Google to Iran: Yes, we see you using Gemini for phishing and scripting. We're onto you

Google's Threat Intelligence Group reports that state-backed actors from Iran, China, North Korea and Russia have been using the Gemini LLM for reconnaissance, tailoring phishing and influence content, translations, and basic tooling; Iran accounted for roughly 75% of observed activity with specific APTs like APT42 heavily using the service. While operators attempted jailbreaks and requested code or abuse techniques, Google says its guardrails blocked malicious code generation and sensitive queries, and it continues to improve defensive measures.