Google finds state-sponsored hackers use AI at ‘all stages’ of attack cycle 

Google’s Threat Intelligence Group found evidence that state-sponsored hacking groups have leveraged the Gemini AI model at multiple stages of cyber operations—using it for OSINT collection, reconnaissance, troubleshooting and occasional malware code generation, and to produce deceptive content for information operations—while generally treating it as a supplementary tool rather than enabling fully autonomous, large-scale automated attacks.