2025-01-29
AI providers’ early reports found threat actors using LLMs mainly as productivity tools for research, scripting help and content, without novel attack capabilities.
Google independently reports the same pattern in Gemini use.
Week of Jan 27 – Feb 2, 2025
2 records1 status changes on new evidence0 new findings
What changed in what we know
Attacks & incidents
Jan 29, 2025
Google finds government-backed hackers using Gemini for support tasks, not novel capabilities
Google Threat Intelligence Group analyzed how government-backed hacking and information-operations actors used the Gemini web app. It reports use for research, troubleshooting code and producing content across several attack phases, with Iranian actors the heaviest users, and says it saw productivity gains but no novel capabilities; requests for clearly malicious help drew safety responses.
Policy & standards
Jan 31, 2025
UK publishes AI Cyber Security Code of Practice with 13 principles, later standardized as ETSI TS 104 223
The UK government published a voluntary Code of Practice for the Cyber Security of AI setting 13 principles across five lifecycle phases for developers, system operators and data custodians. It names indirect prompt injection as a distinct AI risk and includes provisions on audit trails, least-privilege access and monitoring system behaviour. ETSI published the content as Technical Specification TS 104 223 in April 2025.