Google warns how hackers may use AI to target governments, organisations, and others

Artificial Intelligence

Google has released a new report that explores how threat actors are using generative AI to accelerate their campaigns. The report, details new findings across advanced persistent threat (APT) and coordinated information operations (IO) actors tracked by Google's Threat Intelligence Group (GTIG).

“We believe the private sector, governments, educational institutions, and other stakeholders must work together to maximize AI's benefits while also reducing the risks of abuse,” said Google in the report.

The report discusses how APT and IO actors are attempting to misuse Gemini, a large language model developed by Google. The report shares our findings on government-backed threat actor use of the Gemini web application.

The report also explores how generative AI can be used to create deepfakes and other forms of misinformation. The report warns that these technologies could be used to manipulate public opinion and undermine democratic processes. “While we do see threat actors using generative AI to perform common tasks like troubleshooting, research, and content generation, we do not see indications of them developing novel capabilities,” noted Google.

Google also explained how attackers can use AI to target organizations and governments. Attackers can use LLMs in two ways, as per Google. One way is attempting to leverage LLMs to accelerate their campaigns (e.g., by generating code for malware or content for phishing emails). “The overwhelming majority of activity we observed falls into this category,” said Google. The second way attackers can use LLMs is to instruct a model or AI agent to take a malicious action (e.g., finding sensitive user data and exfiltrating it), said Google.

Google's tips to stay safe

Google recommends that organisations take the following steps to protect themselves from the risks of generative AI:

• Be aware of the potential for generative AI to be used for adversarial purposes.
• Train your employees on how to identify and report deepfakes and other forms of misinformation.
• Use security tools to detect and prevent the misuse of generative AI.
• Work with governments and other stakeholders to develop policies and regulations to address the risks posed by generative AI.