">https://github.com/krisprice/ipnet/pull/58</a></li> </ul> The above PRs are great examples of how to extend <code>no_std</code> support to existing std-only crates. <h2>Code size study</h2> Code size is the one of the factors that we evaluated when picking the DNS library to use. <table border="1" cellpadding="8" cellspacing="0" style="border-collapse: collapse; width: 100%;"> <tbody> <tr> <td rowspan="3" style="width: 25%;">Code size by category</td> <td>Rust implemented Shim that calls Hickory-proto on receiving a DNS response</td> <td style="width: 15%;">4KB</td> </tr> <tr> <td>core, alloc, compiler_builtins (reusable, one-time cost)</td> <td>17KB</td> </tr> <tr> <td>Hickory-proto library and dependencies</td> <td>350KB</td> </tr> </tbody> </table> <hr style="border: 0; border-top: 2px solid #f0f0f0;"> <table border="1" cellpadding="8" cellspacing="0" style="border-collapse: collapse; width: 100%;"> <tbody> <tr> <td style="width: 25%;">Sum</td> <td></td> <td style="width: 15%;">371KB</td> </tr> </tbody> </table> We built prototypes and measured size with <a href="https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html#:~:text=Build%20Optimizations">size-optimized settings</a>. Expectedly, <code>hickory_proto</code> is not designed with embedded use in mind, and is not optimized for size. As the Pixel modem is not tightly memory constrained, we prioritized community support and code quality, leaving code size optimizations as future work. However, the additional code size may be a blocker for other embedded systems. This could be addressed in the future by adding additional feature flags to conditionally compile only required functionality. Implementing this modularity would be a valuable future work. <h3>Hook-up Rust to modem firmware</h3> Before building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and <a href="https://doc.rust-lang.org/nomicon/ffi.html"><code>FFI</code></a> to verify the integration of Rust with the existing modem firmware code base. <h2>Compile Rust code to staticlib</h2> While using <code>cargo</code> is the default choice for compilation in the Rust ecosystem, it <a href="https://security.googleblog.com/2021/05/integrating-rust-into-android-open.html#:~:text=No%20nested%20build%20systems">presents challenges</a> when integrating it into existing build systems. We evaluated two options: <ol> <li>Using <code>cargo</code> to build a <a href="https://doc.rust-lang.org/beta/rustc/command-line-arguments.html#--crate-type-a-list-of-types-of-crates-for-the-compiler-to-emit"><code>staticlib</code></a> before the modem builds. Then add the produced staticlib into the linking step.</li> <li>Directly work with <code>rustc</code> and integrate the Rust compilation steps into the existing modem build system.</li> </ol> Option #1 does not scale if we are going to add more Rust components in the future, as linking multiple staticlibs may cause <a href="https://github.com/rust-lang/rust/issues/44322">duplicated symbol errors</a>. We chose option #2 as it scales more easily and allows tighter integration into our existing build system. Our existing C/C++ codebase uses <a href="https://pigweed.dev/">Pigweed</a> to drive the primary build system. Pigweed supports Rust targets (<a href="https://cs.opensource.google/pigweed/pigweed/+/main:pw_build/rust_library.gni;drc=87f7abc323e345dd2729d5039a7ee0ee49c2fd56">example</a>) with direct calls to <a href="https://cs.opensource.google/pigweed/pigweed/+/main:pw_toolchain/generate_toolchain.gni;l=415;drc=e194c83f1d063833745f49da8f85b583be9774bb"><code>rustc</code></a> through <a href="https://gn.googlesource.com/gn/+/main/docs/reference.md#buildfile-functions-tool_specify-arguments-to-a-toolchain-tool_back-to-top-usage"><code>rust tools</code> defined in <code>GN</code></a>. We compiled all the Rust crates, including hickory-proto, its dependencies, and core, compiler_builtin, alloc, to <a href="https://doc.rust-lang.org/reference/linkage.html#r-link.rlib"><code>rlib</code></a>. Then, we created a <code>staticlib</code> target with a single lib.rs file which references all the <a href="https://doc.rust-lang.org/reference/linkage.html#r-link.rlib"><code>rlib</code></a> crates using <a href="https://doc.rust-lang.org/std/keyword.crate.html"><code>extern crate</code></a> keywords. <h2>Build core, alloc, and compiler_builtins</h2> <a href="https://android.googlesource.com/toolchain/android_rust/+/mirror-goog-main-rust-toolchain-source">Android’s Rust Toolchain</a> distributes source code of <code>core</code>, <code>alloc</code>, and <code>compiler_builtins</code>, and we leveraged this for the modem. They can be included to the build graph by adding a <code>GN</code> target with <a href="https://gn.googlesource.com/gn/+/main/docs/reference.md#var_crate_root"><code>crate_root</code></a> pointing to the root <code>lib.rs</code> of each crate. Pixel modem firmware already has a well-tested and specialized global memory allocation system to support some dynamic memory allocations. <code>alloc</code> support was added by implementing the <a href="https://doc.rust-lang.org/alloc/alloc/trait.GlobalAlloc.html">GlobalAlloc</a> with <a href="https://doc.rust-lang.org/nomicon/ffi.html">FFI</a> calls to the allocators C APIs: <pre><code class="language-rust">use core::alloc::{GlobalAlloc, Layout}; extern "C" { fn mem_malloc(size: usize, alignment: usize) -> *mut u8; fn mem_free(ptr: *mut u8, alignment: usize); } struct MemAllocator; unsafe impl GlobalAlloc for MemAllocator { unsafe fn alloc(&self, layout: Layout) -> *mut u8 { mem_malloc(layout.size(), layout.align()) } unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) { mem_free(ptr, layout.align()); } } #[global_allocator] static ALLOCATOR: MemAllocator = MemAllocator; </code></pre> Pixel modem firmware already implements a backend for the Pigweed <a href="https://pigweed.dev/pw_assert/#backend-api">crash facade</a> as the global crash handler. Exposing it into Rust <code>panic_handler</code> through FFI unifies the crash handling for both Rust and C/C++ code. <pre><code class="language-rust">#![no_std] use core::panic::PanicInfo; extern "C" { pub fn PwCrashBackend(sigature: *const i8, file_name: *const i8, line: u32); } #[panic_handler] fn panic(panic_info: &PanicInfo) -> ! { let mut filename = ""; let mut line_number: u32 = 0; if let Some(location) = panic_info.location() { filename = location.file(); line_number = location.line(); } let mut cstr_buffer = [0u8; 128]; // Never writes to the last byte to make sure `cstr_buffer` is always zero // terminated. let (_, writer) = cstr_buffer.split_last_mut().unwrap(); for (place, ch) in writer.iter_mut().zip(filename.bytes()) { *place = ch; } unsafe { PwCrashBackend( "Rust panic\0".as_ptr() as *const i8, cstr_buffer.as_ptr() as *const i8, line_number, ); } loop {} } </code></pre> <h2>Link Rust staticlib</h2> The Pixel modem firmware linking has a step that calls the linker to link all the objects generated from C/C++ code. By using <code>llvm-ar -x</code> to extract object files from the Rust combined staticlib and supplying them to the linker, the Rust code appears in the final modem image. There was a performance issue we experienced due to weak symbols during linking. The inclusion of Rust <code>core</code> and <code>compiler-builtin</code> caused unexpected power and performance regressions on various tests. Upon analysis, we realized that modem optimized implementations of <code>memset</code> and <code>memcpy</code> provided by the modem firmware are accidentally replaced by those defined in <code>compiler_builtin</code>. It seems to happen because both <code>compiler_builtin</code> crate and the existing codebase defines symbols as weak, linker has no way to figure out which one is weaker. We fixed the regression by stripping the <code>compiler_builtin</code> crate before linking using a one line shell script. <pre><code class="language-bash">llvm-ar -t <rust staticlib> | grep compiler_builtins | xargs llvm-ar -d <rust staticlib> </code></pre> <h3>Integrating hickory-proto</h3> <h2>Expose Rust API and calling back to C++</h2> For the DNS parser, we declared the DNS response parsing API in C and then implemented <a href="https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html#:~:text=Exposing%20the%20Same%20API">the same API</a> in Rust. <pre><code class="language-c">int32_t process_dns_response(uint8_t*, int32_t); </code></pre> The Rust function returns an integer standing for the error code. The received DNS answers in the DNS response are required to be updated to in-memory data structures that are coupled with the original C implementation, therefore, we use existing C functions to do it. The existing C functions are dispatched from the Rust implementation. <pre><code class="language-rust">pub unsafe extern "C" fn process_dns_response( dns_response: *const u8, response_len: i32, ) -> i32 { //... validate inputs `dns_response` and `response_len`. // SAFETY: // It is safe because `dns_response` is null checked above. `response_len` // is passed in, safe as long as it is set correctly by vendor code. match process_response(unsafe { slice::from_raw_parts(dns_response, response_len) }) { Ok(()) => 0, Err(err) => err.into(), } } fn process_response(response: &[u8]) -> Result<()> { let response = hickory_proto::op::Message::from_bytes(response)?; let response = hickory_proto::xfer::DnsResponse::from_message(response)?; for answer in response.answers() { match answer.record_type() { hickory_proto::RecordType:... => { // SAFETY: // It is safe because the callback function does not store // reference of the inputs or their members. unsafe { callback_to_c_function(...)?; } } // ... more match arms omitted. } } Ok(()) } </code></pre> In our case, the DNS responding parsing function API is simple enough for us to hand write, while the callbacks back to C functions for handling the response have complex data type conversions. Therefore, we leveraged bindgen to generate FFI code for the callbacks. <h2>Build third-party crates</h2> Even with all features disabled, hickory-proto introduces more than 30 dependent crates. Manually written build rules are difficult to ensure correctness and scale poorly when upgrading dependencies into new versions. Fuchsia has developed <a href="https://fuchsia.googlesource.com/fuchsia/+/master/tools/cargo-gnaw/"><code>cargo-gnaw</code></a> to support building their third party Rust crates. <code>Cargo-gnaw</code> works by invoking <code>cargo metadata</code> to resolve dependencies, then parse and generate GN build rules. This ensures correctness and ease of maintenance. <h3>Conclusion</h3> The Pixel 10 series of phones marks a pivotal moment, being the first Pixel device to integrate a memory-safe language into its modem. While replacing one piece of risky attack surface is itself valuable, this project lays the foundation for future integration of memory-safe parsers and code into the cellular baseband, ensuring the baseband’s security posture will <a href="https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html#:~:text=Final%20thoughts">continue to improve</a> as development continues. Special thanks to Armando Montanez, Bjorn Mellem, Boky Chen, Cheng-Yu Tsai, Dominik Maier, Erik Gilling, Ever Rosales, Hungyen Weng, Ivan Lozano, James Farrell, Jeffrey Vander Stoep, Jiacheng Lu, Jingjing Bu, Min Xu, Murphy Stein, Ray Weng, Shawn Yang, Sherk Chung, Stephan Chen, Stephen Hines.

2026/4/10

Protecting Cookies with Device Bound Session Credentials

Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team Following our April 2024 <a href="https://blog.chromium.org/2024/04/fighting-cookie-theft-using-device.html">announcement</a>, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape. Session theft typically occurs when a user inadvertently downloads malware onto their device. Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server. Infostealer malware families, such as LummaC2, have become increasingly sophisticated at harvesting these credentials. Because cookies often have extended lifetimes, attackers can use them to gain unauthorized access to a user’s accounts without ever needing their passwords; this access is then often bundled, traded, or sold among threat actors. Crucially, once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies. As a result, there is no reliable way to prevent cookie exfiltration using software alone on any operating system. Historically, mitigating session theft relied on detecting the stolen credentials after the fact using a complex set of abuse heuristics – a reactive approach that persistent attackers could often circumvent. DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users’ accounts. <h3>How DBSC Works</h3> DBSC protects against session theft by cryptographically binding authentication sessions to a specific device. It does this using hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS, to generate a unique public/private key pair that cannot be exported from the machine. The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server. Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless to those attackers. This design allows large and small websites to upgrade to secure, hardware-bound sessions by adding dedicated registration and refresh endpoints to their backends, while maintaining complete compatibility with their existing front-end. The browser handles the complex cryptography and cookie rotation in the background, allowing the web app to continue using standard cookies for access just as it always has. Google rolled out an early version of this protocol over the last year. For sessions protected by DBSC, we have observed a significant reduction in session theft since its launch. <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjk4eZvzfBqPL0Xf1ckUo7l58eyeZKSzIelxjLOiOE_XHYNZc-qdx24Sv9n3tgRgc2xOzKZvcHsCksprOlxwd-gIRQaLPsOu2jjuCV4e6G1_ImsXhQeOean1CWndOiQuikT94gbvZLlWfktpCBRtxh9dJkxjpfvradSkzWD1Wqxohg9TJUdyC1kC88y6Abu/s1600/Screenshot%202026-04-09%20at%2010.11.22%E2%80%AFAM.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="828" data-original-width="1364" src="https://imgproxy.citrusreader.com/zZasOeIwJVRq3qh3FKuWB4bnp8lBNWEqTG0rF1cjZtw/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqazRlWnZ6ZkJxUEwwWGYxY2tVbzdsNThleWVaS1N6SWVseGpMT2lPRV9YSFlOWmMtcWR4MjRTdjluM3RnUmdjMnhPektadmNIc0Nrc3ByT2x4d2QtZ0lSUWFMUHNPdTJqanVDVjRlNkcxX0ltc1hoUWVPZWFuMUNXbmRPaVF1aWtUOTRnYnZaTGxXZmt0cENCUnR4aDlkSmt4anBmdnJhZFNreldEMVdxeG9oZzlUSlVkeUMxa0M4OHk2QWJ1L3MxNjAwL1NjcmVlbnNob3QlMjAyMDI2LTA0LTA5JTIwYXQlMjAxMC4xMS4yMiVFMiU4MCVBRkFNLnBuZw"></a></div> An overview of the DBSC protocol showing the interaction between the browser and server. <h3>Private by design</h3> A core tenet of the DBSC architecture is the preservation of user privacy. Each session is backed by a distinct key, preventing websites from using these credentials to correlate a user's activity across different sessions or sites on the same device. Furthermore, the protocol is designed to be lean: it does not leak device identifiers or attestation data to the server beyond the per-session public key required to certify proof of possession. This minimal information exchange ensures DBSC helps secure sessions without enabling cross-site tracking or acting as a device fingerprinting mechanism. <h3>Engagement with the ecosystem</h3> DBSC was designed from the beginning to be an open web standard through the W3C process and adoption by the Web Application Security Working Group. Through this process we partnered with Microsoft to design the standard to ensure it works for the web and got input from many in the industry that are responsible for web security. Additionally, over the past year, we have also conducted two Origin Trials to ensure DBSC effectively serves the requirements of the broader web community. Many web platforms, including Okta, actively participated in these trials and their own testing and provided essential feedback to ensure the protocol effectively addresses their diverse needs. If you are a web developer and are looking for a way to secure your users against session theft, refer to our <a href="https://developer.chrome.com/docs/web-platform/device-bound-session-credentials">developer guide</a> for implementation details. Additionally, all the details about DBSC can be found on the <a href="https://w3c.github.io/webappsec-dbsc/">spec</a> and the corresponding <a href="https://github.com/w3c/webappsec-dbsc">github</a>. Feel free to use the <a href="https://github.com/w3c/webappsec-dbsc/issues">issues</a> page to report bugs or provide feature requests. <h3>Future improvements</h3> As we continue to evolve the DBSC standard, future iterations will focus on increasing support across diverse ecosystems and introducing advanced capabilities tailored for complex enterprise environments. Key areas of ongoing development include: <ul> <li>Securing Federated Identity: In modern enterprise environments, Single Sign-On (SSO) is ubiquitous. We are expanding the DBSC protocol to support cross-origin bindings, ensuring that a relying party (RP) session remains continuously bound to the same original device key used by the Identity Provider (IdP). This guarantees that the high-assurance security of the initial device binding is maintained throughout the entire federated login process, creating an unbroken chain of trust.</li> <li>Advanced Registration Capabilities: While DBSC provides robust protection for established cookies, some environments require an even stronger foundation when the session is first created. We are developing mechanisms to bind DBSC sessions to pre-existing, trusted key material rather than generating a new key at sign-in. This advanced capability enables websites to integrate complementary technologies, such as mTLS certificates or hardware security keys, creating a highly secure registration environment.</li> Broader Device Support: We are also actively exploring the potential addition of software-based keys to extend protections to devices without dedicated secure hardware. </ul>

2026/4/9

Google Workspace’s continuous approach to mitigating indirect prompt injections

Posted by Adam Gavish, Google GenAI Security Team<div> </div><div><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM as it completes the user’s query. This may even be possible without any input directly from the user. <span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">IPI is not the kind of technical problem you “solve” and move on. Sophisticated LLMs with increasing use of agentic automation combined with a wide range of content create an ultra-dynamic and evolving playground for adversarial attacks. That’s why Google takes a sophisticated and comprehensive approach to these attacks. We’re continuously improving LLM resistance to IPI attacks and launching AI application capabilities with ever-improving defenses. <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini.  <span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">In our previous blog “<a href="https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html" style="text-decoration-line: none;"><span face=""Google Sans Text", sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Mitigating prompt injection attacks with a layered defense strategy</a><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">”, we reviewed the layered architecture of our IPI defenses. In this blog, we’ll share more detail on the continuous approach we take to improve these defenses and to solve for new attacks.<h2 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 18pt;"><span face=""Google Sans Text", sans-serif" style="font-size: 16pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">New attack discovery</h2><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">By proactively discovering and cataloging new attack vectors through internal and external programs, we can identify vulnerabilities and deploy robust defenses ahead of adversarial activity. <h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Human Red-Teaming</h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Human <a href="https://cloud.google.com/transform/how-google-does-it-building-an-effective-ai-red-team?utm_campaign=644972bd5b9473000116d347&utm_content=69b98c1e13c0120001542de7&utm_medium=smarpshare&utm_source=linkedin" style="text-decoration-line: none;"><span face=""Google Sans Text", sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Red-Teaming</a><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> uses adversarial simulations to uncover security and safety vulnerabilities. Specialized teams execute attacks based on realistic user profiles to exploit weaknesses, coordinating with product teams to resolve identified issues.<h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Automated Red-Teaming</h4><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Automated Red-Teaming is done via dynamic, machine-learning-driven frameworks to stress-test environments. By algorithmically generating and iterating on attack payloads, we can mimic the behavior of sophisticated threats at scale. This allows us to map complex attack paths and validate the effectiveness of our security controls across a much wider range of edge cases than manual testing could achieve on its own.<h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Google AI Vulnerability Rewards Program (VRP)</h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">The <a href="https://bughunters.google.com/about/rules/google-friends/ai-vulnerability-reward-program-rules" style="text-decoration-line: none;"><span face=""Google Sans Text", sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Google AI Vulnerability Rewards Program (VRP)</a><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> is a critical tool for enabling collaboration between Google and external security researchers who discover new attacks leveraging IPI. Through this VRP, we recognize and reward contributors for their research.  We also host regular, live hacking events where we provide invited researchers access to pre-release features, proactively uncovering novel vulnerabilities. These partnerships enable Google to quickly validate, reproduce, and resolve externally-discovered issues.<h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Publicly disclosed AI attacks </h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Google utilizes open-source intelligence feeds to stay on top of the latest publicly disclosed IPI attacks, across social media, press releases, blogs, and more. From there, new AI vulnerabilities are sourced, reproduced, and catalogued internally to ensure our products are not impacted. <h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Vulnerability catalog </h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">All newly discovered vulnerabilities go through a comprehensive analysis process performed by the Google Trust, Security, & Safety teams. Each new vulnerability is reproduced, checked for duplications, mapped into attack technique / impact category, and assigned to relevant owners. The combination of new attack discovery sources and vulnerability catalog process helps Google stay on top of the latest attacks in an actionable manner. <span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQW2DFy08BHE1u92K8MiOGld7PIVOPqXkC_ACb2tJTcHhA4nG84w5spynWi-W9KcgJWW9mMfyDB1bvdwr-64mtYkkvKPPocpxVUI3pyB-QHXcBgJMXpfYRneCA14pqgDFs9e14xGJGIFOGVAUUrH2up-rju3CwMPjLsl7HtIhGSgrqPRlElqYt4G2af6Dc/s1306/Screenshot%202026-03-31%20at%2010.15.44%E2%80%AFAM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="800" data-original-width="1306" src="https://imgproxy.citrusreader.com/SpxO3HAo6uAi_uC2j5ulUCJJaTAzeSdzXfIXTtJlVEY/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VpUVcyREZ5MDhCSEUxdTkySzhNaU9HbGQ3UElWT1BxWGtDX0FDYjJ0SlRjSGhBNG5HODR3NXNweW5XaS1XOUtjZ0pXVzltTWZ5REIxYnZkd3ItNjRtdFlra3ZLUFBvY3B4VlVJM3B5Qi1RSFhjQmdKTVhwZllSbmVDQTE0cHFnREZzOWUxNHhHSkdJRk9HVkFVVXJIMnVwLXJqdTNDd01QakxzbDdIdEloR1NncnFQUmxFbHFZdDRHMmFmNkRjL3MxNjAwMC9TY3JlZW5zaG90JTIwMjAyNi0wMy0zMSUyMGF0JTIwMTAuMTUuNDQlRTIlODAlQUZBTS5wbmc"></a></div><h2 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 18pt;"><span face=""Google Sans Text", sans-serif" style="font-size: 16pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Synthetic data generation </h2><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">After we discover, curate, and catalog new attacks, we use <a href="https://openreview.net/pdf?id=VOoeogZbMb" style="text-decoration-line: none;"><span face=""Google Sans Text", sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Simula</a><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> to generate synthetic data expanding these new attacks. This process is essential because it allows the team to develop attack variants for completeness and coverage, and to prepare new training and validation data sets. This accelerated workflow has boosted synthetic data generation by 75%, supporting large-scale defense model evaluation and retraining, as well as updating the data set used for calculating and reporting on defense effectiveness. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghY30BDTqV9cG1siMIPHCah6tX1wVhw9WEWHx3cB9tlnm0UlAFHcRF74jzgdWRNamv2B29EpnI1sB4Ztijj9w0Y9-V82JVjSIKoZXaeKxbP_ptOzdRbTWe0W9sfHXlznjAnid0QjGleKvilFV46qk7qjbcNFFBu07HiEbBSZADgpnpZlnuHICHpUNe6Xzv/s1310/Screenshot%202026-03-31%20at%2010.16.24%E2%80%AFAM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="810" data-original-width="1310" src="https://imgproxy.citrusreader.com/cHF1q0-Tqqeh4NHWgMVXyU6TaBwW5JTL4CHe9sXddUc/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VnaFkzMEJEVHFWOWNHMXNpTUlQSENhaDZ0WDF3Vmh3OVdFV0h4M2NCOXRsbm0wVWxBRkhjUkY3NGp6Z2RXUk5hbXYyQjI5RXBuSTFzQjRadGlqajl3MFk5LVY4MkpWalNJS29aWGFlS3hiUF9wdE96ZFJiVFdlMFc5c2ZIWGx6bmpBbmlkMFFqR2xlS3ZpbEZWNDZxazdxamJjTkZGQnUwN0hpRWJCU1pBRGdwbnBabG51SElDSHBVTmU2WHp2L3MxNjAwMC9TY3JlZW5zaG90JTIwMjAyNi0wMy0zMSUyMGF0JTIwMTAuMTYuMjQlRTIlODAlQUZBTS5wbmc"></a></div><h2 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 18pt;"><span face=""Google Sans Text", sans-serif" style="font-size: 16pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Ongoing defense refinement </h2><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Continually updating and enhancing our defense mechanisms allows us to address a broader range of attack techniques, effectively reducing the overall attack surface. Updating each defense type requires different tasks, from config updates, to prompt engineering and ML model retraining. <h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Deterministic Defenses</h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Deterministic <a href="https://saif.google/focus-on-agents" style="text-decoration-line: none;"><span face=""Google Sans Text", sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">defenses</a><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">, including user confirmation, URL sanitization, and tool chaining policies, are designed for rapid response against new or emerging prompt injection attacks by relying on simple configuration updates. These defenses are governed by a centralized Policy Engine, with configurations for policies like baseline tool calls, URL sanitization, and tool chaining. For immediate threats, this configuration-based system facilitates a streamlined process for "point fixes," such as regex takedowns, providing an agile defense layer that acts faster than traditional ML/LLM model refresh cycles.<h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">ML-Based Defenses</h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">After generating synthetic data that expands new attacks into variants, the next step is to retrain our ML-based defenses to mitigate these new attacks. We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples. This approach ensures repeatability, data consistency for fixed training/testing, and establishes a scalable architecture to support future extensions towards fully automated model refresh.<h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face=""Google Sans Text", sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">LLM-Based Defenses</h4><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Using the new synthetic data examples, our LLM-based defenses go through prompt engineering with refined system instructions. The goal is to iteratively optimize these prompts against agreed-upon defense effectiveness metrics, ensuring the models remain resilient against evolving threat vectors.<h4 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 14pt;"><span face="Arial, sans-serif" style="color: #666666; font-size: 12pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Gemini Model Hardening </h4><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Beyond system-level guardrails and application-level defenses, we prioritize <a href="https://deepmind.google/blog/advancing-geminis-security-safeguards/" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">‘model hardening’</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">, a process that improves the Gemini model's internal capability to identify and ignore harmful instructions within data. By utilizing synthetic datasets and fresh attack patterns, we can model various threat iterations. This enables us to strengthen the Gemini model's ability to disregard harmful embedded commands while following the user's intended request. Through this process of model hardening, Gemini has become significantly more adept at detecting and disregarding injected instructions. This has led to a reduction in the success rate of attacks without compromising the model's efficiency during routine operations.<h2 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 18pt;"><span face="Arial, sans-serif" style="font-size: 16pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Defense effectiveness </h2><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">To measure the real-world impact of defense improvements, we simulate attacks against many Workspace features. This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evaluation. The simulation is run against multiple Workspace apps, such as Gmail and Docs, using a standardized set of assets to ensure reliable results. To determine the exact impact of a defense improvement (e.g., an updated ML model or a new LLM prompt optimization), the end-to-end evaluation is run with and without the defense enabled. This comparative testing provides the essential "before and after" metrics needed to validate defense efficacy and drive continuous improvement. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7Ue0_cO2rj4eBwCNMuiNJWHGPlw51p7ZPcSj8C0InvE64MHO3p8BJmGtG9OVg9560Se7zdGN5Pej0ZBa1qKIkzJ6r3IzDmtbNiAxpB4cA6pvX3mKngHvsr1OBgcpmPDyvFVPNRIJyUcnztSPIqLZiDVrI7-okFUz0nfeW5xvbivXAPSsyuuYIiG0rGkzn/s1308/Screenshot%202026-03-31%20at%2010.17.11%E2%80%AFAM.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="806" data-original-width="1308" src="https://imgproxy.citrusreader.com/F2cWarLXdKPGL4SJu7rY_ZrBNBEIQO54Q5G7SDTk7b0/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqN1VlMF9jTzJyajRlQndDTk11aU5KV0hHUGx3NTFwN1pQY1NqOEMwSW52RTY0TUhPM3A4QkptR3RHOU9WZzk1NjBTZTd6ZEdONVBlajBaQmExcUtJa3pKNnIzSXpEbXRiTmlBeHBCNGNBNnB2WDNtS25nSHZzcjFPQmdjcG1QRHl2RlZQTlJJSnlVY256dFNQSXFMWmlEVnJJNy1va0ZVejBuZmVXNXh2Yml2WEFQU3N5dXVZSWlHMHJHa3puL3MxNjAwMC9TY3JlZW5zaG90JTIwMjAyNi0wMy0zMSUyMGF0JTIwMTAuMTcuMTElRTIlODAlQUZBTS5wbmc"></a></div> <h2 dir="ltr" style="line-height: 1.38; margin-bottom: 6pt; margin-top: 18pt;"><span face=""Google Sans Text", sans-serif" style="font-size: 16pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Moving forward </h2><span face=""Google Sans Text", sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Our commitment to AI security is rooted in the principle that every day you’re safer with Google. While the threat landscape of indirect prompt injection evolves, we are building Workspace with Gemini to be a secure and trustworthy platform for AI-first work. IPI is a complex security challenge, which requires a defense-in-depth strategy and continuous mitigation approach. To get there, we’re combining world-class security research, automated pipelines, and advanced ML/LLM-based models. This robust and iterative framework helps to ensure we not only stay ahead of evolving threats but also provide a powerful, secure experience for both our users and customers. </div>

2026/4/2

VRP 2025 Year in Review

Posted by Dirk G<span style="font-family: "Google Sans", sans-serif; font-size: 10pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">öhmann, Tony Mendez, and the Vulnerability Rewards Program Team<div> </div><div><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally <a href="https://security.googleblog.com/2010/11/rewarding-web-application-security.html" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">started in 2010</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Coming back to 2025 specifically, <span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe – across all of our <a href="https://bughunters.google.com/about/rules/6744710187712512" style="text-decoration-line: none;"><span face="Roboto, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">programs</a><span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">. <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; font-weight: 700; vertical-align: baseline; white-space-collapse: preserve;">Vulnerability Reward Program 2025 in Numbers <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"><img height="325" src="https://imgproxy.citrusreader.com/t6h6sf2KQvG5B4bcGL0cwX1VyOcCjwvn7x5g03IQ27U/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VoNGY0ZXE3S3BmSFp4ck52YjA4Zng3QTRpSjN0Rk5pc3dFYk0yLUpUdFhuUk85cXZmWDlkRnQ5MEFzc0l2Wk9LcHRnMFNRLVZYLU91bVRkVU4tQ0hoMTQ0MDR6RnpWVmJtZWZuaHRsaEF4T1p6blZwaUpxU3M4YkU2alNQWlROS1F2WHlua1JmRUJDUFZJalpCQ0x4TnY4QjltU05hVnlrLWhraUJ3QUdjdGIzemROWXZNdVlzcFlZWUVMVjk0" style="margin-left: 0px; margin-top: 0px;" width="624"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"><img height="325" src="https://imgproxy.citrusreader.com/7cDjFpoywOqeeYFPikWjawrGjOMo2mtoK5p0NS3GZ1k/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYS9BVnZYc0VnR3RDNFkzQTlYWWdFZ2NBRG90MWN0SUxvbjZUdHEweE5sRmNZNGVzb2VlR05UeGtqd1VEZnVaRWZ5NGZOaXA0UTJCSHFCdk9nS21HWEFaX1FSckpHTlo3bmw2S1Y3VmNmSlBuWGRwRlJBQUJDdWdITnBmYjRkZ1UxejRiNFVPZEJkakFacHdfTmxPZTVJUWROTUVXUFRHYk0wVnZUal9fV1pNeUg0amhQeUd5bVgtT0lyZlBUcXgyTmMyNjg2" style="margin-left: 0px; margin-top: 0px;" width="624"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Want to learn more about who’s reporting to the VRP? Check out our <a href="https://bughunters.google.com/leaderboard" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Leaderboard</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> on the <a href="https://bughunters.google.com/" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Google Bug Hunters site</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">. <span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; font-weight: 700; vertical-align: baseline; white-space-collapse: preserve;">VRP Highlights in 2025 <span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: <ul style="margin-bottom: 0px; margin-top: 0px; padding-inline-start: 48px;"><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">The new, dedicated AI VRP was <a href="https://bughunters.google.com/blog/6116887259840512/announcing-google-s-new-ai-vulnerability-reward-program" style="text-decoration-line: none;"><span style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">launched</a><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">, underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts.</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">Similarly, the Chrome VRP now also includes reward categories for problems found in <a href="https://bughunters.google.com/about/rules/chrome-friends/5745167867576320/chrome-vulnerability-reward-program-rules#gemini-ai-vulnerabilities" style="text-decoration-line: none;"><span style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">AI features</a><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">.</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">We <a href="https://bughunters.google.com/blog/6551590643040256/new-patch-rewards-program-for-osv-scalibr" style="text-decoration-line: none;"><span style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">launched</a><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;"> a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulnerability, or secret detection that expand the tool’s scanning capabilities. Besides strengthening the tool’s capabilities for all users, user submissions already helped us uncover and remediate a number of leaked secrets internally!</li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">As part of Google's Cybersecurity Awareness Month campaign in October, we hosted our very own <a href="https://bughunters.google.com/blog/6489680025550848/escal8-2025-gathering-cybersecurity-expertise-in-mexico-city" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">security conference in Mexico City, ESCAL8</a><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">. The conference included init.g(mexico), our cybersecurity workshop for students, HACKCELER8, Google’s CTF finals, and a <span style="font-size: 11pt; font-style: italic; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">Safer with Google<span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;"> seminar, sharing technical thought leadership with Mexican government officials. </li><li aria-level="1" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: disc; vertical-align: baseline; white-space: pre;"><span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">bugSWAT, <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">our special invite-only live hacking event, saw several editions in 2025 and<span style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;"> <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">delivered some outstanding findings across different areas:</li><ul style="margin-bottom: 0px; margin-top: 0px; padding-inline-start: 48px;"><li aria-level="2" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: circle; vertical-align: baseline; white-space: pre;"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">We hosted our first dedicated <a href="https://bughunters.google.com/blog/5753079171252224/ai-bugswat-in-tokyo-2025-hacker-roadshow" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">AI bugSWAT (Tokyo) in April</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;"> which yielded a whopping 70+ reports filed and over $400,000 in rewards issued. </li><li aria-level="2" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: circle; vertical-align: baseline; white-space: pre;"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">We continued the momentum in early summer with <a href="https://bughunters.google.com/blog/hardening-google-cloud-insights-from-the-latest-cloud-vrp-bugswat" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">Cloud bugSWAT (Sunnyvale) in June</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;"> resulting in 130 reports, with $1,600,000 in rewards paid out.</li><li aria-level="2" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: circle; vertical-align: baseline; white-space: pre;"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">Next in line was bugSWAT Las Vegas in August, leading to 77 reports and rewards of $380,000. </li><li aria-level="2" dir="ltr" style="font-family: Roboto, sans-serif; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; list-style-type: circle; vertical-align: baseline; white-space: pre;"><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;">And finally, as part of ESCAL8 in Mexico City, <a href="https://bughunters.google.com/blog/6489680025550848/escal8-2025-gathering-cybersecurity-expertise-in-mexico-city#bugswat-hacking-for-a-safer-internet" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; text-wrap-mode: wrap; vertical-align: baseline;">bugSWAT Mexico</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-wrap-mode: wrap; vertical-align: baseline;"> focused on many different targets and spaces including AI, Android, and Cloud, and resulted in the filing of 107 reports, totalling $566,000 in rewards to date. </li></ul></ul> <span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; font-weight: 700; vertical-align: baseline; white-space-collapse: preserve;">Looking for more details?<span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> See the <a href="https://bughunters.google.com/blog/google-vrps-in-review-2025" style="text-decoration-line: none;"><span face="Roboto, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">extended version of this post</a><span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> on the Security Engineering blog for reports from individual VRPs such as Android, Abuse, AI, Cloud, Chrome, and OSS, including specifics concerning high-impact bug reports and focus areas of security research. <h3 dir="ltr" style="line-height: 1.38; margin-bottom: 4pt; margin-top: 16pt;"><span face="Arial, sans-serif" style="color: #434343; font-size: 14pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">What’s coming in 2026</h3><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">In 2026, we remain fully committed to fostering collaboration, innovation, and transparency with the security community by hosting several bugSWAT events throughout the year, and following up with the next edition of our cybersecurity conference, ESCAL8. More broadly, our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services – all of which is only possible in collaboration with the external community of researchers we are so lucky to collaborate with!  <span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">In this spirit, we’d like to extend a huge thank you to our bug hunter community for helping us make Google products and platforms more safe and secure for our users around the world – and invite researchers not yet engaged with the Vulnerability Reward Program to join us in our mission to keep Google safe (check out our <a href="https://bughunters.google.com/about/rules/6744710187712512" style="text-decoration-line: none;"><span face="Arial, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">programs</a><span face="Arial, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> for inspiration 🙂)! <span face="Roboto, sans-serif" style="font-size: 11pt; font-style: italic; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Thank you to Tony Mendez, Dirk Göhmann, Alissa Scherchen, Krzysztof Kotowicz, Martin Straka, Michael Cote, Sam Erb, Jason Parsons, Alex Gough, and Mihai Maruseac.  <span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;">Tip: Want to be informed of new developments and events around our Vulnerability Reward Program? Follow the<a href="https://x.com/GoogleVRP" style="text-decoration-line: none;"><span face="Roboto, sans-serif" style="color: black; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> <span face="Roboto, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Google VRP channel</a><span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> on X to stay in the loop and be sure to check out the<a href="https://bughunters.google.com/blog" style="text-decoration-line: none;"><span face="Roboto, sans-serif" style="color: black; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> <span face="Roboto, sans-serif" style="color: #1155cc; font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; text-decoration-line: underline; text-decoration-skip-ink: none; vertical-align: baseline; white-space-collapse: preserve;">Security Engineering blog,</a><span face="Roboto, sans-serif" style="font-size: 11pt; font-variant-alternates: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-numeric: normal; font-variant-position: normal; vertical-align: baseline; white-space-collapse: preserve;"> which covers topics ranging from VRP updates to security practices and vulnerability descriptions! </div>

2026/3/31

Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android

Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play Modern digital security is at a turning point. <a href="https://blog.google/innovation-and-ai/technology/safety-security/the-quantum-era-is-coming-are-we-ready-to-secure-it/">We are on the threshold of using quantum computers to solve "impossible" problems</a> in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, the same unique ability to consider different options simultaneously also allows these machines to bypass our current digital locks. This puts the public-key cryptography we’ve relied on for decades at risk, potentially compromising everything from bank transfers to trade secrets. To secure our future, it is vital to adopt the new Post-Quantum Cryptography (PQC) standards National Institute of Standards and Technology (NIST) is urging before large-scale, fault-tolerant quantum computers become a reality. To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC). We have been <a href="https://blog.google/innovation-and-ai/technology/safety-security/the-quantum-era-is-coming-are-we-ready-to-secure-it/">preparing for a post-quantum world since 2016</a>, conducting pioneering experiments with post-quantum cryptography, rolling out post-quantum capabilities in our products, and sharing our expertise through threat models and technical papers. For Android, the objective extends beyond patching individual applications or transport protocols. The imperative is to ensure that the entire platform architecture is resilient for the decades to come. We are beginning tests of PQC enhancements starting in the next Android 17 beta, followed by general availability in the Android 17 production release. This deployment introduces a comprehensive architectural upgrade that is being rolled out across the operating system. By integrating the recently finalized <a href="https://www.nist.gov/pqc">NIST PQC standards</a> deep into the platform, we’re establishing a new, quantum-resistant chain of trust. This chain of trust secures the platform continuously—from the moment the OS powers on, to the execution of applications distributed globally. Android is swapping today’s digital locks for advanced encryption to help enhance the security of every app you download—no matter how powerful future supercomputers get. <h3>Securing the foundation: Verified boot and hardware trust</h3> Security on any computing device begins when the hardware starts; if the underlying operating system is compromised, all subsequent software protections fail. As quantum computing advances, adversaries could potentially forge digital signatures to bypass these foundational integrity checks. To secure the platform against this looming threat, Android 17 introduces two major post-quantum cryptographic (PQC) upgrades: <ol> <li>Upgrading Android Verified Boot (AVB): The AVB library is integrating the Module-Lattice-Based Digital Signature Algorithm (ML-DSA). This provides quantum-resistant digital signatures, ensuring the software loaded during the boot sequence remains highly resistant to unauthorized modification.</li> <li>Migrating Remote Attestation: Android 17 begins the transition of Remote Attestation to a fully PQC-compliant architecture under the current standards. By updating KeyMint's certificate chains to support quantum-resistant algorithms, devices can securely prove their state to relying parties, maintaining trust in a post-quantum environment.</li> </ol> <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhb5lOnA0GCP-Le-JkSsDvVv50etaBwWjTGUzmKcqN92u9L1qVjVZTa5Ij9_Q-GSrHrfW55y_tQbPPgMbdT-VMh3FQecBdPbqiKLEV502tDWKZMz48PGMWtgFzFJFQGAZ8R0rFf-vCcSwHK73632o8eKa78uvvhrq9OGDwgmtnzdbkJjymnAtGbk_SXKeO2/s1600/Blog%20Post%20-%20Post%20Quantum%20Chain%20of%20Trust%20-%20inline%20v03.jpg" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1080" data-original-width="1920" src="https://imgproxy.citrusreader.com/mtXRX_vDSlXp5Eu6oUN1nM7QEyatsK6G-6q9twwNK0o/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VoYjVsT25BMEdDUC1MZS1Ka1NzRHZWdjUwZXRhQndXalRHVXptS2NxTjkydTlMMXFWalZaVGE1SWo5X1EtR1NySHJmVzU1eV90UWJQUGdNYmRULVZNaDNGUWVjQmRQYnFpS0xFVjUwMnREV0taTXo0OFBHTVd0Z0Z6RkpGUUdBWjhSMHJGZi12Q2NTd0hLNzM2MzJvOGVLYTc4dXZ2aHJxOU9HRHdnbXRuemRia0pqeW1uQXRHYmtfU1hLZU8yL3MxNjAwL0Jsb2clMjBQb3N0JTIwLSUyMFBvc3QlMjBRdWFudHVtJTIwQ2hhaW4lMjBvZiUyMFRydXN0JTIwLSUyMGlubGluZSUyMHYwMy5qcGc"></a></div> <h3>Empowering developers: Android Keystore updates</h3> Protecting the underlying operating system is only the first layer of defense; developers must be equipped with the cryptographic primitives necessary to leverage PQC keys and establish robust identity verification. Implementing lattice-based cryptography, which requires significantly larger key sizes and memory footprints than classical elliptic curve cryptography, within the severely resource-constrained Trusted Execution Environment (TEE), represents a major engineering achievement. This capability is designed to support the hardware roots of trust and can now generate and verify post-quantum signatures. Building on this hardware foundation, Android 17 updates Android Keystore to natively support ML-DSA. This allows applications to leverage quantum-safe signatures entirely within the device’s secure hardware, isolating sensitive key material from the main operating system. The SDK exposes both ML-DSA-65, and ML-DSA-87, enabling developers to seamlessly integrate these using the standard <a href="https://developer.android.com/reference/java/security/KeyPairGenerator">KeyPairGenerator</a> API. This establishes a new era of identity and authentication for the app ecosystem without requiring developers to engineer proprietary cryptographic implementations. <h3>Ecosystem scale: Bringing hybrid signing to Google Play apps and games </h3> Android is committed to ensuring the platform is PQC resistant and extending the chain of PQC resistance to application signatures. The mechanisms used to verify the authenticity of applications are being upgraded to ensure that app installations and subsequent updates are strictly tamper-proof against quantum-enabled signature forgery. The platform will verify PQC signatures over APKs to enable this chain of trust. To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing. This approach provides an immediate bridge to quantum safety for the majority of active installs. Google Play will let developers automatically generate 'hybrid' signature blocks that combine classical and PQC keys. Updating keys across billions of active devices is a complex operational endeavor. Play App Signing leverages <a href="https://cloud.google.com/security/products/security-key-management">Google Cloud KMS</a>, which helps ensure industry-leading compliance standards, to secure signing keys. By managing signing keys securely in the cloud, Google Play enables developers to seamlessly upgrade their app security to PQC standards without the burden of complex, manual key management. During the Android 17 release cycle, Google Play will handle the generation of quantum-safe ML-DSA signing keys for new apps and existing apps that opt-in, independent of the applications target API . Later, developers will be able to choose their own classical and ML-DSA signing keys and delegate them to Google Play for their hybrid key upgrade. To promote security best practices, Google Play will also start prompting developers to upgrade their signing keys at least every two years. <h3>The cryptographic roadmap: From authenticity to privacy</h3> <a href="https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html">Google’s post-quantum transition began in 2016</a>, and Android 17 marks the first phase of Android’s post-quantum transition: <ul> <li>Securing the foundation: We are upholding the integrity of our attestation and Chain of Trust by incorporating ML-DSA into Android Verified Boot.</li> <li>Empower Developers: The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application. </li> <li>Ecosystem Scale: By using hybrid signatures for APKs, developers can create a protected transition that preserves current trust while adding post-quantum defenses to block unauthorized updates.</li> </ul> Our roadmap further integrates post-quantum key encapsulation into KeyMint, Key Attestation and Remote Key Provisioning. This evolution is intended to bolster the security of the entire identity lifecycle—from hardware-level DICE measurements to our remote attestation servers—ensuring the Android ecosystem remains resilient and private against the quantum threats of tomorrow.

2026/3/25

Cultivating a robust and efficient quantum-safe HTTPS

Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, <a href="https://datatracker.ietf.org/wg/plants/about/">PKI, Logs, And Tree Signatures</a> (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of <a href="https://csrc.nist.gov/projects/post-quantum-cryptography">quantum-resistant cryptography</a> introduces into TLS connections requiring <a href="https://certificate.transparency.dev/howctworks/">Certificate Transparency</a> (CT). We recently <a href="https://blog.google/innovation-and-ai/technology/safety-security/the-quantum-era-is-coming-are-we-ready-to-secure-it/">shared</a> our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we’ve taken to address them in earlier <a href="https://blog.chromium.org/2023/08/protecting-chrome-traffic-with-hybrid.html">blog</a> <a href="https://blog.chromium.org/2024/05/advancing-our-amazing-bet-on-asymmetric.html">posts</a>. To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the <a href="https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.md">Chrome Root Store</a>. Instead, Chrome, in collaboration with other partners, is developing an <a href="https://drive.google.com/file/d/1KQXAGBHXR4S_prwFrZlyfA6DrpvfJwuJ/view">evolution</a> of HTTPS certificates based on <a href="https://datatracker.ietf.org/doc/draft-ietf-plants-merkle-tree-certs/">Merkle Tree Certificates</a> (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact <a href="https://research.swtch.com/tlog#merkle_trees">Merkle Tree proofs</a>. In this model, a Certification Authority (CA) signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree. <h3 style="text-align: left;">Why MTCs?</h3> MTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today’s internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of issuance: it is impossible to issue a certificate without including it in a public tree. This means the security properties of today’s CT ecosystem are included by default, and without adding extra overhead to the TLS handshake as CT does today. <h3 style="text-align: left;">Chrome’s MTC Propagation Plan</h3> Chrome is already experimenting with MTCs with real internet traffic, and we intend to gradually build out our deployment such that MTCs provide a robust quantum-resistant HTTPS available for use throughout the internet. Broadly speaking, our rollout spans three distinct phases. <ul> <li>Phase 1 (UNDERWAY): In <a href="https://www.google.com/url?q=https://blog.cloudflare.com/bootstrap-mtc/&sa=D&source=docs&ust=1770666818817662&usg=AOvVaw3YI8DKCxh8bqHxgrDZe04O">collaboration</a> with Cloudflare, we are conducting a feasibility study to evaluate the performance and security of TLS connections relying on MTCs. To ensure a seamless and secure experience for Chrome users who might encounter an MTC, every MTC-based connection is backed by a traditional, trusted X.509 certificate during this experiment. This "fail safe" allows us to measure real-world performance gains and verify the reliability of MTC issuance without risking the security or stability of the user's connection.</li> </ul> <ul> <li>Phase 2 (Q1 2027): Once the core technology is validated, we intend to invite CT Log <a href="https://certificate.transparency.dev/logs/">operators</a> with at least one “<a href="https://googlechrome.github.io/CertificateTransparency/log_states.html">usable</a>” log in Chrome before February 1, 2026 to participate in the initial bootstrapping of public MTCs. These organizations have already demonstrated the operational excellence and high-availability infrastructure required to run global security services that underpin TLS connections in Chrome. Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.</li> </ul> <ul> <li>Phase 3 (Q3 2027): Early in Phase 2, we will finalize the requirements for onboarding additional CAs into the new Chrome Quantum-resistant Root Store (CQRS) and corresponding Root Program that only supports MTCs. This will establish a modern, purpose-built trust store specifically designed for the requirements of a post-quantum web. The Chrome Quantum-resistant Root Program will operate alongside our <a href="https://security.googleblog.com/2023/05/how-chrome-root-program-keeps-users-safe.html">existing Chrome Root Program</a> to ensure a risk-managed transition that maintains the highest levels of security for all users. This phase will also introduce the ability for sites to opt in to downgrade protections, ensuring that sites that only wish to use quantum-resistant certificates can do so.</li> </ul> This area is evolving rapidly. As these phases progress, we will continue our active participation in standards bodies such as the IETF and <a href="https://github.com/C2SP/C2SP">C2SP</a>, ensuring that insights gathered from our efforts flow back towards standards, and that changes in standards are supported by Chrome and the CQRS. <h3 style="text-align: left;">Cultivating new practices and policy for a more secure and reliable web</h3> We view the adoption of MTCs and a quantum-resistant root store as a critical opportunity to ensure the robustness of the foundation of today’s ecosystem. By designing for the specific demands of a modern, agile, internet, we can accelerate the adoption of post-quantum resilience for all web users. We expect this modern foundation for TLS to evolve beyond current ecosystem norms and emphasize themes of security, simplicity, predictability, transparency and resilience. These properties might be expressed by: <ul> <li>Grounding our approach in first principles, prioritizing only elements essential for establishing a secure connection between a server and a client.</li> <li>Utilizing <a href="https://datatracker.ietf.org/doc/html/rfc8555">ACME</a>-only workflows to reduce complexity and ensure the cryptographic agility required to respond to future threats across the entire ecosystem.</li> <li>Upgrading to a modern framework for communicating revocation status. This allows for the replacement of legacy CRLs and streamlined requirements to focus only on key compromise events. </li> <li>Exploring “reproducible” <a href="https://security.googleblog.com/2025/12/https-certificate-industry-phasing-out.html">Domain Control Validation</a> to create a model where proofs of domain control are publicly and persistently available, empowering any party to independently verify the legitimacy of a validation (i.e., serve as a “DCV Monitor”).</li> <li>Enhancing the CA inclusion model to prioritize proven operational excellence. By establishing a pathway where prospective MTC CA Owners can first demonstrate their reliability as Mirroring Cosigners and DCV Monitors, we ensure that acceptance is based on verified performance and a reliable track record. </li> <li>Evolving the third-party oversight model to prioritize complete, continuous, and externally verifiable monitoring. This shift would focus on ensuring a high standard of transparency and consistency, providing immediate and reliable insights into performance that can replace the function of annual third-party audits.</li> </ul> To secure the future of the web, we are dedicating our operational resources to two vital parallel tracks. First, we remain fully committed to supporting our current CA partners in the Chrome Root Store, facilitating root rotations to ensure existing non-quantum-resistant hierarchies remain robust and conformant with the Chrome Root Program Policy. Simultaneously, we are focused on building a secure future by developing and launching the infrastructure required to support MTCs and their default use in Chrome. We also expect to support “traditional” X.509 certificates with quantum-resistant algorithms for use only in private PKIs (i.e., those not included in the Chrome Root Store) later this year. As we execute and refine our work on MTCs, we look forward to sharing a concrete policy framework for a quantum-resistant root store with the community, and are excited to learn and define clear pathways for organizations to operate as Chrome-trusted MTC CAs.

2026/2/27

Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection

Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9ayiNS_mohG01oo-z0b-tV2YipKpwBiepwyWZQ3BVw5p79JHUUWSinlFZAi7q0VhhRhrbP4SEXp37TP3MHo_3lYf176kJRbUbq_7tFBaBrzDbOdMy2FQDC1SG66jw2ay2f8Fr34JHdCWf12CyjD1ZY1NHwfx-aplzwqLWTbKqQ0pTeg9VT9O8Q-O65tfj/s1600/Android%20Scam%20Protection%20Header_2026.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1182" data-original-width="2096" src="https://imgproxy.citrusreader.com/uGAEtzcDKVbJLZzB_ag-RJdeBNUqH1Cz5-vd-dmEJMA/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VpOWF5aU5TX21vaEcwMW9vLXowYi10VjJZaXBLcHdCaWVwd3lXWlEzQlZ3NXA3OUpIVVVXU2lubEZaQWk3cTBWaGhSaHJiUDRTRVhwMzdUUDNNSG9fM2xZZjE3NmtKUmJVYnFfN3RGQmFCcnpEYk9kTXkyRlFEQzFTRzY2ancyYXkyZjhGcjM0SkhkQ1dmMTJDeWpEMVpZMU5Id2Z4LWFwbHp3cUxXVGJLcVEwcFRlZzlWVDlPOFEtTzY1dGZqL3MxNjAwL0FuZHJvaWQlMjBTY2FtJTIwUHJvdGVjdGlvbiUyMEhlYWRlcl8yMDI2LnBuZw"></a></div> We’ve <a href="https://security.googleblog.com/2025/10/how-android-protects-you-from-scams.html">shared</a> how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month1. While that scale is significant, the true impact of these protections is best understood through the stories of the individuals they help keep safe every day. This includes people like Majik B., an IT professional in Sunnyvale, California. Despite his technical background, Majik recently found himself on a call that felt dangerously legitimate. While using his Pixel, he received a call that appeared to be from his bank. The number looked correct, the caller knew his name and his address, and the story about a "suspicious charge" made perfect sense. "I’m usually pretty careful about this stuff," Majik recalled, "but I stayed on the line longer than I normally would. Even knowing how these scams work, it was convincing in the moment." The turning point came when his phone displayed a Scam Detection warning during the call, which provided a critical moment to pause and reflect. Majik hung up, checked his bank app directly, and confirmed there was no fraudulent charge. For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”. While stories like Majik’s show how our existing protections provide a robust shield against scams, our work isn't done. As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead. A recent <a href="https://counterpointresearch.com/en/insights/assessing-the-state-of-ai-powered-mobile-security-blog">evaluation</a> by Counterpoint Research found that Android smartphones provide the most comprehensive AI-powered protections of any mobile platform. We are committed to building on this foundation by expanding our AI-powered protections to more users and devices, while rolling out new features that utilize on-device AI to defend against increasingly sophisticated threats. <h3>Expanding Scam Detection for Calls to Samsung Devices</h3> To help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud. We are bringing these protections to more of our users through new regional expansion and availability on new devices. Scam Detection for phone calls on Google Pixel devices is available in the US, UK, Australia, Canada, France, Germany, India, Ireland, Italy, Japan, Mexico, and Spain. Scam Detection is already helping millions of users to stay safe from scammers, and we are expanding this feature to more manufacturers, starting with the Samsung Galaxy S26 series in the U.S. We are continuing to work with our partners to bring these industry-leading protections to even more users. Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that the processing stays on your device. This keeps your conversations private while delivering warnings in real-time. To preserve your privacy, the phone conversation processed by Scam Detection is neither stored on your device, nor shared outside of the device. To ensure you stay in total control of your experience, Scam Detection is turned off by default. When enabled, the feature only applies to calls identified as potential scams and is never used in calls with your contacts. You can easily manage these preferences in your phone settings whenever you choose. <h3>Enhanced Protection Against Messaging Scams</h3> We want everyone to feel secure when they open their messages, no matter where they are or what language they speak. To make this possible, we’ve now expanded Scam Detection for Google Messages to more than 20 countries. This includes support for several languages including English, Arabic, French, German, Portuguese, and Spanish. Beyond reaching more people, we are also making our protections more intelligent. We are enhancing how Google Messages identifies fraudulent texts by utilizing our <a href="https://blog.google/technology/ai/google-gemini-ai/#:~:text=We%E2%80%99re%20also%20bringing%20Gemini%20to%20Pixel">Gemini on-device model</a> on the latest Android flagship devices in the US, Canada, and the UK. The added power of Gemini’s on-device model allows for a much more nuanced analysis of complex conversational threats. For example, it can better detect the subtle conversational patterns used in job offer scams or sophisticated romance baiting scams (also known as “pig butchering”), a deceptive tactic where a scammer builds a long-term "relationship" with a potential victim to gain their trust, before tricking them into a fraudulent investment. Because these methods rely on gradual manipulation and don’t present typical warning signs, they need more advanced capabilities to catch them at scale. These advanced protections are now rolling out on Google Pixel 10 series and other select devices, and will be available on the Samsung Galaxy S26 series. <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDGwI3nRzYAhKXU48umCrIsGF9jj5DWdvtL4jc-wDDVxZnPUkuOaoHuf5tk1Xk5K9UH2dlVAw2YnIOJhpSYrXtOXE4iE7EfFckPHkLBQJjqCTJ4XG-RNtND7RMy6NE-R3wVMD4IshCl6foO8oSmBZsiVNlHlGF_jNO-eMl70Bi7SqMGtw-2RRIjKy4LPC0/s1600/Android%20Scam%20Detection%20GIF_1.gif" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1080" data-original-width="1080" src="https://imgproxy.citrusreader.com/f30CO5u-9o8uhnuRwcdReg82OABKGEgKgVCFOxIbdAw/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqREd3STNuUnpZQWhLWFU0OHVtQ3JJc0dGOWpqNURXZHZ0TDRqYy13RERWeFpuUFVrdU9hb0h1ZjV0azFYazVLOVVIMmRsVkF3MlluSU9KaHBTWXJYdE9YRTRpRTdFZkZja1BIa0xCUUpqcUNUSjRYRy1STnRORDdSTXk2TkUtUjN3Vk1ENElzaENsNmZvTzhvU21CWnNpVk5sSGxHRl9qTk8tZU1sNzBCaTdTcU1HdHctMlJSSWpLeTRMUEMwL3MxNjAwL0FuZHJvaWQlMjBTY2FtJTIwRGV0ZWN0aW9uJTIwR0lGXzEuZ2lm"></a></div> Gemini<del>-</del>powered Scam Detection alerts a user to a job offer scam <h3>Using the Best of Google AI to Set the Standard in Mobile Scam Protection</h3> Android continues to set the standard in mobile scam protections by leveraging advanced AI to identify and intercept threats as they happen. As scammer’s strategies shift, we remain committed to developing equally adaptive and intelligent defenses. Our goal is to provide you with peace of mind so you can continue to connect and communicate with confidence, knowing our multi-layered defenses are there to help protect your financial and personal data against mobile scams. <hr> Disclaimers 1: This total comprises all instances where a message or call was proactively blocked or where a user was alerted to potential spam or scam activity.

2026/2/25

Keeping Google Play & Android app ecosystems safe in 2025

Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNWPkN36d-E-0ZgVQNZYRep5TH3AnZltbtmu6PO7XLRULe4BuLMiRjS9z25JVTNu-imtoi2efJL2p-T4hu7eXdVirZIoNwIhEOY1p7pVtZwpzsmzIV8chhYOOz7ML5qFHoS0gz7Q3sNQwInc4sV4AaHavaIwn5twlSmjmuHG66uasapArBcBNMIg0XG0et/s1600/SafeAppEcosystem_BlogHero_Still_1920x1080.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1080" data-original-width="1920" src="https://imgproxy.citrusreader.com/3qwgPX9Zign53wRoR29BSCiHHY8oQck7jBzUUjAKudM/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqTldQa04zNmQtRS0wWmdWUU5aWVJlcDVUSDNBblpsdGJ0bXU2UE83WExSVUxlNEJ1TE1pUmpTOXoyNUpWVE51LWltdG9pMmVmSkwycC1UNGh1N2VYZFZpclpJb053SWhFT1kxcDdwVnRad3B6c216SVY4Y2hoWU9PejdNTDVxRkhvUzBnejdRM3NOUXdJbmM0c1Y0QWFIYXZhSXduNXR3bFNtam11SEc2NnVhc2FwQXJCY0JOTUlnMFhHMGV0L3MxNjAwL1NhZmVBcHBFY29zeXN0ZW1fQmxvZ0hlcm9fU3RpbGxfMTkyMHgxMDgwLnBuZw"></a></div> The Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy invasions. As bad actors leverage AI to change their tactics and launch increasingly sophisticated attacks, we’ve deepened our investments in AI and real-time defenses over the last year to maintain the upper hand and stop these threats before they reach users. <h3>Upgrading Google Play’s AI-powered, multi-layered user protections</h3> We’ve seen a clear impact from these safety efforts on Google Play. In 2025, we prevented over 1.75 million policy-violating apps from being published on Google Play and banned more than 80,000 bad developer accounts that attempted to publish harmful apps. These figures demonstrate how our proactive protections and push for a more accountable ecosystem are discouraging bad actors from publishing malicious apps, while our new tools help honest developers build compliant apps more easily. Initiatives like developer verification, mandatory pre-review checks, and testing requirements have raised the bar for the Google Play ecosystem, significantly reducing the paths for bad actors to enter. <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXqjB3En8VZFiwKb-q2dzxMdWauGxhuxJyMFuwwRrEMYLvx8EvQbpyfwth1M1SamrAc8vwZvZVoP4GYe7PPpFVwFTevniOYB7bLFAWPQ8cD074hraPEkevtcTnVgPbP_OO9Oo0Ohl6-3LpwaRAUnt-uwzSNcl5yEvYK7uBNEpBNGaQds8c5-ynRhsKCseL/s1600/SafeAppEcosystem_HeroVisual_3Claims_1920x1080.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1080" data-original-width="1920" src="https://imgproxy.citrusreader.com/N2T7_l4xyA8u9zLxhskg6rbngkDdXrGKZW3WURAK9Yg/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VoWHFqQjNFbjhWWkZpd0tiLXEyZHp4TWRXYXVHeGh1eEp5TUZ1d3dSckVNWUx2eDhFdlFicHlmd3RoMU0xU2FtckFjOHZ3WnZaVm9QNEdZZTdQUHBGVndGVGV2bmlPWUI3YkxGQVdQUThjRDA3NGhyYVBFa2V2dGNUblZnUGJQX09POU9vME9obDYtM0xwd2FSQVVudC11d3pTTmNsNXlFdllLN3VCTkVwQk5HYVFkczhjNS15blJoc0tDc2VML3MxNjAwL1NhZmVBcHBFY29zeXN0ZW1fSGVyb1Zpc3VhbF8zQ2xhaW1zXzE5MjB4MTA4MC5wbmc"></a></div> User safety is at the core of everything we build. Over the years, we’ve continually introduced ways to help users stay safe and make informed app choices — from <a href="https://support.google.com/googleplay/answer/1075738">parental controls</a> to <a href="https://support.google.com/googleplay/answer/11416267">data safety transparency</a> and <a href="https://android-developers.googleblog.com/2025/01/helping-users-find-trusted-apps-on-google-play.html">app badges</a>. We’re constantly improving our policies and protections to encourage safe, high-quality apps on Google Play and stop bad actors before they cause harm. Apps on Google Play undergo rigorous reviews for safety and compliance with our policies. Last year, <a href="https://blog.google/products-and-platforms/platforms/google-play/keeping-google-play-safe-2025/">we shared</a> that Google Play runs over 10,000 safety checks on every app we publish, and we continue to check and recheck apps after they’ve been published. In 2025, we continued scaling our defenses even further by: <ul> <li>Boosting AI-enhanced app detection: We integrated Google’s latest generative AI models into our review process, helping our human review team continue to find complex malicious patterns faster.</li> <li>Preventing unnecessary access to sensitive data: We prevented over 255,000 apps from getting excessive access to sensitive user data and continued to strengthen our privacy policies. Our commitment to privacy-forward app development, supported by tools like Play Policy Insights in <a href="https://developer.android.com/studio">Android Studio</a> and <a href="https://support.google.com/googleplay/android-developer/answer/10787469?hl=en">Data safety section</a>, has empowered developers to continue to: minimize privacy-sensitive permission requests, and prioritize the user in their design choices.</li> <li>Blocking spam ratings and reviews: Whether they lead to review inflation or deflation, spam ratings and reviews can negatively impact our users’ trust and our developers’ growth. We’re continually evolving our detection models to help ensure app reviews are accurate. Our anti-spam protections blocked 160 million spam ratings and reviews last year, including inflated and deflated reviews. We also prevented an average 0.5-star rating drop for apps targeted by review bombing, protecting our users and developers from unhelpful reviews.</li> <li>Safeguarding kids and families: Our approach to kids and families is built on the core belief that children deserve a safe, enriching digital environment. Our commitment is to empower parents with robust tools while providing children with access to high-quality, age-appropriate content. Last year, we announced <a href="https://support.google.com/googleplay/android-developer/answer/16302250?sjid=17958105945234987629-NC">new layers of protection</a>, in addition to our existing <a href="https://blog.google/technology/safety-security/age-assurance-measures-safer-online-kids-teens-us/">safeguards</a>, to prevent younger audiences from discovering or downloading apps involving activities like gambling or dating. </li> </ul> <h3>Enhancing Google Play Protect to help keep the entire Android ecosystem safe</h3> We also continued to improve our protections for the broader Android ecosystem, by expanding <a href="https://support.google.com/googleplay/answer/2812853?hl=en">Google Play Protect</a> and real-time security measures like in-call scam protections to help keep users safe from scams, fraud, and other threats. <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRRyFyWuAAS0qmMVtLZaUEybmZ13gxGFxa6UsF_BGUocGCqDI6OAH-wM6_Fl84ZRyGZKnHcOCR4ceaPacTMsGsHtkb1R6lWlrcF1BAxBBt06KAe0n-t7C1gn7IMDC7rLZGY2bBshE1oR-0rCaYWponr8e6bh0AQP5K4koLy1CahuD9lT5Ay1I4JjaCSKb3/s1600/SafeAppEcosystem_GooglePlayProtectRealTimeScanning_1920x1080.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1080" data-original-width="1920" src="https://imgproxy.citrusreader.com/gr5oz-NIT_m0i36nRLZtwYq150pZSYyZceKkjwVgK9I/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VoUlJ5RnlXdUFBUzBxbU1WdExaYVVFeWJtWjEzZ3hHRnhhNlVzRl9CR1VvY0dDcURJNk9BSC13TTZfRmw4NFpSeUdaS25IY09DUjRjZWFQYWNUTXNHc0h0a2IxUjZsV2xyY0YxQkF4QkJ0MDZLQWUwbi10N0MxZ243SU1EQzdyTFpHWTJiQnNoRTFvUi0wckNhWVdwb25yOGU2YmgwQVFQNUs0a29MeTFDYWh1RDlsVDVBeTFJNEpqYUNTS2IzL3MxNjAwL1NhZmVBcHBFY29zeXN0ZW1fR29vZ2xlUGxheVByb3RlY3RSZWFsVGltZVNjYW5uaW5nXzE5MjB4MTA4MC5wbmc"></a></div> As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily. This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful. And, last year, its real-time scanning capability identified more than 27 million new malicious apps from outside Google Play, warning users or blocking the app to neutralize the threat. To benefit from these protections, we recommend that users always keep Google Play Protect on. While fraudsters are constantly evolving their tactics, Google Play Protect is evolving faster. Last year, we expanded: <ul> <li>Enhanced fraud protection: Google Play Protect’s <a href="https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html">enhanced fraud protection</a> analyzes and automatically blocks the installation of apps that may abuse sensitive permissions to commit financial fraud. This protection is triggered when a user attempts to install an app from an "Internet-sideloading source" — such as a web browser or messaging app — that requests a sensitive permission. Building on the success of our initial pilot in Singapore, we expanded enhanced fraud protection to 185 markets, now covering more than 2.8 billion Android devices. In 2025, we blocked 266 million risky installation attempts and helped protect users from 872,000 unique, high-risk applications.</li> <li>In-call scam protection: We also <a href="https://security.googleblog.com/2025/05/whats-new-in-android-security-privacy-2025.html">introduced</a> new protections to combat social engineering attacks during phone calls. This feature preemptively disables the ability to turn off Google Play Protect during phone calls, stopping bad actors from being able to trick users into disabling their device's built-in defenses to download a malicious app while on a call.</li> </ul> <h3>Partnering with developers for a more secure, privacy-friendly future</h3> Keeping Android and Google Play safe requires deep collaboration. We want to thank our global developer community for their partnership and for sharing their feedback on the tools and support they need to succeed. <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuQSOEIEqh9WkZLhfDByQYwJ5oCPUI_tux-OhPo3qgJ9LZ0Uuphey0RcUPiiIoqOcE8eEOWqSreJsex9f_8UAn8JUn8wnc3AcApCymgrDn3YCHeudyrH5QI22iArfEGKjluM1jKVujCXLRwmH06V2MnaSO3f_koSgMelHiuwPJtKQHKwcFi6AksS3TRqWY/s1600/SafeAppEcosystem_PlayIntegrityAPI_1920x1080.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" data-original-height="1080" data-original-width="1920" src="https://imgproxy.citrusreader.com/2IiZmJt0l-cn5zdiZiRPhMLOkB262w69CWRpzkzXe6c/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VpdVFTT0VJRXFoOVdrWkxoZkRCeVFZd0o1b0NQVUlfdHV4LU9oUG8zcWdKOUxaMFV1cGhleTBSY1VQaWlJb3FPY0U4ZUVPV3FTcmVKc2V4OWZfOFVBbjhKVW44d25jM0FjQXBDeW1nckRuM1lDSGV1ZHlySDVRSTIyaUFyZkVHS2psdU0xaktWdWpDWExSd21IMDZWMk1uYVNPM2Zfa29TZ01lbEhpdXdQSnRLUUhLd2NGaTZBa3NTM1RScVdZL3MxNjAwL1NhZmVBcHBFY29zeXN0ZW1fUGxheUludGVncml0eUFQSV8xOTIweDEwODAucG5n"></a></div> In 2025, we focused on reducing friction for developers and providing them with tools to safeguard their businesses: <ul> <li>Building safer apps more easily: We’re helping developers streamline their work by bringing insights directly into their natural workflows. It starts with <a href="https://developer.android.com/studio/publish/insights">Play Policy Insights in Android Studio</a>, which gives developers real-time feedback as they code. We focused first on permissions and APIs that grant deeper system access or handle personal data, like location or photos. This gives developers a head start on policy requirements, including prominent disclosures or usage declarations, while they’re still building. When developers move to Play Console to prepare their apps for submission, our expanded <a href="https://support.google.com/googleplay/android-developer/answer/14807773">pre-review checks</a> help catch common reasons for rejection, like improper usage of credentials or permissions and broken privacy policy links, ensuring smoother, faster reviews.</li> <li>Stronger threat detection with Play Integrity API: Every day, apps and games make over 20 billion checks with <a href="https://developer.android.com/google/play/integrity">Play Integrity API</a> to protect against abuse and unauthorized access. In 2025, we added <a href="https://android-developers.googleblog.com/2025/10/stronger-threat-detection-simpler.html">hardware-backed signals</a> to make it even harder for bad actors to spoof devices and introduced <a href="https://android-developers.googleblog.com/2025/10/stronger-threat-detection-simpler.html">new in-app prompts</a> that let users fix common issues like network errors without leaving the app. We also launched <a href="https://developer.android.com/google/play/integrity/device-recall">device recall</a> in beta to help developers identify repeat bad actors even after a device has been reset, all while protecting user privacy.</li> <li>Building trust through developer verification: We’ve seen how effective developer verification is on Google Play, and now we’re applying those lessons to the broader Android ecosystem. By ensuring there is a real, accountable identity behind every app, verification helps legitimize authentic developers and prevents bad actors from hiding behind anonymity to repeatedly cause harm. After gathering feedback during our <a href="https://developer.android.com/developer-verification/guides/early-access">early access</a> period, we’ll open up verification to all developers this year. We’ve also added a dedicated account type for students and hobbyists, which will allow them to distribute these apps to a limited number of devices without the full verification requirements.</li> <li>Greater security with every Android release: In Android 16, developers can <a href="https://android-developers.googleblog.com/2025/12/enhancing-android-security-stop-malware.html">protect</a> users’ most private information, like bank logins, with just one line of code. We’ve integrated this feature automatically to <a href="https://android-developers.googleblog.com/2025/12/enhancing-android-security-stop-malware.html#:~:text=Automatic%2C%20enhanced%20security%20for%20setFilterTouchesWhenObscured%20protection">certain apps</a> for an instant security boost against “<a href="https://developer.android.com/privacy-and-security/risks/tapjacking#mitigations">tapjacking</a>,” a trick where bad apps use hidden layers to steal clicks for ad fraud. </li> </ul> <h3>Looking ahead</h3> Our top priority remains making Google Play and Android the most trusted app ecosystems for everyone. This year, we’ll continue to invest in AI-driven defenses to stay ahead of emerging threats and equip Android developers with the tools they need to build apps safely. To empower developers who distribute their apps on Google Play, we’ll maintain our focus on embedding checks to help build apps that are compliant by design, while providing guidance to help proactively avoid policy violations before an app is published. We’ll also roll out Android developer verifications to hold bad actors accountable and prevent them from hiding behind anonymity to cause repeated harm. Thank you for being part of the Google Play and Android community as we work together to build a safer app ecosystem.

2026/2/19

New Android Theft Protection Feature Updates: Smarter, Stronger

Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt. Today, we're announcing a powerful set of theft protection feature updates that build on our<a href="https://security.googleblog.com/2024/10/android-theft-protection.html"> existing protections</a>, designed to give you greater peace of mind by making your device a much harder target for criminals. <h3>Stronger Authentication Safeguards</h3> We've expanded our security to protect you against an even wider range of threats. These updates are now available for Android devices running Android 16+. More User Control for Failed Authentications: In Android 15, <a href="https://blog.google/products/android/android-theft-protection/">we launched</a> Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts. This feature is now getting a new dedicated enable/disable toggle in settings, giving you more granular control over your device's security. Expanding Identity Check to cover more: <a href="https://security.googleblog.com/2025/01/android-theft-protection-identity-check-expanded-features.html">Early in 2025</a>, we enabled Identity Check for Android 15+, which requires the user to utilize biometrics when performing certain actions outside of trusted places. Later in the year, we extended this safeguard to cover all features and apps that use the Android Biometric Prompt. This means that critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check. Stronger Protection Against Screen Lock Guessing: We’re making it much harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts. To ensure you aren’t locked out by mistake (<a href="https://www.linkedin.com/pulse/how-my-son-secured-android-lockscreen-jeremiah-cox-vn88c/">by a curious child</a>, for instance), identical incorrect guesses no longer count toward your retry limit. <div class="separator" style="clear: both;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVh6O_BTgr0Y5vICILPIdLfewGVuyy6CbPwm-MswORJJOuvoZnXnFD4A4-3uo0iUa0bKWCxVs5E5RQy1kvWFSI6cmYYcbUqHlucIEqLkszJ-kxrcWhqn_HXVuRPglXmtUe1gPRwHaYZ-K9GBQWCPW0izyvLIMr5Rus8e9BZUPFXJTG5LjivTdUFIEiQdtB/s3816/Android%20Theft%20Protection_Image.png" style="display: block; padding: 1em 0; text-align: center; "><img alt border="0" height="600" data-original-height="3816" data-original-width="2520" src="https://imgproxy.citrusreader.com/8p-7f4JxDWJA8UDMXowXzyj8wlWJqBUkRcLOtarrwP4/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VpVmg2T19CVGdyMFk1dklDSUxQSWRMZmV3R1Z1eXk2Q2JQd20tTXN3T1JKSk91dm9ablhuRkQ0QTQtM3VvMGlVYTBiS1dDeFZzNUU1UlF5MWt2V0ZTSTZjbVlZY2JVcUhsdWNJRXFMa3N6Si1reHJjV2hxbl9IWFZ1UlBnbFhtdFVlMWdQUndIYVlaLUs5R0JRV0NQVzBpenl2TElNcjVSdXM4ZTlCWlVQRlhKVEc1TGppdlRkVUZJRWlRZHRCL3M2MDAvQW5kcm9pZCUyMFRoZWZ0JTIwUHJvdGVjdGlvbl9JbWFnZS5wbmc"></a></div> <h3>Enhanced Recovery Tools</h3> We're also enhancing our recovery tools to make them even more helpful. This update is now available for Android devices running Android 10+. More Control for Remote Lock. Remote Lock (<a href="android.com/lock">android.com/lock</a>) is a crucial tool that lets you lock your lost or stolen device from any web browser. We are adding a new optional security question/challenge to the process. This helps ensure that only you, the real device owner, can initiate a lock, adding another layer of security to your recovery flow. <h3>Proactive Protection: "Default-On" in Brazil</h3> Keeping our users safe is a top priority, which is why we're working to make theft protection available out-of-the-box for more Android users. For new Android devices activated in Brazil, two of our key <a href="https://support.google.com/android/answer/15146908?hl=en">theft protection features</a> are now enabled by default: <ul> <li>Theft Detection Lock: Uses on-device AI to sense motion and context that may indicate a "snatch-and-run" theft. If a theft attempt is detected, it will quickly lock the device screen to help protect your data.</li> <li>Remote Lock: Allows users to lock their device from any device that provides a web access to <a href="http://android.com/lock">android.com/lock</a> without the need to have enabled the feature in advance.</li> </ul> This helps ensure new devices have a critical layer of theft protection from day one. <h3>Continuing To innovate in Device Theft Protection</h3> We’re always evolving our protections to stay one step ahead of thieves. Our ongoing updates help ensure that no matter where you go, you can have greater peace of mind knowing your device and data are protected by Android’s multi-layered defenses. Keep a lookout for even more Android theft protection updates.

2026/1/27

Google Online Security Blog

AI threats in the wild: The current state of prompt injections on the web

Bringing Rust to the Pixel Baseband

Protecting Cookies with Device Bound Session Credentials

Google Workspace’s continuous approach to mitigating indirect prompt injections

VRP 2025 Year in Review

Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android

Cultivating a robust and efficient quantum-safe HTTPS

Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection

Keeping Google Play & Android app ecosystems safe in 2025

New Android Theft Protection Feature Updates: Smarter, Stronger

推荐订阅

WeLiveSecurity

Blaze's Security Blog

SANS Blog

ClearSky Cyber Security

360 Netlab Blog - Network Security Research Lab at 360