Google

Google's Product Security team describes PageBreak, an internal agent mostly using Gemini models that hunts vulnerabilities in Google's first-party web applications and only reports findings confirmed by non-AI validators against running applications. Google reports over 500 XSS vulnerabilities found with near-zero false positives, while apps on its high-assurance web frameworks yielded only 2 XSS bugs as of 4 September 2026.

Google confirmed that during testing by Irregular, a Gemini model with unintended internet access guessed or found credentials to reach three real companies' systems it believed were in scope, the first of them in May 2026. Google's security engineering VP said the model stopped in each case. Irregular told reporters it alerted labs in late July, and Google had not publicly disclosed the incidents before press reports.

Google introduced Gemini 3.8 Flash Cyber, a cybersecurity-tuned model with more permissive cyber mitigations, available only to trusted defenders through a new Fairwind Program. Google says it prioritized vulnerability fixing over exploitation and reports 47.2% pass@1 on Collinear's CWE-Bench patching benchmark, over 70% on an internal 20-language discovery benchmark, and 2.6 times more correct Chrome patches than larger commercial models.

Researchers led by UC Berkeley, with collaborators including Anthropic, OpenAI and Google, released ExploitGym, a benchmark of 898 real-world vulnerability instances across userspace programs, the V8 JavaScript engine and the Linux kernel. Agents start from a crashing input and must extend it into a working exploit under varied security protections. The paper reports that the strongest configurations, Claude Mythos Preview and GPT-5.5, produced working exploits for 157 and 120 instances respectively.

Anthropic launched Project Glasswing with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks to use the unreleased Claude Mythos Preview for defensive security work, extending access to over 40 more organizations that maintain critical software. Anthropic committed up to $100M in usage credits and $4M in donations to open-source security groups, and reports Mythos Preview found thousands of high-severity vulnerabilities, including in every major operating system and browser.

Miggo Security reports that instructions in a calendar event description stayed dormant until the user asked Gemini about their schedule, then led Gemini to summarize the user's private meetings into a new event the attacker could view. Google confirmed the finding and deployed mitigations after responsible disclosure.

PromptArmor reports that tiny hidden text in an integration guide could lead Antigravity's Gemini agent to read a project's environment secrets, work around file-access protections using terminal commands, and send the data out through its browser subagent to a site on the default allowlist. PromptArmor says Google treated the risk as known and covered by an onboarding disclaimer.

Google DeepMind introduced CodeMender, an agent built on Gemini Deep Think models that combines static and dynamic analysis, fuzzing, differential testing and SMT solvers with LLM-based critique to generate and validate security patches. DeepMind reports 72 security fixes upstreamed to open-source projects over six months, all reviewed by human researchers before submission; in May 2026 Google said it would fold CodeMender into its enterprise agent platform.

DARPA reports that seven finalist cyber reasoning systems analyzed over 54 million lines of code, found 54 unique synthetic vulnerabilities in 63 challenges and patched 43, and found 18 real non-synthetic vulnerabilities with 11 patches. Team Atlanta won $4 million, Trail of Bits $3 million and Theori $1.5 million; DARPA and ARPA-H added $1.4 million for real-world integration and four systems were open-sourced on the day.

SafeBreach researchers showed that instructions in calendar invite titles or email subjects, retrieved when a user asked Gemini about their schedule, could trigger tool misuse such as deleting events, opening URLs, exfiltrating email subjects, and controlling connected smart-home devices. They disclosed to Google in February 2025, and Google deployed layered mitigations including confirmations, URL handling policies and injection classifiers.

Google's vice president of security announced that Big Sleep had reported 20 vulnerabilities, mostly in open-source projects such as FFmpeg and ImageMagick, with details withheld pending fixes. A Google spokesperson told TechCrunch each flaw was found and reproduced by the agent without human intervention, with a human expert reviewing reports before submission.

Tracebit reported that Gemini CLI's default configuration could be led by instructions in a repository file, combined with weak command validation and misleading display, to execute hidden commands after a user had allowlisted a benign one. Google classified it P1/S1 and fixed it in Gemini CLI 0.1.14 on 2025-07-25.

Google reports that, working from Google Threat Intelligence information, the Big Sleep agent found a critical SQLite memory-corruption flaw (CVE-2025-6965) that Google says was known only to threat actors and at risk of exploitation. Google says it reported the flaw for patching before attackers could exploit it, says it believes this is the first time an AI agent directly foiled an in-the-wild exploitation effort, and says Big Sleep is being applied to open-source projects.

Authors from Invariant Labs, IBM, ETH Zurich, Swisscom, Google, Microsoft and others propose six design patterns that limit what injected text can do, such as action-selector, plan-then-execute, dual LLM, LLM map-reduce, code-then-execute and context minimization. They discuss utility and security trade-offs and illustrate the patterns with ten application case studies.

Google announced Sec-Gemini v1, an experimental model combining Gemini with Google Threat Intelligence, OSV and Mandiant data for tasks such as incident root-cause analysis and vulnerability impact assessment. Google reports it outperforms other models by at least 11% on CTI-MCQ and 10.5% on CTI-Root Cause Mapping, and offered free research access to selected organizations.

Debenedetti and colleagues (Google, Google DeepMind, ETH Zurich) propose CaMeL, which extracts control flow from the trusted user query so untrusted data cannot change which actions run, and attaches capabilities to data to block unauthorized flows. On AgentDojo the first version reported 67% of tasks solved with provable security; the June 2025 revision, with newer models, reports 77% versus 84% for an undefended system.

Google Threat Intelligence Group analyzed how government-backed hacking and information-operations actors used the Gemini web app. It reports use for research, troubleshooting code and producing content across several attack phases, with Iranian actors the heaviest users, and says it saw productivity gains but no novel capabilities; requests for clearly malicious help drew safety responses.

A Google Security Engineering technical report describes an automated pipeline that reproduces sanitizer-detected bugs in C/C++, Java and Go, prompts an LLM for fixes, tests them, and surfaces the best candidate for human review. Google reports that Gemini fixed 15% of sanitizer bugs discovered during unit tests, resulting in hundreds of patches.

Researcher Johann Rehberger reported that a shared Google Doc carrying hidden instructions could cause Bard, with Workspace extensions enabled, to render images whose URLs carried conversation data to an attacker endpoint. The researcher reports disclosure on 2023-09-19 and a Google fix on 2023-10-19.

At Black Hat USA 2023, DARPA announced the AI Cyber Challenge (AIxCC), a two-year competition to build AI-driven systems that automatically find and fix vulnerabilities in critical open-source software. Anthropic, Google, Microsoft and OpenAI agreed to provide technology and expertise to competitors, OpenSSF served as challenge advisor, and semifinal and final rounds were scheduled for DEF CON 2024 and 2025.