Google discloses state-backed adversarial misuse of Gemini

Google's Threat Intelligence Group (GTIG) published a report in January 2025 describing how government-backed hacking groups and coordinated influence operations attempted to misuse Google's Gemini AI assistant. The analysis covered prompts from Iranian, Chinese, North Korean and Russian state-linked actors, finding they mostly used Gemini for research, coding help and content generation rather than new attack techniques.

What happened

GTIG combined analyst review with LLM-assisted analysis to examine prompts submitted by APT and information-operations actors who attempted to misuse Gemini. Iranian APT actors were the heaviest users of Gemini, using it for a wide range of purposes, with the group APT42 focused on crafting phishing campaigns and reconnaissance on defense experts. Chinese government-backed actors used Gemini to conduct reconnaissance, for scripting and development, to troubleshoot code, and to research how to obtain deeper access to target networks. Google said it observed limited use of Gemini by Russian APT actors during the period of analysis. Information-operations actors, again led by Iran-linked groups, used Gemini for research, persona development, translation and content creation.

Impact

Google reported it did not observe threat actors developing novel or breakthrough AI-enabled capabilities during the period studied. Threat actors attempted basic jailbreaks using publicly available prompts in unsuccessful attempts to bypass Gemini's safety controls. Some actors also tried unsuccessfully to use Gemini to enable abuse of Google products, including researching Gmail phishing techniques, coding a Chrome infostealer, and bypassing account verification. Google said Gemini's safety and security measures restricted content that would have enhanced adversary capabilities throughout the dataset reviewed.

Response

Google said it applies its intelligence to improve its defenses and protect users from cyber threat activity. The company said it had not seen threat actors expand their capabilities or better succeed in their efforts to bypass its defenses. Google said it shares its findings with the security community to raise awareness and enable stronger protections across the ecosystem. A later GTIG update noted the report served as a baseline that the group has since revisited as threat actor use of Gemini evolved.

Lessons for security leaders

Security teams should treat generative AI assistants the way they treat other productivity tools used by adversaries, expecting reconnaissance, phishing-lure drafting and coding assistance rather than exotic new attack classes in the near term. Logging and monitoring AI assistant usage for patterns consistent with reconnaissance or jailbreak attempts can give defenders an early signal, since vendors like Google rely on exactly this kind of telemetry to detect and disable abusive accounts. Leaders should also assume that safety filters can reduce but not eliminate misuse, so defenses against AI-assisted phishing and scripting still need to rest on existing email security, credential hygiene and endpoint controls rather than on model guardrails alone.