Google to critical infra orgs: Our AI scanners won't be evil, promise

security

Gemini 3.8 Flash Cyber and Wiz's Red Agent team up to protect hospitals, public transit, and tech

Google has jumped on the AI-defense-for-critical-systems train with its Scan for Good initiative, and says that its threat-hunting models have already autonomously uncovered critical security issues at hospitals, a municipality, a public rail operator, and major technology providers. So don't fear these bots. 

The initiative, announced on Thursday, uses Google’s Gemini 3.8 Flash Cyber, a version of the model tuned for software bug hunting and remediation, and Wiz’s Red Agent - this is the Google-owned cloud security shop’s pentesting AI agent. The AI systems will uncover public exposures and attack paths across public services, critical infrastructure, and nonprofits, and then hand these off for verification and remediation to human security researchers.

“The program has been active over the past several months, and with this official launch, we are scaling it globally,” Gal Nagli, head of offensive security at Wiz, told The Register. “There is no set end date.”

It's similar to OpenAI’s Daybreak for Frontline Defenders initiative, announced earlier this month. This program will distribute $1 billion in credits to subsidize access to OpenAI services and training for resource-strapped cyber defenders, including those protecting water and energy systems, community banks, local governments, nonprofits, and open-source projects.

And like OpenAI’s new program, the Wiz and Google DeepMind partnership follows disclosures that Google’s AI agents also escaped their sandboxes and hacked other companies’ websites - as did agents developed by OpenAI, Anthropic, and Meta, and those are just the ones we know about.

It also comes as existential dread about AI killing all of humanity reaches a fever pitch.

AI for good (not evil)

Scan for Good aims to put offensive security agents and Gemini 3.8 Flash Cyber to good, not evil, use. When authorized, either explicitly by organizations that apply for an assessment or under applicable bug bounty programs and vulnerability disclosure policies, the AIs will examine publicly facing websites, APIs, and applications for exposures, and then work with organizations to find and fix these. 

Every potential finding will be reviewed and validated by a human, and Wiz assures that “humans will remain responsible for confirming impact and making disclosure decisions.”

When the bots and humans do identify a serious issue, the humans will contact the affected organization and work with them to remediate the security holes.     

Google’s AI systems have already helped critical organizations and tech providers find serious, internet-facing risks, including a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories. 

In this bug-hunting expedition, conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz’s Red Agent autonomously identified a script injection vulnerability in snowflakedb/snowflake-connector-net. The flaw allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title.

Wiz disclosed the issue on June 23, and Snowflake fixed it on the same day, rotated the affected credential, and verified through detailed audit logs that Wiz was the only actor during the exposure window.

Real-world examples

The Google-owned biz provided several other examples of its AI for good, and said all of these were autonomously discovered by the models before Wiz validated them, but “only far enough to confirm real-world impact.”

At that point, they privately notified the affected organization about the issue and helped it remediate the vulnerability.                                                                        Some of these include:

• An exposed administrator key enabled read, write, and delete access to 8.8 million files in a “nationally significant archive” belonging to an unnamed Middle Eastern country. Assigning the correct set of permissions fixed the flaw.

• A public hospital with missing access controls exposed staff contact information and gave anyone online control of a hospital-wide mobile alert channel. 

• A private hospital’s public appointment-booking site used an unsafe upload method that would have allowed attackers to take control of a hospital server and obtain patient identifiers, clinical information, and consent signatures.

• A municipality’s public data service exposed sensitive personal, health, and financial information belonging to about 5,000 elderly residents. Wiz confirmed the risk without collecting a bulk dataset.

• A public rail operator had a leaky production database that exposed active administrator sessions. This could have allowed criminals to take control of routes, schedules, service announcements, and administrator accounts - essentially disrupting the entire transportation system. Wiz helped the operator secure the system.

The US Cybersecurity and Infrastructure Security Agency (CISA) also gave Scan for Good its stamp of approval, and Wiz told us the American cyber-defense agency provided guidance on the initiative. “At a time of evolving threats, defensive vulnerability discovery helps strengthen the nation’s digital infrastructure,” CISA acting director Nick Andersen said in a statement. ®