State-Sponsored Adversary Use of the Gemini API for Vulnerability Research and Operational Support (2026)

Incident Summary

On May 11, 2026, the Google Threat Intelligence Group (GTIG) published a report on AI-enabled vulnerability exploitation and initial access, describing observed use of the Gemini API by multiple state-sponsored threat actors for vulnerability research and offensive support.^[1]

GTIG named three state-aligned clusters. It reported observing UNC2814, a PRC-nexus group, “use this form of expert persona prompting by directing the model to act as a senior security auditor or C/C++ binary security expert,” seeking vulnerability analysis of TP-Link firmware and Odette File Transfer Protocol implementations. APT45, a DPRK-aligned group, was observed “sending thousands of repetitive prompts that recursively analyze different CVEs and validate PoC exploits.” APT27, also PRC-nexus, “leveraged Gemini to accelerate the development of a fleet management application” supporting an operational relay box (ORB) network.^[1]

GTIG places expert-persona prompting in the context of “persona-driven jailbreaking attempts” and prompt injection. It does not publish refusal rates or control-testing results, so the extent to which Gemini’s safety controls were bypassed rather than simply not triggered is not established in the public record.

Google reported taking action against the documented activity by disabling the associated assets.^[1] The disclosure was covered by BleepingComputer, CSO Online, SiliconANGLE, and other outlets.^[2][3][4]

A separate case in the same GTIG report, involving an unattributed criminal actor and AI-assisted development of a working zero-day exploit, is recorded separately as INC-26-0105. The two are kept apart because their actors, attribution confidence, and outcomes differ.

Key Facts

• Disclosure source: Google Threat Intelligence Group, published May 11, 2026
• State-aligned actors named: UNC2814 (PRC-nexus), APT45 (DPRK-aligned), APT27 (PRC-nexus)
• Model involved: Google Gemini, accessed via the Gemini API. Google is the model provider; the threat actors were users of that API, not its developers or deployers
• Techniques described: Expert-persona prompting, recursive CVE analysis across thousands of repetitive prompts, AI-assisted development of offensive support tooling
• Targets cited: TP-Link firmware, Odette File Transfer Protocol, ORB-network fleet management
• Vendor response: Google reported disabling the assets associated with the documented activity
• Observation dates: Not published by GTIG, which describes the activity only as recently observed
• Related record: INC-26-0105 covers the unattributed criminal AI-assisted zero-day case from the same report

Threat Patterns Involved

Primary: Automated Vulnerability Discovery — APT45’s recursive CVE-analysis workflow and UNC2814’s expert-persona security-audit prompts both use an LLM to assist vulnerability triage and exploit validation.

Secondary:

• Jailbreak & Guardrail Bypass — GTIG characterizes expert-persona prompting within its discussion of persona-driven jailbreaking attempts. The public record describes the technique, not a measured bypass rate.
• Tool Misuse & Privilege Escalation — APT27’s use of Gemini for ORB fleet-management development illustrates a general-purpose assistant being applied to offensive-operations tooling.

Significance

GTIG’s report documents adversary use of a commercial LLM in security-relevant workflows, at a scale and specificity not previously published for these actors.

1. State adoption is described as repetitive and high-volume. GTIG’s account of APT45 sending “thousands of repetitive prompts that recursively analyze different CVEs and validate PoC exploits” describes a triage workflow rather than isolated experimentation.
2. Expert-persona framings remain a live concern for frontier safeguards. GTIG situates UNC2814’s prompting within persona-driven jailbreaking. Whether current alignment training reliably refuses adversarial security-research framings is not answered by this disclosure.
3. The provider holds an observation position defenders do not. Prompt-level activity is visible to the model vendor rather than to endpoint or network defenders, which is why the documented response came from Google disabling assets.

Analyst assessment

The following are this project’s interpretations rather than findings stated by GTIG, and they are not established by the incident record alone.

• LLM assistance may reduce the marginal effort of CVE triage for actors with API access, though the disclosure does not quantify any productivity change.
• Detection of this class of activity appears to concentrate at the model-provider layer. Endpoint and network defenders may have limited visibility into prompt-level workflows, which suggests provider-side monitoring carries disproportionate weight for this threat class.
• Asset disablement addresses observed accounts. It does not, on its own, indicate whether actors migrated to alternative commercial or open-weights models.