Google: China's APT31 used Gemini to plan cyberattacks against US orgs

Google Threat Intelligence attributes activity to China-backed APT31 using Gemini and the Hexstrike framework to automate vulnerability discovery, targeted reconnaissance, and exploit testing against US organizations; accounts linked to the campaign were disabled. The report warns that agentic AI adoption accelerates attack speed, widens the patch gap, and includes model-extraction attempts against Google’s models, increasing risk to critical infrastructure and enterprise defenses.