Loading story…
Google released Gemini 3.1 Pro, positioning it as an upgraded core model for the Gemini platform and claiming a significant jump in reasoning performance versus the prior Gemini 3 Pro based on internal testing and benchmark results (including an ARC-AGI-2 score cited by Google). The update follows a recent upgrade to Gemini 3 Deep Think that Google framed as targeting harder research problems in domains like math, coding, chemistry, and physics, while also acknowledging that benchmarks alone are not a complete measure of real-world capability.
Google also added AI music generation to the Gemini app and web experience via Lyria 3, expanding Gemini beyond text/image/video into audio creation. Google said Lyria 3 outputs will include an audio watermark using SynthID, enabling users to check whether audio was generated by Google’s AI by uploading it to Gemini; the company also described guardrails intended to reduce direct artist-style imitation and a reporting mechanism for problematic outputs, with higher usage limits tied to paid subscription tiers (AI Pro and AI Ultra).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google released Gemini 3.1 Pro as an upgrade over Gemini 3 and positioned it as the core model behind recent advances in the Gemini 3 Deep Think line. Google said the model is available across its developer, enterprise, and end-user products, though access is limited to higher-tier plans.
Google introduced a new Gemini capability that can generate AI music without lyrics. The feature was reported by Ars Technica as a newly available Gemini function.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google expanded **Gemini Personal Intelligence** beyond paid subscribers, making the feature available to more free U.S. users across **AI Mode in Search**, the **Gemini app**, and **Gemini in Chrome**. The feature connects Gemini to personal Google services such as **Gmail**, **Google Photos**, **YouTube**, and **Search history**—with user permission—so it can provide more contextual, personalized responses instead of generic answers. Reported use cases include shopping recommendations based on prior purchases, travel and layover suggestions tailored to preferences and location, and troubleshooting help informed by a user’s device or purchase history. Google said the capability is **opt-in** and lets users choose which apps and services to connect, with the option to disconnect them later. Coverage of the rollout emphasized the amount of personal context Gemini can access, including email, photos, and search activity, and noted that the feature was previously limited to users paying for Google’s AI subscription. One report highlighted a hands-on test in which Gemini identified vehicle details and recommended tire options and local sellers, illustrating the depth of personalization now being offered to a broader user base.
Jun 29, 2026
Google is testing deeper **Gemini** integration in Chrome via a new internal feature called **“Skills,”** which appears to let users define named, instruction-based automations that Gemini can execute inside the browser. The feature is surfaced through a new `chrome://skills` page and aligns with Google’s stated direction of turning Gemini into a more agent-like assistant capable of acting across tabs and, over time, integrating more tightly with Google services. Separately, Google has added user controls to manage the **on-device GenAI model** used by Chrome’s *Enhanced Protection* (Safe Browsing) capabilities, which were previously upgraded with AI for “real-time” detection of dangerous sites, downloads, and potentially malicious extensions. In Chrome Canary, users can disable *On-device GenAI* under **Chrome → Settings → System**, which also enables deletion of the local model; Google indicated the local model may support additional security and browser features beyond scam detection as it rolls out more broadly.
Jun 29, 2026
Google's Threat Intelligence Group (GTIG) has identified a significant evolution in cybercriminal and nation-state tactics, with adversaries now leveraging Gemini AI to develop advanced malware and data processing agents. Notably, groups such as APT42 have experimented with Gemini to create a 'Thinking Robot' malware module capable of rewriting its own code during execution to evade detection, as well as AI agents that process and analyze sensitive personal data for surveillance and intelligence gathering. These developments mark a shift from previous uses of AI for productivity, such as phishing and translation, to direct integration of AI into malware operations. The experimental PromptFlux malware dropper exemplifies this trend, utilizing Gemini to dynamically generate obfuscated VBScript variants and periodically update its code to bypass antivirus defenses. PromptFlux attempts persistence via Startup folder entries and spreads through removable drives and network shares, while its 'Thinking Robot' module queries Gemini for new evasion techniques. Although PromptFlux is still in early development and not yet capable of causing significant harm, Google has proactively disabled its access to the Gemini API. Other AI-powered malware, such as FruitShell, have also been observed, indicating a broader move toward AI-driven, self-modifying threats in the wild.
Jun 29, 2026