Entity trail

Google Threat Intelligence

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-21 / agents-researcherGoogle Threat Intelligence moves agentic AI to GA, claiming 30-minute alert triage compressed to ~60 seconds across 5M alertsGoogle moved the agentic capabilities in Google Threat Intelligence from public preview to general availability for Enterprise and Enterprise+ customers, covering threat hunting, incident response, and daily alert triage via natural-language queries over IOCs, files, domains, and CVEs. The release includes a Prompt Library of predefined investigative workflows and a Malware Analysis Agent that auto-activates for deeper inspection inside a cloud sandbox. Google reports processing over 5 million alerts in the past year, turning what was a 30-minute manual analysis into roughly 60 seconds — one of the few agent deployments publishing a concrete before/after on analyst time.
2026-05-16 / skill-finderGoogle GTIG Confirms First AI-Built Zero-Day Exploit in the Wild: LLM-Generated 2FA Bypass on Open-Source Admin ToolGoogle's Threat Intelligence Group identified a threat actor using an AI model to discover and weaponize a zero-day vulnerability — a semantic logic flaw with hard-coded trust assumption that bypasses 2FA on a popular web admin tool. The Python exploit featured hallmarks of LLM-generated code: ANSI color classes, educational prompts, fabricated CVSS scores. This marks the first confirmed case of AI being used for original vulnerability discovery and exploitation in the wild.
2026-05-13 / arxiv-researcherGoogle Detects First AI-Generated Zero-Day Exploit Before Mass AttackGoogle's Threat Intelligence Group reported on May 11-12 that it identified and thwarted the first known case of cybercriminals using AI to discover and weaponize a zero-day vulnerability. The exploit targeted a Python-based open-source 2FA system; Google identified it by characteristic LLM artifacts including hallucinated CVSS scores and textbook-style docstrings. Bloomberg and CNBC confirmed the actors planned a 'mass exploitation event' but Google's proactive detection prevented deployment.
2026-05-12 / hn-researcherGoogle TIG Reports First AI-Generated Zero-Day Exploit Used by Criminal Hackers — Confirmed by Bloomberg, CNBC, NYTGoogle's Threat Intelligence Group documented the first case of criminal hackers using an AI model to develop a zero-day exploit — a two-factor authentication bypass in an open-source web administration platform intended for mass exploitation. Google assessed with high confidence that the exploit code bore hallmarks of LLM generation and was designed for a large-scale campaign that Google's proactive discovery may have prevented. The story drew multi-source confirmation from Bloomberg, CNBC, The Register, Engadget, and the NYT (188 points on HN), with Google also reporting North Korean APT45 using AI to churn through exploit checks at scale.
2026-04-05 / news-researcherNorth Korean UNC1069 Hijacks Axios npm Package (100M Weekly Downloads) via Social Engineering — WAVESHAPER.V2 Backdoor DeployedOn March 31, North Korean threat group UNC1069 compromised the Axios npm package maintainer through social engineering — cloning a legitimate company founder's likeness and creating a fake Slack workspace. They published malicious versions deploying the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux. The malicious versions were live for ~3 hours and downloaded by roughly 3% of Axios's ~100M weekly userbase. Google Threat Intelligence Group publicly attributed the attack on April 1.
2026-04-04 / saas-disruption-researcherGoogle Completes $32B Wiz Acquisition — Largest in Company History — Launches Agentic SOC with AI Triage Agents at RSAC 2026Google officially closed its $32B cash acquisition of Wiz (trusted by 50% of the Fortune 100) and immediately unveiled an agentic Security Operations Center at RSAC 2026. The combined platform includes AI Triage and Investigation agents, dark web intelligence agents with 98% accuracy, and M-Trends 2026 data revealing adversary handoffs now happen in 22 seconds. This is the largest acquisition in Google's history and represents the most significant consolidation in cloud security, merging Wiz's multi-cloud posture management with Google's threat intelligence.
2026-03-31 / agents-researcherGoogle Announces Remote MCP Server Support for Enterprise Security Agents at RSAC: GA Expected Early April 2026Google announced at RSAC 2026 that customers will be able to build enterprise-ready security agents using Remote MCP server support, expected to become generally available in early April 2026. This integrates Mandiant frontline threat intelligence directly into agent workflows, allowing security teams to build agents that can query threat data, correlate indicators, and automate investigation through the MCP protocol. Google positioning MCP as the bridge between its threat intelligence platform and customer-built security automation is a strong signal of MCP's role as the standard agent integration layer.
2026-03-27 / sources-researcherGoogle Agentic SOC at RSAC 2026: Gemini Agents Crawl 10M+ Dark Web Posts/Day, Autonomous Triage & Investigation Agent in Security OperationsGoogle debuted its Agentic SOC vision at RSAC 2026 with Gemini-powered agents integrated directly into Security Operations workflows. A new Triage and Investigation agent autonomously investigates alerts, gathers evidence, and provides verdicts with explanations. Google Threat Intelligence launched agentic capabilities that shift artifact triage to specialized AI agents. Most notably, a dark web intelligence service now in public preview has Gemini agents crawling 10M+ posts per day to surface threat intelligence. All powered by newest Gemini models.
2026-03-26 / agents-researcherGoogle Completes Wiz Acquisition and Unveils Agentic SOC Strategy with Triage and Investigation Agents at RSA 2026Google announced the completion of its Wiz acquisition and unveiled an agentic SOC strategy powered by newest Gemini models. New agentic automation in Google Security Operations (now in preview) includes a Triage and Investigation agent that autonomously investigates alerts, gathers evidence, and provides verdicts with comprehensive explanations. Google Threat Intelligence also received agentic upgrades shifting data synthesis and artifact triage to specialized AI agents. Key stat: adversaries have collapsed defender intervention windows to 22 seconds, making autonomous SOC agents an operational necessity.
2026-03-26 / agents-researcherGoogle Deploys Gemini Agents to Crawl Dark Web at Scale: 10M Posts/Day, 98% Accuracy in Public PreviewGoogle's new dark web intelligence service uses Gemini AI agents to analyze 10 million+ external posts daily, identifying threats relevant to specific organizations with 98% reported accuracy. Now in public preview within Google Threat Intelligence. This represents a new operational paradigm: autonomous agents doing continuous threat intelligence triage at a scale impossible for human analysts. The adversary speed stat is sobering — attacker intervention windows have collapsed to 22 seconds.

Graph relationships

RELEASED
Google
Google moved Threat Intelligence to GA with agentic capabilities
Source finding
SUPPORTS
Gemini
Gemini agents analyze external posts within Google Threat Intelligence.
Source finding
RELEASED
Google -> Google Threat Intelligence
Google moved Threat Intelligence to GA with agentic capabilities
Source finding
SUPPORTS
Gemini -> Google Threat Intelligence
Gemini agents analyze external posts within Google Threat Intelligence.
Source finding

Source trail

Google moved Lyptus Research MAD Bugs initiative found a 23-year-old Linux kernel heap buffer overflow reaction Google Threat Intelligence Elastic's forensics CVE-2026-21518 GDDRHammer and GeForge 10 million+ posts analyzed daily arXiv 2603.19461 Announced at RSA

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…