Loading story…
Google DeepMind has piloted a double-blind evaluation framework for its proprietary Gemini 2.5 Flash Lite model, designed to prevent benchmark leakage and contamination. External evaluators can submit confidential prompts, benchmarks, and scoring code without exposing them to Google, while Google keeps model weights and inference code confidential; the pilot is intended to validate the testing method rather than publish model-performance scores.
The project involves the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons, using private benchmarks within a cryptographically protected environment. Its architecture combines Google Cloud Confidential Space, an NVIDIA H100 Confidential GPU, Intel TDX-encrypted host memory, remote attestation, and OpenMined PySyft controls. The safeguards go beyond contractual confidentiality and zero-logging practices, but the model still requires trust in Google-operated attestation and signing systems, the cloud platform, and underlying hardware vendors.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Google DeepMind announced and piloted what it described as the first double-blind evaluation of a proprietary frontier-class AI model. It evaluated Gemini 2.5 Flash Lite against confidential benchmarks supplied by MLCommons and the Singapore AI Safety Institute inside a privacy-preserving confidential-computing environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has introduced Private AI Compute, a privacy-enhancing technology designed to process AI queries securely in the cloud while maintaining on-device-level privacy guarantees. The system leverages Trillium TPUs and Titanium Intelligence Enclaves, utilizing AMD-based Trusted Execution Environments (TEEs) to encrypt and isolate memory, ensuring that user data remains inaccessible to Google and protected from physical exfiltration attacks. The infrastructure supports mutual attestation and encrypted communication between trusted nodes, with strict controls to prevent unauthorized access and ensure that only validated workloads are executed. To assess the security of this new platform, Google engaged NCC Group for a comprehensive review, including architectural analysis and detailed cryptographic assessments of key components such as the Oak Session Library, attestation mechanisms, and the T-Log system. The review also covered configuration and source code analysis to evaluate the robustness of the system's privacy and security controls. This independent evaluation highlights Google's efforts to provide strong privacy assurances for cloud-based AI processing, addressing concerns about data confidentiality and integrity in modern cloud environments.
Jun 29, 2026
Google and Google DeepMind introduced **Gemini 3.5 Flash Cyber**, a security-focused AI model designed to find, validate, and help remediate software vulnerabilities. Built on **Gemini 3.5 Flash**, the model is positioned for defensive cybersecurity use cases including bug discovery, exploit analysis, and patch generation, and is being offered through **CodeMender** in a limited-access pilot for governments and other trusted partners because of its dual-use risk. Google said internal testing showed the model outperforming **Gemini 3.5 Flash**, **Gemini 3.6 Flash**, and **Anthropic Claude Opus 4.6** at identifying unique vulnerabilities, including in complex targets such as **Google Chrome**, **Apple Safari**, and the **V8 JavaScript Engine**. The company said the model uncovered remote code execution flaws, found a memory-corruption issue in a sensitive production service, and produced a reliable **RCE** exploit that bypassed **ASLR** and **W^X** mitigations; Google also said CodeMender’s core capabilities will be made available to customers through the **Gemini Enterprise Agent Platform** using generally available Gemini models.
Jul 23, 2026
Google has acknowledged the significant risk of prompt injection attacks targeting its Gemini-powered Chrome browsing agent, which can be manipulated to perform unauthorized actions such as initiating financial transactions or exfiltrating sensitive data. In response, Google has introduced a second AI model, termed the 'user alignment critic,' designed to independently vet the agent's proposed actions before execution. This model operates in isolation from untrusted web content, providing an additional layer of defense against both goal hijacking and data leakage. The move comes as prompt injection has been identified as a leading vulnerability in AI systems, with industry bodies like OWASP and the UK's National Cyber Security Centre highlighting its prevalence and difficulty to mitigate due to the structural limitations of large language models. The Gemini-powered browsing agent, currently in preview, is capable of navigating websites, clicking buttons, and filling forms while users are logged into sensitive accounts, increasing the potential impact of successful attacks. Security experts and analysts have emphasized the need for robust safeguards, as malicious instructions can be hidden in web pages, iframes, or user-generated content. Google's dual-model approach aims to address these concerns by ensuring that any action not aligned with the user's intent is blocked, thereby reducing the risk of exploitation through prompt injection. The development reflects a broader industry trend of reassessing the security of AI-driven browsers and the need for advanced countermeasures to protect users and organizations from emerging threats.
Jun 29, 2026