Attack that rewrote everything
On February 12, 2026, Google published a GTIG threat tracker describing large-scale model-extraction campaigns against Gemini. Google said Gemini was targeted by large prompt-flooding campaigns (in one documented case, more than 100,000 prompts) that appear aimed at model extraction (distillation) rather than conventional intrusion.
This was no ordinary cyberattack; it was a calculated, surgical operation designed to steal something far more valuable than passwords. Attackers sought to extract Gemini’s reasoning traces and behavioral patterns (what researchers call the model’s ‘reasoning’ or policy), enabling a clone to replicate Gemini’s problem-solving ability.
No firewall was broken
Most people imagine cyberattacks as dramatic breaches through heavily fortified digital walls. This attack was entirely different. Attackers never broke a single lock or bypassed any firewall.
Instead, attackers abused legitimate public access (APIs and web interfaces) by sending large numbers of specialist prompts. Separately, security researchers have also found code-level vulnerabilities in some Gemini-adjacent tools that could have enabled different kinds of compromise.
Distillation attacks explained clearly
The technical term for this strategy is a distillation attack, also known as model extraction. Attackers flood an AI system with massive volumes of strategically designed prompts across multiple languages and varying levels of complexity.
Every response becomes a valuable data point. Those responses are then fed into a separate, smaller AI model, a student model that learns to think exactly like Gemini without spending a dollar on original research.
Reasoning was the prize
Attackers were not chasing random answers or surface-level information. Every one of those 100,000-plus prompts was precisely engineered to extract Gemini’s reasoning engine, the algorithms enabling it to think through complex problems, weigh competing possibilities, and reach intelligent conclusions.
That step-by-step reasoning capability represents years of exclusive research investment and is precisely what separates a truly advanced AI system from a basic, ordinary search engine.
One campaign, endless prompts
A single documented campaign alone generated over 100,000 unique prompts before Google’s systems detected the suspicious pattern. Google said the prompt campaigns included multilingual sequences aimed at eliciting reasoning behavior — a pattern consistent with attempts to build multilingual clones for commercial or research use, though Google did not publicly confirm the attackers’ commercial intent.
The extraordinary volume and linguistic diversity of these prompts made it one of the most ambitious AI intellectual property theft operations ever publicly disclosed.
Google caught it live
Google says its detection systems identified suspicious querying patterns in real time and that it blocked or disabled implicated accounts and assets during the activity. Google also stated its defenses prevented complete extraction in the documented incidents it reported.
However, Google openly acknowledged a deeply uncomfortable truth: distillation attacks are complicated and potentially impossible to eliminate as long as powerful AI models remain publicly accessible to anyone with an internet connection.
Sophisticated actors, global reach
Investigators confirmed the attacks originated from commercially motivated actors operating across multiple countries worldwide, likely private-sector companies and well-funded independent researchers aggressively seeking competitive advantage in the booming AI marketplace.
The perpetrators were not opportunistic, random hackers. They were organized, technically sophisticated entities with clear financial motivation and the operational resources to systematically clone Gemini’s most valuable capabilities for their own profitable commercial deployment.
Safety guardrails never transfer
The dangers of distillation attacks extend far beyond stolen corporate profits. When an AI model’s capabilities are copied without authorization, the critical safety filters, ethical guardrails, and harm-prevention systems built into the original model rarely transfer to the clone.
Lawmakers were formally warned that distilled models could be recklessly deployed across high-risk domains, including biology, chemistry, and weapons research, and completely stripped of the safety infrastructure that legitimate companies carefully develop over years.
The Gemini Trifecta exposed
Security researchers uncovered three serious simultaneous vulnerabilities across Google’s AI ecosystem, collectively nicknamed the Gemini Trifecta. The flaws affected the Cloud Assist tool, the Search Personalization Model, and the Browsing Tool simultaneously.
Exploiting these weaknesses allowed attackers to steal saved personal user information, harvest precise physical location data, and compromise cloud infrastructure resources, all accomplished through cleverly constructed prompts rather than any traditional code-based intrusion techniques.
Canary in the coal mine
A senior Google security analyst issued a stark warning extending far beyond Google’s own ecosystem. Google, he stated, is the canary in the coal mine for a coming wave of similar attacks targeting smaller companies running custom AI tools trained on sensitive, proprietary data.
Any business with a specialized AI model containing confidential customer records, trade strategies, or exclusive industry knowledge now faces the same threat of extraction without the Google-level detection capabilities that once protected them.
Google’s layered defense architecture
Google responded to this escalating threat by deploying a comprehensive, multi-layered defense system to protect Gemini at every stage of the prompt processing pipeline.
Defenses include proprietary machine-learning classifiers that detect malicious prompts before model exposure, security reinforcement techniques that embed protective instructions around incoming content, Safe Browsing-powered URL redaction, and a human confirmation framework that requires explicit user approval before any potentially sensitive AI-generated action is automatically executed on a user’s behalf.
Curious how this honesty gap could affect kids and families next? Take a moment to explore how Google’s Gemini AI fits into children’s daily lives and what parents should know before trusting it.
AI espionage is permanent now
The 100,000-prompt Gemini attack signals something far larger than a single corporate security incident. It marks the permanent arrival of AI espionage as a defining characteristic of the modern technology era.
As the global AI race accelerates and models embed deeper into critical business and government operations, the drive to steal, clone, and weaponize artificial intelligence will only intensify. Building powerful AI is no longer sufficient; it is now an equally urgent, billion-dollar obligation.
Want to see how far Google is going to put Gemini everywhere you look? Take a quick peek at how it’s being pushed onto Galaxy devices and why that matters.
Have you ever caught an AI sounding super confident and still being wrong? Share what happened in the comments.
This slideshow was made with AI assistance and human editing.
Don’t forget to follow us for more exclusive content right here on MSN.
Read More From This Brand:
Lucky you! This thread is empty,
which means you've got dibs on the first comment.
Go for it!