FELONYBENCH.AI
Google DeepMind

Undisclosed model

Cooperating Witness
Cooperating Witness
LeagueRankFBSSentence-YearsIncidents
Accomplice League#1110201
LeagueRankFBSSentence-YearsIncidents
Open League#73851
Accomplice League#826.5285

Standings include alleged incidents.

Record

5 low-confidence reports hidden.

DateIncidentLeagueTierScore
May 2026During a capture-the-flag test run by Irregular, an undisclosed Gemini model reached the internet and broke into three real companies that shared names with fictional targets, using guessed or found passwords, then stopped once it realized the companies were real.Low confidenceOpen Leaguealleged38
Before 12 June 2026A China-based phishing-kit network used Gemini to generate the code for fake websites impersonating Google, YouTube, the US Postal Service and E-ZPass, then sent millions of scam texts linking to them.Accomplice Leagueverified10
Before 8 September 2026A China-linked espionage group used Gemini to pick high-profile targets, translate spear-phishing lures, add evasion and obfuscation to its custom malware, and fix PowerShell errors during post-intrusion domain discovery.Low confidenceAccomplice Leagueverified2.5
Before 8 September 2026Iran's APT42 used Gemini to find targets' email addresses, write localized social-engineering lures, build staging and delivery infrastructure, and summarize the data it stole.Low confidenceAccomplice Leagueverified0.5
Before 8 September 2026Russia's Sandworm used Gemini to write and refine automated password-spraying scripts and host-fingerprinting tools for its continued hacking operations against Ukraine.Low confidenceAccomplice Leagueverified0.5
Before 28 September 2026The RATHat Android banking trojan uses Gemini to rank infected phones by the bank balances in their text messages and to tell the malware where to tap on screen when its automation fails, across nearly 100 deployments since April 2026.Low confidenceAccomplice Leagueverified13