Ledger / 12 Feb 2026
APT31 drove Gemini with Hexstrike MCP tooling against US targets
Confirmed
Google observed the prompting directly.
APT31 gave Gemini an expert persona and used it to analyze RCE, WAF bypass and SQL injection test results against named US targets.
“trialing Hexstrike MCP tooling, and directing the model to analyze remote code execution (RCE), web application firewall (WAF) bypass techniques, and SQL injection test results against specific US-based targets”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial UseGoogle Threat Intelligence Group · 12 Feb 2026 · primary source
- Disclosed
- 12 Feb 2026
- Activity
- 2025
- Actor
- APT31 (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- China
- Targets
- US-based targets
- What the AI did
- Vuln research, Exploit dev, Ops automation
- Model
- Gemini, Hexstrike MCP
- Model family
- Google, Open-source harness
- Model basis
- stated by vendor
- Autonomy
- semi-autonomous
- Outcome
- Google reports; outcome not stated.