Loading story…
Google and Wiz launched Scan for Good, an AI-assisted vulnerability-discovery initiative for critical infrastructure, public services, nonprofits, and technology providers. Using Gemini 3.8 Flash Cyber and Wiz Red Agent, the program identified serious, previously unexploited weaknesses at hospitals, a public rail operator, a municipality, and a national archive. Reported findings included leaked rail-administrator sessions, unrestricted control over a hospital mobile-alert channel, a hospital booking-site upload flaw that could enable server takeover and patient-data exposure, and exposed records affecting roughly 5,000 elderly residents.
Other remediated issues included administrative access to 8.8 million national-archive files and a cloud-provider credential that could have allowed alteration of more than 500 production container images. Google also cited an autonomously identified critical GitHub Actions script-injection flaw in Snowflake's snowflake-connector-net repository, which Snowflake fixed on the day of disclosure. Google said testing is conducted only with explicit authorization or under applicable disclosure and bug-bounty programs, with human researchers validating findings and coordinating remediation; CISA endorsed the defensive-discovery approach while Wiz cautioned that AI can also accelerate malicious attack-path development.
Track how attackers are adapting to this technology.
10 events from the most recent confirmed update back to the earliest known activity.
Wiz Red Agent identified a critical script-injection flaw in Snowflake's snowflake-connector-net GitHub repository through Snowflake's HackerOne program. Snowflake remediated the issue and rotated the affected credential on the day Wiz disclosed it; its audit review found no activity other than Wiz during the exposure window.
CISA provided guidance and collaboration for the Scan for Good initiative. Acting Director Nick Andersen endorsed defensive vulnerability discovery as a way to strengthen digital infrastructure amid evolving threats.
Google and its Wiz subsidiary launched Scan for Good, an AI-assisted defensive security-testing initiative for critical infrastructure, public services, nonprofits, and technology providers. The program uses Gemini 3.8 Flash Cyber and Wiz Red Agent, requires authorization or applicable disclosure-program coverage, and has human researchers validate findings and coordinate remediation.
Wiz reported that a credential embedded in public website code at an unnamed cloud provider could have allowed malicious software to be published across more than 500 production container images supporting a flagship AI service. The provider and exposure were not identified publicly, and Wiz said reported issues had been addressed.
The initiative discovered a public rail operator production-database exposure that leaked active administrator sessions. The sessions could have enabled control of routes, schedules, service announcements, and administrator accounts; Wiz said it helped secure the system before transit disruption occurred.
Wiz found a public municipal data-service exposure involving personal, health, and financial information for roughly 5,000 elderly residents. Wiz said it confirmed the issue without collecting a bulk data set and that the exposure was addressed.
An unsafe file-upload feature on an unnamed private hospital's public appointment-booking site could have enabled server takeover and exposure of patient identifiers, clinical information, and consent signatures. Wiz reported the issue was addressed before exploitation.
Wiz identified missing access controls at an unnamed public hospital that exposed staff contact details and allowed internet users to control a hospital-wide mobile-alert channel. The issue was addressed before reported exploitation.
The initiative found an exposed administrator key at an unnamed Middle Eastern national archive that allowed reading, modifying, and deleting 8.8 million files. Correcting permissions remediated the exposure.
Google completed its acquisition of Wiz, bringing the cloud-security company into Google Cloud.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group said it disrupted what it believes is the first observed cybercriminal campaign to use AI to develop a working zero-day exploit, preventing a likely mass-exploitation event against an unnamed open-source web administration tool. The flaw was a semantic logic issue in a Python script that allowed two-factor authentication bypass with valid credentials, and Google said the exploit code showed strong signs of LLM assistance, including heavily annotated Python, educational docstrings, textbook formatting, and even a hallucinated CVSS score. Google notified the vendor before the exploit was deployed at scale, and researchers assessed with high confidence that the code was generated with meaningful help from an AI model other than Gemini. Google said the case reflects a broader shift as threat actors industrialize generative AI across the attack lifecycle, from vulnerability research and exploit validation to malware development, obfuscation, reconnaissance, and social engineering. The company linked this trend to activity from China-, North Korea-, and Russia-aligned operators, and highlighted examples including **PROMPTSPY**, an Android backdoor that used the Gemini API to interpret device interfaces and automate clicks and swipes, as well as supply-chain compromises tied to repositories associated with **Trivy**, **Checkmarx**, **LiteLLM**, and **BerriAI**. Google said it has disabled malicious Gemini-linked assets and urged organizations to harden CI/CD pipelines, protect tokens, and scrutinize AI-related dependencies and abuse infrastructure.
Jun 29, 2026
Google-owned Mandiant disclosed an internal AI-assisted vulnerability discovery platform, the **Agentic Vulnerability Discovery Harness (AVDH)**, saying it identified more than 100 verified high-severity software flaws in two days during a live investigation tied to stolen corporate repositories. Mandiant said the system has been used internally for about ten months, scanned tens of millions of lines of code, and produced tens of thousands of findings, including dozens of assignable vulnerabilities affecting widely used web extensions and open-source projects. Mandiant said the work has already led to 12 assigned CVEs, including `CVE-2026-13242` and `CVE-2026-55803`, with roughly another dozen cases still in coordinated disclosure. The company described AVDH as a pipeline of specialized AI agents handling threat modeling, entry-point discovery, context enrichment, hypothesis generation, and validation, while stressing that human analysts still review threat models and manually reproduce exploits before findings are accepted. To reduce false positives, agents are designed to challenge one another’s conclusions and apply consultant-authored rules by language, framework, and vulnerability type; Mandiant also said it evaluated the system on synthetic intentionally vulnerable codebases rather than public benchmarks to avoid model-training contamination.
Aug 19, 2026
Tenable Research identified and disclosed three critical vulnerabilities in Google's Gemini AI assistant suite, collectively referred to as the "Gemini Trifecta." These flaws affected three distinct components: Gemini Cloud Assist, Gemini Search Personalization Model, and the Gemini Browsing Tool. The vulnerabilities exposed users to significant privacy and security risks, including the potential for data exfiltration and unauthorized access to sensitive information. In the case of Gemini Cloud Assist, attackers could exploit a prompt injection flaw by embedding malicious prompts within HTTP User-Agent headers sent to Google Cloud services. When Gemini Cloud Assist summarized these logs, the injected prompts could be executed, potentially leading to credential phishing and further compromise of cloud resources. The Search Personalization Model was susceptible to search-injection attacks, where attackers manipulated a user's Chrome search history using JavaScript to inject prompts. This allowed the attacker to control the AI chatbot's behavior and leak the user's saved information and location data. The Gemini Browsing Tool contained an indirect prompt injection vulnerability, enabling attackers to exfiltrate private data by leveraging the tool's internal web page summarization feature. Proof-of-concept demonstrations showed how these vulnerabilities could be exploited in real-world scenarios, with attackers using JavaScript to manipulate browser history and force visits to malicious sites, or injecting logs that would later be summarized by Gemini. All three vulnerabilities were reported to Google and have since been remediated with targeted fixes. The incident highlights the growing risks associated with integrating AI assistants into cloud and enterprise environments, as these tools can become both targets and vehicles for sophisticated attacks. Security researchers emphasized the need for organizations to maintain strict visibility and policy enforcement over AI deployments. The flaws demonstrated that AI models, when given access to sensitive data and external communication capabilities, can be weaponized if not properly secured. The Gemini Trifecta serves as a cautionary example for the broader industry, underscoring the importance of robust security measures in the development and deployment of AI-powered tools. Organizations are urged to review their AI security posture and ensure that similar vulnerabilities are not present in their environments. The rapid remediation by Google mitigated the immediate risks, but the incident has sparked renewed attention on the security challenges unique to AI assistants. As AI adoption accelerates, the need for proactive threat modeling and continuous monitoring of AI systems becomes increasingly critical. The Gemini vulnerabilities illustrate how attackers can exploit the intersection of AI, cloud infrastructure, and user data to achieve their objectives. This event is a reminder that AI security must be prioritized alongside traditional cybersecurity measures to protect users and organizations from emerging threats.
Jun 29, 2026