--- title: GTIG AI Threat Tracker: Distillation, Experimentation,... description: Google's Threat Intelligence Group reports increasing adversarial misuse of AI in Q4 2025, including model extraction attacks attempting to steal proprietary... canonical: https://daily.dev/posts/gtig-ai-threat-tracker-distillation-experimentation-and-continued-integration-of-ai-for-adversa-npbj5jw1l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use | daily.dev og:description: Google's Threat Intelligence Group reports increasing adversarial misuse of AI in Q4 2025, including model extraction attacks attempting to steal proprietary... og:url: https://daily.dev/posts/gtig-ai-threat-tracker-distillation-experimentation-and-continued-integration-of-ai-for-adversa-npbj5jw1l og:image: https://api.daily.dev/og/posts/NpbJ5Jw1l.png og:image:alt: GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use **[Google Cloud](https://daily.dev/sources/gcp)** · 24 min read · 0 upvotes · 0 comments ## Summary Google's Threat Intelligence Group reports increasing adversarial misuse of AI in Q4 2025, including model extraction attacks attempting to steal proprietary AI capabilities, government-backed threat actors using LLMs for reconnaissance and phishing, and experimental AI-integrated malware like HONESTCUE that leverages Gemini's API for code generation. While no breakthrough capabilities emerged, threat actors from DPRK, Iran, China, and Russia are operationalizing AI across the attack lifecycle—from target profiling to malware development. Google disrupted multiple campaigns by disabling associated accounts and continues strengthening model safeguards against misuse. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Google unleashes even more AI security agents to fight crims](https://daily.dev/posts/google-unleashes-even-more-ai-security-agents-to-fight-crims-qbbsjltt3) · The Register · 0 upvotes · 0 comments - [Introducing Google AI Threat Defense to help you outpace the adversary](https://daily.dev/posts/introducing-google-ai-threat-defense-to-help-you-outpace-the-adversary-40fldosuh) · Google Cloud · 0 upvotes · 0 comments - [AI Security Report 2026](https://daily.dev/posts/ai-security-report-2026-hegfr6vxl) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#ai](https://daily.dev/tags/ai), [#machine-learning](https://daily.dev/tags/machine-learning), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#google-gemini](https://daily.dev/tags/google-gemini) [View this post on daily.dev](https://daily.dev/posts/gtig-ai-threat-tracker-distillation-experimentation-and-continued-integration-of-ai-for-adversa-npbj5jw1l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use","url":"https://daily.dev/posts/gtig-ai-threat-tracker-distillation-experimentation-and-continued-integration-of-ai-for-adversa-npbj5jw1l","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gtig-ai-threat-tracker-distillation-experimentation-and-continued-integration-of-ai-for-adversa-npbj5jw1l"},"datePublished":"2026-02-12T07:09:48.652Z","dateModified":"2026-02-26T18:45:22.908Z","description":"Google's Threat Intelligence Group reports increasing adversarial misuse of AI in Q4 2025, including model extraction attacks attempting to steal proprietary...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEunF","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEunF","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gtig-ai-threat-tracker-distillation-experimentation-and-continued-integration-of-ai-for-adversa-npbj5jw1l","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai,machine-learning,cyber,malware,google-gemini","timeRequired":"PT24M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use"}]} ```