Google Reveals State-Sponsored Hackers' Attempts to Exploit Gemini AI
9 Sources
[1]
AI is Not a Game Changer for Threat Actors Yet, Says Google
A new security report from the company states that threat actors haven't been able to use AI to develop novel capabilities to accelerate and amplify attacks. Google Threat Intelligence Group (GITG) recently published a report analysing various attempts to misuse Google's AI assistant Gemini. The
[2]
Google says hackers abuse Gemini AI to empower their attacks
Multiple state-sponsored groups are experimenting with the AI-powered Gemini assistant from Google to increase productivity and to conduct research on potential infrastructure for attacks or for reconnaissance on targets. Google's Threat Intelligence Group (GTIG) detected government-linked
[3]
Google exposes government-backed misuse of Gemini AI
While artificial intelligence advancements unlock opportunities in various industries, innovations may also become targets of hackers, highlighting a concerning potential for AI misuse. Google's threat intelligence department released a paper titled Adversarial Misuse of Generative AI, revealing
[4]
Google says Gemini is being misused to launch major cyberattacks
Hackers are experimenting, but haven't found "novel capabilities" just yet Dozens of cybercriminal organizations from all around the world are abusing Google's Artificial Intelligence (AI) solution Gemini in their attacks, the company has admitted. In an in-depth analysis discussing who the
[5]
Google: Over 57 Nation-State Threat Groups Using AI for Cyber Operations
Over 57 distinct threat actors with ties to China, Iran, North Korea, and Russia have been observed using artificial intelligence (AI) technology powered by Google to further enable their malicious cyber and information operations. "Threat actors are experimenting with Gemini to enable their
[6]
Google details nefarious Gemini use by Iranian spies
And you, China, Russia, North Korea ... Guardrails block malware generation Google says it's spotted Chinese, Russian, Iranian, and North Korean government agents using its Gemini AI for nefarious purposes, with Tehran by far the most frequent naughty user out of the four. The web giant has been
[7]
Foreign Hackers Are Using Google's Gemini in Attacks on the US
The rapid rise of DeepSeek, a Chinese generative AI platform, heightened concerns this week over the United States' AI dominance as Americans increasingly adopt Chinese-owned digital services. With ongoing criticism over alleged security issues posed by TikTok's relationship to China, DeepSeek's
[8]
Gemini chatbot is being exploited by hackers from Iran, China, and North Korea for cyber attacks, confirms Google
North Korean hackers leverage the chatbot to create fake cover letters and research remote IT jobs for infiltration. Hackers supported by state-sponsored organizations from nations like China, North Korea, and Iran are using the Gemini chatbot to enhance their cyberattack capabilities, according
[9]
Google shares how all the world's baddies have been using Gemini for their nefarious deeds
The most common uses of Gemini appear to be for researching targets and helping at coding. From pretty much the moment that powerful AI language models debuted on the scene, bad guys have been looking to do bad stuff with them. The companies behind them make concerted efforts to protect their
Share
Copy Link
Google's Threat Intelligence Group reports on how state-sponsored hackers from various countries are experimenting with Gemini AI to enhance their cyberattacks, but have not yet developed novel capabilities.
Google Reveals State-Sponsored Hackers' Use of Gemini AI
Google's Threat Intelligence Group (GTIG) has released a comprehensive report detailing how state-sponsored hackers are experimenting with the company's AI assistant, Gemini, to enhance their cyberattacks. The report highlights that while these threat actors are finding productivity gains, they have not yet developed novel capabilities using AI
1
.Scope of Misuse
Over 57 distinct threat actors from more than 20 countries, primarily from China, Iran, North Korea, and Russia, have been observed using Gemini for various purposes
5
. These state-sponsored groups are utilizing the AI tool to:- Conduct reconnaissance on potential targets
- Research publicly known vulnerabilities
- Assist with coding and scripting tasks
- Develop tools and payloads
- Plan post-compromise activities
Country-Specific Activities
Different countries have shown varying patterns of Gemini usage:
- Iran: Focused on crafting phishing campaigns, conducting reconnaissance on defense experts and organizations, and generating cybersecurity content
5
. - China: Primarily used for troubleshooting code, scripting, and development, as well as researching methods to gain deeper access to target networks
3
. - North Korea: Utilized Gemini across various attack lifecycle phases, from research to development. They also explored topics of strategic interest, such as the South Korean military and cryptocurrency
3
. - Russia: Limited use, mainly for converting publicly available malware and adding encryption layers to existing code
5
.
Attempted Jailbreaks and Security Measures
Google reported unsuccessful attempts by threat actors to jailbreak Gemini using publicly available prompts and basic measures like rephrasing or repeatedly sending the same prompt
3
. The company emphasized that these attempts were unsuccessful, with Gemini providing safety-filtered responses1
.Related Stories
Impact on Cybersecurity Landscape
While AI tools like Gemini are being misused, experts suggest that they have not yet become game-changers for threat actors. Kent Walker, president of global affairs at Alphabet (Google), stated, "In other words, the defenders are still ahead, for now"
1
.However, cybersecurity professionals warn that the use of AI in crafting phishing emails and other attacks has made traditional detection methods less effective
4
.Future Concerns and Mitigation Strategies
As AI capabilities continue to evolve, there are growing concerns about potential threats:
- Direct exploitation of AI agents, which Google highlighted as a significant risk
1
. - The need for adaptive, real-time security measures to protect AI-driven systems
1
. - Risks to data confidentiality within AI agent systems
1
.
To address these challenges, researchers and companies are exploring various defense mechanisms, including sandboxing techniques and training LLMs to follow only original prompt instructions
1
.Google emphasizes the need for heightened public-private collaboration to strengthen cyber defenses and disrupt threats, stating, "American industry and government need to work together to support our national and economic security"
5
.References
Summarized by
Navi
[2]
[3]
Related Stories
Google reports state-sponsored hackers exploit Gemini AI across all stages of cyberattacks
12 Feb 2026•Technology
Google's Gemini AI Vulnerabilities Expose Risks of Indirect Prompt Injection
30 Sept 2025•Technology
Google Discovers AI-Powered Malware in the Wild, But Experts Question Real-World Threat Level
05 Nov 2025•Technology
Recent Highlights
1
OpenAI Claims AI Breakthrough on Navier-Stokes Problem, Sparking Math Community Crisis
Science and Research
2
Anthropic's Claude Now Leads 26% of AI Development Work, Company Reveals New Transparency Metrics
Technology
3
OpenAI Reveals AI Models Hiding Mistakes and Taking Unauthorized Actions in 6 New Misalignment Cases
Technology
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
