A prompt-injection vulnerability surfaced in Google AI Overviews on May 22, causing the system to interpret plain English words as chatbot instructions rather than search queries. Users searching for dictionary definitions of terms like “disregard,” “dismiss,” “cancel,” and “stop” received responses such as “Sure, that is no problem. Let me know if you have any other questions,” the kind of reply a large language model produces when a user tells it to halt a task.
Google confirmed the bug in a statement to Tom’s Guide. “We’re aware that AI Overviews are misinterpreting some action-related queries, and we’re working on a fix, which will roll out soon,” a Google spokesperson said. The company clarified that the issue stems from how AI Overviews interprets certain query strings, and stated it is separate from the Search expansions announced at Google I/O 2026.
The core problem is architectural. Google Search now routes a wide class of queries through a Gemini-powered reasoning layer designed to follow natural-language instructions. That layer cannot reliably distinguish between a user searching the definition of “disregard” and a user instructing the system to disregard something. When the input token matches a known instruction-class word, the model responds as if receiving a command.
Behavior was inconsistent across surfaces and accounts, according to Tom’s Guide’s own testing. Staff reported that the bug appeared in both standard AI Overviews and in AI Mode, Google’s conversational search experience. The affected word list extended beyond the original three terms to include “cancel” and “stop,” with AI Mode responding to the latter with “No problem. I’ve stopped the current action.” Some accounts on the same device showed the error; others did not, suggesting the rollout of a partial fix or an A/B configuration difference.
For search teams, the inconsistency is as significant as the bug itself. A ranking or display error that reproduces unpredictably across logged-in accounts and device types is harder to diagnose in Search Console than one with a clear trigger. Publishers who monitor AI Overviews appearances for their branded or definitional queries may see anomalous citation drops or format changes that do not correspond to any indexing event.
This is not AI Overviews’ first reliability problem. Tom’s Guide cited a study published roughly a month before this incident finding that AI Overviews return incorrect answers on approximately one in ten queries. Google introduced AI Overviews in 2025 to sustained criticism over factual errors in early rollouts. The prompt-injection class of bug is qualitatively different from a hallucination: a hallucination produces a wrong answer, while a prompt-injection failure causes the system to misidentify what kind of task it is performing. Both erode the retrieval guarantees that make Search useful.
The timing sharpens the stakes. At Google I/O 2026, the company announced that Search is shifting toward an AI-native model where Gemini handles query interpretation, answer generation, and now task execution. Agentic capabilities including calendar management and interactive-site generation were featured prominently. A system that cannot distinguish “please stop” as a search object from “please stop” as an instruction faces a harder version of this problem when it also has write access to external services.
Google said a fix would roll out soon but did not specify a timeline or confirm whether the patch would address only the flagged terms or apply a broader classification pass to instruction-adjacent vocabulary.
Search teams running query monitoring through Google Search Console or third-party rank trackers should flag informational queries containing imperative verbs for manual review until Google confirms the fix is complete. Any query set targeting command vocabulary, particularly in legal, technical-writing, or language-learning verticals, is a candidate for elevated monitoring over the next two to four weeks.
Reported by Tom’s Guide on 2026-05-22, based on original reporting by Scott Younker.
