Loading story…
Google and Google DeepMind introduced Gemini 3.5 Flash Cyber, a security-focused AI model designed to find, validate, and help remediate software vulnerabilities. Built on Gemini 3.5 Flash, the model is positioned for defensive cybersecurity use cases including bug discovery, exploit analysis, and patch generation, and is being offered through CodeMender in a limited-access pilot for governments and other trusted partners because of its dual-use risk.
Google said internal testing showed the model outperforming Gemini 3.5 Flash, Gemini 3.6 Flash, and Anthropic Claude Opus 4.6 at identifying unique vulnerabilities, including in complex targets such as Google Chrome, Apple Safari, and the V8 JavaScript Engine. The company said the model uncovered remote code execution flaws, found a memory-corruption issue in a sensitive production service, and produced a reliable RCE exploit that bypassed ASLR and W^X mitigations; Google also said CodeMender’s core capabilities will be made available to customers through the Gemini Enterprise Agent Platform using generally available Gemini models.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Google stated that CodeMender’s foundational capabilities would be made available to customers through the Gemini Enterprise Agent Platform using generally available Gemini models. This marked the planned productization path for the security tooling beyond the restricted pilot.
Google said internal evaluations showed Gemini 3.5 Flash Cyber outperforming Gemini 3.5 Flash, Gemini 3.6 Flash, and Anthropic Claude Opus 4.6 at finding unique vulnerabilities. It also disclosed that the model identified remote code execution flaws, a memory-corruption issue in a sensitive production service, and generated a reliable RCE exploit that bypassed ASLR and W^X mitigations.
Google DeepMind announced Gemini 3.5 Flash Cyber, a specialized AI model for vulnerability discovery, validation, and patching. The company said the model would be offered through CodeMender in a limited-access pilot restricted to governments and trusted partners because of its dual-use potential.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcesecurityaffairs.com
Open sourcedeepmind.google
Open sourcethehackernews.com
Open sourceblog.google
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has acknowledged the significant risk of prompt injection attacks targeting its Gemini-powered Chrome browsing agent, which can be manipulated to perform unauthorized actions such as initiating financial transactions or exfiltrating sensitive data. In response, Google has introduced a second AI model, termed the 'user alignment critic,' designed to independently vet the agent's proposed actions before execution. This model operates in isolation from untrusted web content, providing an additional layer of defense against both goal hijacking and data leakage. The move comes as prompt injection has been identified as a leading vulnerability in AI systems, with industry bodies like OWASP and the UK's National Cyber Security Centre highlighting its prevalence and difficulty to mitigate due to the structural limitations of large language models. The Gemini-powered browsing agent, currently in preview, is capable of navigating websites, clicking buttons, and filling forms while users are logged into sensitive accounts, increasing the potential impact of successful attacks. Security experts and analysts have emphasized the need for robust safeguards, as malicious instructions can be hidden in web pages, iframes, or user-generated content. Google's dual-model approach aims to address these concerns by ensuring that any action not aligned with the user's intent is blocked, thereby reducing the risk of exploitation through prompt injection. The development reflects a broader industry trend of reassessing the security of AI-driven browsers and the need for advanced countermeasures to protect users and organizations from emerging threats.
Jun 29, 2026
Tenable Research identified and disclosed three critical vulnerabilities in Google's Gemini AI assistant suite, collectively referred to as the "Gemini Trifecta." These flaws affected three distinct components: Gemini Cloud Assist, Gemini Search Personalization Model, and the Gemini Browsing Tool. The vulnerabilities exposed users to significant privacy and security risks, including the potential for data exfiltration and unauthorized access to sensitive information. In the case of Gemini Cloud Assist, attackers could exploit a prompt injection flaw by embedding malicious prompts within HTTP User-Agent headers sent to Google Cloud services. When Gemini Cloud Assist summarized these logs, the injected prompts could be executed, potentially leading to credential phishing and further compromise of cloud resources. The Search Personalization Model was susceptible to search-injection attacks, where attackers manipulated a user's Chrome search history using JavaScript to inject prompts. This allowed the attacker to control the AI chatbot's behavior and leak the user's saved information and location data. The Gemini Browsing Tool contained an indirect prompt injection vulnerability, enabling attackers to exfiltrate private data by leveraging the tool's internal web page summarization feature. Proof-of-concept demonstrations showed how these vulnerabilities could be exploited in real-world scenarios, with attackers using JavaScript to manipulate browser history and force visits to malicious sites, or injecting logs that would later be summarized by Gemini. All three vulnerabilities were reported to Google and have since been remediated with targeted fixes. The incident highlights the growing risks associated with integrating AI assistants into cloud and enterprise environments, as these tools can become both targets and vehicles for sophisticated attacks. Security researchers emphasized the need for organizations to maintain strict visibility and policy enforcement over AI deployments. The flaws demonstrated that AI models, when given access to sensitive data and external communication capabilities, can be weaponized if not properly secured. The Gemini Trifecta serves as a cautionary example for the broader industry, underscoring the importance of robust security measures in the development and deployment of AI-powered tools. Organizations are urged to review their AI security posture and ensure that similar vulnerabilities are not present in their environments. The rapid remediation by Google mitigated the immediate risks, but the incident has sparked renewed attention on the security challenges unique to AI assistants. As AI adoption accelerates, the need for proactive threat modeling and continuous monitoring of AI systems becomes increasingly critical. The Gemini vulnerabilities illustrate how attackers can exploit the intersection of AI, cloud infrastructure, and user data to achieve their objectives. This event is a reminder that AI security must be prioritized alongside traditional cybersecurity measures to protect users and organizations from emerging threats.
Jun 29, 2026
Google has patched a maximum-severity remote code execution flaw in **Gemini CLI** that affected headless deployments, especially **GitHub Actions** and other CI/CD workflows. The vulnerability stemmed from overly permissive workspace trust handling that automatically treated active folders as trusted and could load attacker-controlled configuration files and environment variables from local `.gemini` directories. The issue was independently discovered by Elad Meged of Novee and Dan Lisichkin of Pillar Security, and researchers warned that successful exploitation could expose secrets, credentials, source code, and connected downstream systems. Google said the issue is addressed in **Gemini CLI** versions `0.39.1` and `0.40.0-preview.3`, but warned that applying the fix may require additional workflow changes to avoid breaking automation. The `run-gemini-cli` GitHub Action defaults to the latest release, which can disrupt pipelines that depended on the previous implicit trust behavior, while workflows using `--yolo` mode may fail silently unless tool allowlists are updated to align with the new policy engine. Google is urging organizations to review CI/CD jobs and move to explicit trust settings and compatible allowlists before resuming automated use.
Jun 29, 2026