Google’s Adversarial-Misuse Report on Gemini: State-Backed Actors and AI-Assisted Cyber Operations
Google’s Threat Intelligence Group (GTIG) published its first adversarial-misuse report on January 29, 2025, documenting how state-backed actors from Iran, China, North Korea, and Russia used Gemini across multiple stages of cyber operations. The findings reveal that while generative AI tools like Gemini accelerate threat actor productivity, they have not yet introduced novel attack capabilities beyond existing frameworks. The report aligns with similar analyses from OpenAI and Microsoft, emphasizing that AI misuse currently mirrors traditional cyber tactics rather than revolutionizing them.
The analysis was conducted using a combination of manual review by GTIG analysts and LLM-assisted detection methods. GTIG, which specializes in tracking government-backed cyber espionage, coordinated information operations (IO), and serious cybercrime, identified Gemini misuse by correlating technical signals from threat actor infrastructure with activity on Google’s platforms. This approach allowed GTIG to disrupt malicious campaigns and share insights with the broader security community to strengthen defenses.
Threat Actor Behavior: Productivity Gains Without Novel Capabilities
State-backed actors primarily used Gemini for routine tasks that align with established attack methodologies. Iranian advanced persistent threat (APT) groups were the most active, leveraging Gemini for infrastructure research, vulnerability discovery, payload development, and evasion techniques. Russian APT actors demonstrated limited engagement during the observed period, while Chinese and North Korean actors were not explicitly highlighted in the report’s detailed breakdown. Iranian IO actors accounted for 75% of all Gemini misuse by IO groups, focusing on content generation, persona development, translation, and audience expansion tactics.
The report found no evidence of threat actors developing original or persistent prompt attacks—such as those outlined in Google’s Secure AI Framework (SAIF)—to bypass Gemini’s safety controls. Instead, misuse attempts relied on publicly available jailbreak prompts with minor variations, such as rephrasing instructions or repeating prompts. These efforts were uniformly unsuccessful, indicating that Gemini’s safeguards effectively restricted assistance for explicitly malicious tasks. Safety responses were triggered when actors sought help with Gmail phishing, Chrome infostealer coding, or Google account verification bypasses.
Gemini’s role in threat operations was largely operational rather than transformative. APT actors used the model to streamline research, troubleshooting, and scripting, while IO actors relied on it for content localization and messaging refinement. The report notes that generative AI currently functions as a productivity tool—similar to existing frameworks like Metasploit or Cobalt Strike—rather than enabling breakthrough attack vectors. Skilled actors benefit from accelerated workflows, while less experienced operators gain access to techniques they might otherwise struggle to develop independently.
Limitations and Future Risks in AI-Assisted Cyber Operations
While the report underscores the absence of novel AI-driven attack capabilities, GTIG acknowledges the evolving nature of the AI landscape. Emerging agentic systems and new models could introduce more sophisticated misuse scenarios, particularly as threat actors adapt to advancements in AI functionality. The report distinguishes between two primary misuse vectors: accelerating existing campaigns (e.g., generating phishing content or malware code) and instructing AI agents to perform malicious actions (e.g., data exfiltration). The latter remains a theoretical risk under Google’s SAIF taxonomy but has not yet materialized in observed campaigns.
Google’s proactive measures, including continuous model improvements and disruption of malicious activity, have mitigated immediate risks. However, the report emphasizes the need for collaboration among private sector organizations, governments, and academic institutions to address broader AI security challenges. GTIG’s findings suggest that while generative AI lowers the barrier to entry for less skilled actors, it does not fundamentally alter the core tactics of state-backed cyber operations. The focus remains on detecting and disrupting misuse while fostering responsible AI development across the industry.