Google I/O’s New AI Agents Expand Prompt-Injection Risks

Summary

The article says Google I/O 2026 introduced Project Mariner, A2A, managed MCP servers and always-on information agents, arguing poisoned web pages, Agent Cards or emails could steer agents with access to Gmail, Drive and tools. It recommends runtime controls and least-

Key points

The article describes four agent surfaces introduced at Google I/O 2026: Project Mariner, Agent2Agent (A2A), managed MCP servers and always-on information agents.
It argues that indirect prompt injection can steer Project Mariner through attacker-controlled web content, including hidden page text and metadata.
A2A Agent Cards may misrepresent an agent’s capabilities or endpoint, or contain instructions aimed at the agent reading the card; authentication does not validate those claims.
The article warns that background agents combining access to untrusted content, sensitive Gmail or Drive data, and external actions could be steered by a hostile email.
It says logging alone cannot prevent harmful actions and recommends tool allowlisting, tightly scoped credentials, human checkpoints for sensitive actions and runtime monitoring of tool calls.

Article Details

Event Type: Security analysis of AI-agent attack surfaces introduced at Google I/O 2026
Impact: The article warns that indirect prompt injection through web pages, Agent Cards, and emails could steer agents into unauthorized actions. Agents with access to Gmail, Drive, and external tools could expose sensitive data or send it outside the organization. No confirmed exploitation of the announced Google features or breach is reported.

People

Sundar PichaiGoogle CEO who, according to the article, described the launch as the “agentic Gemini era” during the I/O keynote.

Vendors

GoogleGoogle I/O 2026 introduced four major AI agent surfaces—Project Mariner, Agent2Agent (A2A), managed MCP servers, and always-on information agents—but each inherits the same core weakness: the model cannot reliably

Products

Agent2Agent (A2A)Google I/O 2026 introduced four major AI agent surfaces—Project Mariner, Agent2Agent (A2A), managed MCP servers, and always-on information agents—but each inherits the same core weakness: the model cannot reliably GmailThe result is a broad new attack surface where poisoned web pages, malicious Agent Cards, and hostile emails can steer agents that have access to Gmail, Drive, and external tools.Google CloudAgent2Agent (A2A) protocol lets agents discover and trust each other, managed MCP servers ship across Google Cloud, and information agents run 24/7 with access to your Gmail and Drive.Google DriveThe result is a broad new attack surface where poisoned web pages, malicious Agent Cards, and hostile emails can steer agents that have access to Gmail, Drive, and external tools.Project MarinerGoogle I/O 2026 introduced four major AI agent surfaces—Project Mariner, Agent2Agent (A2A), managed MCP servers, and always-on information agents—but each inherits the same core weakness: the model cannot reliably