Ledger / 11 May 2026
DPRK and PRC clusters use Gemini and agent tools for scaled vulnerability research
Confirmed
Google, the model provider, observed the prompts in Gemini.
GTIG observed APT45 sending thousands of repetitive prompts to analyze CVEs and validate PoC exploits, and UNC2814 using expert-persona jailbreaks for router and firmware research. Actors also experimented with agentic tools OpenClaw and OneClaw. Date is the report date, not an incident date.
“we have observed APT45 sending thousands of repetitive prompts that recursively analyze different CVEs and validate PoC exploits”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessGoogle Threat Intelligence Group · 11 May 2026 · primary source
- Disclosed
- 11 May 2026
- Activity
- 2026
- Actor
- APT45; UNC2814 (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- North Korea (APT45); PRC-associated (UNC2814)
- Targets
- Embedded devices (TP-Link firmware, OFTP implementations) and CVE/PoC validation
- What the AI did
- Vuln research, Exploit dev
- Model
- Google Gemini, OpenClaw, OneClaw, wooyun-legacy Claude Code skill
- Model family
- Google, Unspecified, Anthropic
- Model basis
- stated by vendor
- Autonomy
- semi-autonomous
- Outcome
- Accounts disrupted; GTIG reports sustained AI-augmented exploit research, no specific victim named.