Models/model

Gemini

Google's Gemini models, including cyber-specialized variants.

A collection of what the corpus records about this model family, grouped by lane. It is not a capability assessment.

Attacks & incidents

Sep 19, 2026

Google confirms Gemini accessed three real companies during Irregular cyber evaluations earlier in 2026

AttackIncidentGoogle, Irregular

Sep 8, 2026

Google reports attackers moving from prompting to agentic workflows, including a six-hour automated campaign

AttackMisuse reportGoogle Threat Intelligence Group, Mandiant

May 11, 2026

Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use

AttackMisuse reportGoogle Threat Intelligence Group, UNC6780 (TeamPCP)

Jan 19, 2026

Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data

AttackVulnerability disclosureMiggo Security, Google

Nov 20, 2025

PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

AttackVulnerability disclosurePromptArmor, Google

Nov 5, 2025

Google reports malware that queries LLMs during execution, including APT28's PROMPTSTEAL

AttackMisuse reportGoogle Threat Intelligence Group, APT28

Aug 26, 2025

s1ngularity: compromised Nx npm packages used local AI coding CLIs to hunt for secrets

AttackIncidentNx

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

AttackVulnerability disclosureSafeBreach, Tel Aviv University, Technion

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Jul 28, 2025

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

AttackVulnerability disclosureTracebit, Google

Jan 29, 2025

Google finds government-backed hackers using Gemini for support tasks, not novel capabilities

AttackMisuse reportGoogle Threat Intelligence Group, Google

Defense & research

Sep 24, 2026

Google's PageBreak agent finds over 500 XSS bugs in its own web apps using deterministic validators

DefenseTool releaseGoogle

Sep 2, 2026

Google releases Gemini 3.8 Flash Cyber for trusted defenders, emphasizing automated patching

DefenseTool releaseGoogle, Google DeepMind, Collinear

Jun 18, 2026

Google DeepMind publishes an AI Control Roadmap treating internal agents as potential insider threats

DefenseFrameworkGoogle DeepMind

May 12, 2026

CTFusion uses live CTF events to counter contamination and cheating in cyber agent benchmarks

DefenseBenchmarkarXiv

Apr 21, 2026

Threat-hunting benchmark finds best LLM agent flags only 3.8% of malicious events in raw logs

DefenseBenchmarkSimbian AI

Mar 16, 2026

CAISI, UK AISI and Gray Swan competition finds concealed indirect injections succeed on all 13 frontier models

DefensePaperGray Swan AI, US Center for AI Standards and Innovation, UK AI Security Institute

Oct 6, 2025

Google DeepMind introduces CodeMender, an agent that patches and hardens code, with 72 upstreamed fixes

DefenseTool releaseGoogle DeepMind, Google

Jun 17, 2025

SHADE-Arena measures whether agents can pursue hidden harmful side tasks without being caught by monitors

DefenseBenchmarkAnthropic, Redwood Research

May 20, 2025

Google DeepMind reports lessons from continuously attacking Gemini with adaptive prompt injections

DefensePaperGoogle DeepMind

Apr 29, 2025

Meta releases AutoPatchBench to test AI repair of fuzzing-found C/C++ vulnerabilities

DefenseBenchmarkMeta

Apr 4, 2025

Google announces Sec-Gemini v1, an experimental model for security operations workflows

DefenseTool releaseGoogle

Jan 31, 2024

Google reports Gemini-based pipeline fixed 15% of sanitizer bugs found in its unit tests

DefensePaperGoogle

Findings drawing on these records

Jul 21, 2026

Frontier agents under cyber evaluation have taken actions against real third-party systems outside the evaluation.

Corroboratedobserved4 evidence records1 linked finding

Aug 27, 2025

Attackers have used AI agents to carry out much of the work of real intrusions, from reconnaissance to credential theft and extortion, with people directing them at a few decision points.

Corroboratedobserved5 evidence records

Mar 19, 2026

OpenAI reports its internal coding-agent monitor matched every staff escalation, and OpenAI and Google DeepMind report that most flags reflect overeagerness or mistakes rather than adversarial intent.

Qualifiedreported2 evidence records1 linked finding

May 12, 2026

Scores on public CTF benchmarks can be inflated when agents find published solutions, and static benchmarks lose validity as their flaws are patched.

Reportedmeasured2 evidence records

May 11, 2026

Google's threat intelligence team attributes to AI the development of a zero-day exploit that criminal actors prepared for mass exploitation, based on characteristics of the code.

Reportedreported1 evidence record

Jul 14, 2025

LLM agents fall well short of reliable performance on realistic threat-investigation and threat-hunting benchmarks built from security logs.

Corroboratedmeasured3 evidence records

Jul 28, 2025

Every frontier agent tested in two large public red-teaming competitions was hijacked at least once; in the 2026 competition the injections also had to conceal the compromise from the user.

Reportedmeasured2 evidence records

Nov 3, 2023

Content sent by outsiders, such as email, calendar invites, shared documents, or web forms, can trigger agent actions without the user clicking anything.

Corroboratedmeasured6 evidence records

Jul 22, 2025

Limits that agents are only told about, or that block one tool while others remain available, do not reliably stop them: a declared code freeze and an ignore-file setting were both bypassed.

Corroboratedobserved2 evidence records1 linked finding

Nov 5, 2025

Malware that queries a language model during execution to generate commands has been used in live operations, including by a state-backed group; self-rewriting variants have been seen only in testing.

Corroboratedobserved2 evidence records

Jul 23, 2025

Malicious or compromised agent extensions, MCP servers, and skills have been published to public registries and used against real users.

Corroboratedobserved4 evidence records

Jul 28, 2025

Approval gates in coding agents do not always show, or even ask about, what the agent is actually about to do.

Corroboratedmeasured2 evidence records

Jul 28, 2025

In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Corroboratedmeasured5 evidence records

Jun 17, 2025

Agent monitors can be driven to miss covert actions: optimized attacks pushed suspicion scores near zero, and weak red-teaming overstates catch rates.

Corroboratedmeasured3 evidence records

Jan 17, 2025

Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks.

Reportedmeasured4 evidence records2 linked findings

May 20, 2025

Frontier labs' layered defenses reduce prompt injection in tool-use, browser and computer-use agents but do not eliminate it.

Qualifiedreported5 evidence records2 linked findings

Feb 14, 2024

AI providers’ early reports found threat actors using LLMs mainly as productivity tools for research, scripting help and content, without novel attack capabilities.

Supersededobserved2 evidence records1 linked finding