Google Warns: Malicious Web Pages Can Hijack AI Agents
AI agents are becoming more powerful.
They can browse websites, read documents, summarize emails, use tools, and sometimes even take actions on behalf of users.
But Google is now warning about a growing security problem that many people still underestimate: indirect prompt injection.
In simple words, attackers can hide malicious instructions inside public web pages, documents, comments, or other content that an AI agent might read. The user may never see those instructions. But the AI agent can still process them and accidentally follow them.
Google’s security team said it scanned the public web for known indirect prompt-injection patterns and found that this is no longer just a theoretical problem. These attacks are especially risky for AI systems connected to multiple data sources, like email, cloud files, browsers, workplace tools, or enterprise apps.
That matters because AI agents are no longer just answering questions. They are starting to act.
They can pull information, make decisions, update files, trigger workflows, and connect with business systems. If hidden instructions on the web can influence those agents, then the security risk becomes much bigger than a bad chatbot reply.
Why this matters?
This is one of the most important AI security stories right now.
The next phase of AI is not just about smarter models. It is about AI systems that can take action in the real world. And once AI agents get access to company data, customer information, code repositories, or internal tools, attackers will look for ways to manipulate them.
For businesses and developers, this is a clear warning: AI agents need strong permissions, monitoring, and safety layers before they are trusted with real workflows.
The web was built for humans to read.
Now AI agents are reading it too — and attackers are already learning how to talk to them.
DeepSeek V4 Arrives – and China’s AI Race Gets More Serious
DeepSeek is back in the spotlight.
On April 24, DeepSeek released the preview version of DeepSeek V4, including V4-Pro and V4-Flash. The company says both models are now available through its API and support OpenAI-compatible and Anthropic-compatible interfaces, making them easier for developers to plug into existing AI tools.
The technical details are big.
DeepSeek V4-Pro is listed as a 1.6 trillion-parameter Mixture-of-Experts model, while V4-Flash is a smaller 284 billion-parameter model. Both support a 1 million-token context window, which is designed for long documents, complex coding tasks, research workflows, and agent-based use cases.
But the bigger story is not only the model.
Reuters reported that after DeepSeek V4’s launch, major Chinese tech companies rushed to secure Huawei AI chips, showing how closely China’s model race is now connected to its domestic chip strategy.
That makes this story bigger than a normal model release.
DeepSeek is not just competing with OpenAI, Anthropic, Google, and Meta on model performance. It is also becoming part of a larger push to reduce dependence on U.S. AI hardware and build a stronger Chinese AI ecosystem.
Why this matters?
DeepSeek V4 shows that the AI race is no longer only about who has the smartest chatbot.
It is about who controls the full stack: models, chips, cloud infrastructure, developer tools, and pricing.
For developers, DeepSeek V4 is important because it offers another powerful open-weight option for coding agents, long-context work, and AI app development. For the global AI industry, it shows that China’s AI progress is still moving fast despite chip restrictions and export controls.
The message is clear: the AI race is becoming more global, more technical, and more infrastructure-driven.
And DeepSeek is once again forcing the industry to pay attention.
Salesforce Pushes Toward an Agent-First Future
Salesforce is making a major shift in how business software may work in the AI era.
For years, enterprise software has been built around dashboards, forms, menus, and manual workflows. People log in, click around, update records, move data, and manage tasks.
Salesforce is now moving toward a different idea: what if AI agents could operate business software directly?
The company recently introduced Salesforce Headless 360, where Salesforce says its platform can be accessed through APIs, MCP tools, and CLI commands. That means AI agents can read, write, and act across Salesforce without always needing a traditional user interface.
Salesforce also launched Agentforce Operations, which is designed to coordinate work between AI agents and humans. According to Salesforce, these agents can handle tasks like extracting data from documents, running calculations, updating models, and identifying compliance gaps.
This is a big signal.
Salesforce is not treating AI as just another assistant inside a dashboard. It is preparing for a future where AI agents become the main way work gets done across business platforms.
Why this matters?
This could change how companies use software.
Instead of employees opening multiple tools and manually completing repetitive tasks, AI agents could work across systems in the background pulling data, updating records, preparing reports, and escalating important decisions to humans.
For startups, SaaS companies, and enterprise teams, this points toward a bigger trend: business software may become less about screens and more about outcomes.
The dashboard may not disappear overnight.
But Salesforce is clearly preparing for a world where the AI agent becomes the interface.
Liked this issue? Get the next one free.
One email on Tuesday. Unsubscribe in one click.