Google's Gemini Survived 100,000+ Cloning Attempts from Iranian and Chinese APTs

Everyone thinks AI model theft is some distant sci-fi threat. Wrong. It's happening right now, at massive scale, and Google just gave us the receipts.

Google's Threat Intelligence Group dropped a bombshell: attackers hammered Gemini with over 100,000 prompts trying to clone it. We're not talking script kiddies here—this was APT42 (Iranian), UNC795 (PRC-based), and APT41 running sophisticated extraction campaigns.

What gets me excited (in a terrifying way) is how clever these attacks were. The attackers weren't just brute-forcing responses. They targeted Gemini's internal reasoning traces—those step-by-step thought processes that models usually summarize for us mere mortals.

Think about that for a second. They figured out how to trick Gemini into showing its work. Full reasoning outputs instead of sanitized summaries. It's like getting a genius to think out loud instead of just giving you the answer.

The Elephant in the Room

Here's what nobody wants to admit: our API-first AI world is fundamentally vulnerable to this. Gemini launched in December 2023 as Google's answer to GPT-4, positioning itself as the reasoning champion. That advanced reasoning? It made Gemini a premium target.

The attack surface is massive:

• Model extraction via API queries
• Distillation through behavior replication
• Social engineering using AI-generated personas
• Malware development with AI-assisted debugging

Google's response? They "disabled associated assets" for these threat actors. That's corporate speak for "we banned them, but there are probably thousands more we haven't caught."

What This Means for Us Builders

As developers, we're living in a new reality. The same APIs we use to build cool stuff are being weaponized at nation-state levels. Three critical takeaways:

1. Rate limiting isn't enough - 100,000 prompts got through before detection

2. Reasoning traces need protection - summarization enforcement is now a security feature

3. Input sanitization is critical - especially for CLI tools (looking at you, Gemini CLI)

The attackers used Gemini for everything from code auditing to exploitation research. They turned Google's own model against itself.

The Market Reality Check

This changes everything for AI infrastructure. Free-tier APIs suddenly look like massive liability exposure. Premium models like Gemini Advanced might become the only viable option for serious applications.

We're seeing the birth of a new industry: AI security services. Companies like Tracebit are already building canary tokens and detection systems specifically for AI attacks. The 2026 AI market was projected at $200B+. Add AI security as a mandatory line item.

The geopolitical angle is wild too. Chinese and Iranian state actors are using American AI models to build offensive capabilities. That's going to accelerate the push toward closed-source models and restricted APIs.

The Technical Reality

What fascinates me most is how Google's GTIG describes these as "augmented attacks" and "new AI-enabled malware." We're not just defending against traditional threats anymore. We're dealing with AI attacking AI.

The detection challenge is enormous. How do you differentiate between legitimate research queries and extraction attempts when both look like heavy API usage? Google clearly struggled with this—100,000+ prompts is a lot of activity to miss.

Bottom line: The age of naive AI deployment is over. Every API call is potentially hostile. Every model interaction could be an extraction attempt.

We wanted AGI. We got Advanced Persistent Threats with PhD-level reasoning capabilities.

Welcome to the AI security arms race. Hope you brought rate limits.