In this conversation, Marco Li Mandri of ING lays out a clear, structured view of what responsible AI deployment actually requires inside a global bank. While much of the industry conversation focuses on what AI can do, Li Mandri is firmly focused on what must be in place before it is allowed to do it.
He describes ING’s approach as resting on three non-negotiable pillars. The first is purpose and permission. AI must be used only where there is a clear justification — either because it is mandated by regulation or because the customer has explicitly given consent. Without this foundation, no technical sophistication can make an AI use case acceptable. Purpose defines legitimacy.
The second pillar is process. Li Mandri explains that generative AI introduces an entirely new category of risk — far beyond what traditional models or rules-based systems created. In response, ING has implemented a dedicated GenAI risk assessment framework, designed specifically to evaluate the unique risks this technology brings. This framework considers more than one hundred distinct risk factors, allowing ING to examine issues individually rather than treating AI risk as a single abstract concern. From bias and hallucination to explainability and misuse, each risk is assessed deliberately and transparently.
But purpose and process alone are not enough. The third pillar is productisation. AI governance cannot live in policy documents or slide decks — it must be embedded directly into the product itself. Li Mandri explains that ING’s AI and GenAI platforms are built as robust systems with humans firmly in the loop, real-time monitoring, and automated detection of anomalies or errors. AI systems actively flag when something is going wrong, allowing teams to intervene quickly and remain in control.
This embedded governance model is critical. Rather than relying on periodic reviews or retrospective audits, ING monitors accuracy, behaviour, and hallucination risk continuously. Control is not an afterthought — it is designed into how the product operates every day.
What emerges is a picture of AI not as an experiment, but as a managed capability. ING is not trying to eliminate risk — an impossible task — but to understand it deeply, isolate it clearly, and control it consistently. This approach allows the bank to innovate while remaining compliant, resilient, and trustworthy.
Li Mandri’s message is pragmatic and cautionary in equal measure. AI’s power demands discipline. Institutions that rush to deploy without purpose, process, and embedded control risk losing trust long before they gain value. ING’s approach shows that moving fast and staying in control are not opposites — but only if governance comes first.
Bitcoin (BTC) rallied to $69,482 on Friday, and the rally coincided with data showing steady accumulation from smaller-sized holders in February.
Analysts say the breakout may evolve into a broader bullish trend, although other data suggest that a longer period of price consolidation will underlie the emerging bull trend.
Key takeaways:
BTC broke above the $69,000 resistance and its descending channel, triggering $92 million in short liquidations within four hours.
Small wallets added $613 million in February, while the whale wallets stalled with $4.5B billion in outflows.
Short-term holder profit-ratio indicator hit its lowest level since November 2022, underscoring weak sentiment over the past few weeks.
Will the Bitcoin relief rally last?
Bitcoin has pushed above the upper boundary of its descending channel and retested $69,000. The move marks a potential bullish break of structure (BOS), if BTC holds above $68,000.
If BTC holds above this reclaimed level, the next internal liquidity zones sit near $71,500 and $74,000. The 50 and 100-period exponential moving averages (EMAs) are now compressing beneath the price on the one-hour chart, reinforcing the possibility of the short-term momentum continuing.
The latest price surge triggered roughly $96 million in futures liquidations over the past four hours, with nearly $92 million coming from short positions, signaling a short squeeze on bearish traders.
BTC liquidations were primarily concentrated on Bybit (22.5%), Hyperliquid (22%), and Gate (15%), suggesting these platforms account for a significant share of active leveraged positioning in the market.
The breakout is supported by the steady buying from the smaller-sized investors. Order flow data from Hyblock shows that the small wallets ($0–$10,000) have accumulated roughly $613 million in cumulative volume delta (CVD) in February, consistently bidding during the price correction.
The mid-sized wallets ($10,000–$100,000) remain around -$216 million for the month, but the cohort added roughly $300 million since BTC fell below $60,000, suggesting selective accumulation during discounted periods.
Bitcoin CVD data across different wallet sizes. Source: Hyblock Capital
Whale wallets ($100,000 and above) saw their CVD bottom near -$5.8 billion earlier in February and have since moved sideways. This stabilization implies that the aggressive distribution has paused, though a clear accumulation trend from the large holders has yet to emerge.
For the rally to continue, whale buying may need to return, and the short-term holder spent output profit ratio (SOPR) may need to move back above 1, signaling that the recent buyers are no longer selling at a loss.
Notably, the short-term holder SOPR recently fell to its lowest level since November 2022, indicating that many recent buyers have been realizing losses, a sign that conviction may remain fragile despite the rebound.
Related: Bitcoin passes $69K on slower US CPI print, but Fed rate-cut odds stay low
This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision. While we strive to provide accurate and timely information, Cointelegraph does not guarantee the accuracy, completeness, or reliability of any information in this article. This article may contain forward-looking statements that are subject to risks and uncertainties. Cointelegraph will not be liable for any loss or damage arising from your reliance on this information.
The DeFi Education Fund (DEF) has urged the U.K.’s Financial Conduct Authority to adopt a narrow, functional definition of “control” as it finalizes new rules for crypto asset activities.
The Washington, D.C.-based advocacy group argued that regulatory obligations should hinge on whether an entity has unilateral authority over user funds or transactions, not merely whether it developed or contributed to a decentralized protocol, in a response to an FCA consultation paper shared exclusively with CoinDesk.
“Control should be the determinative factor” of regulatory scope, DEF said, warning that software developers could otherwise be swept into intermediary-style obligations despite lacking custody or transactional authority.
The submission focuses on an area of the consultation which considers how decentralized finance (DeFi) arrangements should be treated under the U.K.’s emerging crypto regime. DEF supports the FCA’s control-based approach in principle but says it must be tied to concrete operational powers, such as the ability to initiate or block transactions, modify protocol parameters or exclude users.
DEF is an organization focused on informing policymakers and regulators about the benefits of DeFi and has been one of the prominent lobby groups on the road to crypto regulatory frameworks being established in Washington in recent years.
The group also challenged the FCA’s framing of DeFi-specific risks, arguing that cybersecurity vulnerabilities are not unique to blockchain systems and that public blockchains offer transparency advantages in combating illicit finance.
Applying prudential, reporting and platform access requirements designed for centralized trading platforms to non-custodial, automated protocols would be “ill-suited,” DEF said.
The FCA is seeking to bring a broad range of crypto activities within its regulatory perimeter as the U.K. moves toward a comprehensive digital asset framework.
Read More: UK regulators start major consultation on crypto listings, DeFi, and staking
The CEO of Binance France was the target of a home invasion attempt by three intruders, according to a local news report.
The executive and his family are safe, and the three individuals were arrested later that day.
Physical attacks for crypto, or “wrench attacks,” were on the rise last year with $41 million in confirmed losses according to CertiK.
A trio of criminals attempted to rob the CEO of Binance France, but only made away with two cell phones before being arrested later that day, according to a local news report from RTL News.
The report did not name the executive, but David Prinçay holds the role CEO of Binance France. The executive was not home when the intruders entered his residence, and they fled shortly thereafter.
“We’re aware of reports concerning one of our colleagues in France. He and his family are safe and working closely with law enforcement,” Binance co-CEO Richard Teng posted on X. “Authorities have informed us that three individuals have been arrested. The investigation remains active, and we are cooperating fully.”
A spokesperson for Binance told Decrypt that it “would not comment on specific details to protect the integrity of the ongoing investigation and ensure the safety of all involved individuals.”
According to the local news report, the assailants first entered a different residence in the building while seeking directions to the executive’s apartment.Later, the trio used the same vehicle, captured in CCTV footage, to travel to another residence. There they were reportedly overheard discussing an incorrect address before fleeing the scene.
Around this time, police were mobilized and were able to track the group on public transport, before they were apprehended and taken into custody at the Lyon Perrache train station.
Good to hear David and his family are safe. This highlights the importance of safety and privacy.
I hope the France law enforcement catches these bad actors in the physical world and keeps the country safe. https://t.co/QhuWJDaeN2
“Good to hear David and his family are safe. This highlights the importance of safety and privacy,” Binance co-founder and former CEO Changpeng Zhao posted on X.
The failed invasions were the latest in a series of attempted or completed crypto-related physical attacks in France, often called “wrench attacks.” Last week, six individuals were arrested after kidnapping a magistrate and seeking a crypto ransom, plus multiple reported physical attacks took place in January.
Last month, a cybersecurity expert told Decrypt that France has experienced “one of the most visible waves of violent, crypto-linked kidnappings and extortion attempts in the EU.” It was also home to one of last year’s most high-profile wrench attacks, which involved the kidnapping of another crypto executive, Ledger co-founder David Balland.
A database of wrench attacks compiled by Casa co-founder and Chief Security Officer Jameson Lopp lists 14 physical wrench attacks since the year began—11 of which are labeled as occurring in France.
Wrench attacks jumped 75% year-over-year in 2025 and reached a record high in confirmed crypto losses, totaling nearly $41 million, according to a report from blockchain security firm CertiK.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Bastian Aue will take over the co-executive director role alongside Hsiao-Wei.
Tomasz Stańczak said on Friday he will step down as co-executive director of the Ethereum Foundation (EF) at the end of February.
Stańczak, who has served in the role for around a year, said in a post on X that Bastian Aue will take over as interim co-ED alongside current co-ED Hsiao-Wei. He added in a separate blog post that the foundation is in a strong place with “new voices”, making it a good time for a leadership change.
“I am happy with the current state of things; the roadmap is clearer; the goals are set; the leaders at the EF grew more confident about making decisions by themselves and owning more,” Stańczak said.
The EF is a non-profit organization dedicated to supporting the Ethereum ecosystem, which currently has a total value locked (TVL) of over $56 billion, making it the largest smart contract blockchain, according to DeFiLlama. Ethereum’s native token, Ether (ETH), is currently trading at $2,062, up 4.4% on the day.
Stańczak’s role as co-ED focused on improving efficiency and building ties with builders, institutions, and the broader community. He added that the foundation’s key goals – including faster decision-making, better communication, clearer policies, and greater transparency – have either been completed or are improving.
“It has been important for me, over the last year, to present the role of the EF co-ED as impactful and desirable, a position where one can make a meaningful difference by empowering people of extraordinary talent and dedication, both at the EF and more broadly in the Ethereum ecosystem,” Stańczak wrote.
Ethereum co-founder Vitalik Buterin responded to the news on X, praising Stańczak’s work and creativity. Buterin said Stańczak helped improve the foundation by bringing “fresh new energy,” and pushing the EF to think more about how AI could change blockchain.
“I look forward to seeing the exciting work that Tomasz will continue to do, both within Ethereum and outside,” Buterin added.
Looking ahead, Stańczak said the foundation is working on a long-term plan for Ethereum, scaling the network with Layer 2s (L2s), and researching post-quantum security. He also said there’s a strong focus on expanding work in decentralized AI.
Stańczak concluded that he plans to continue working directly with founders in both frontier tech and Ethereum. “I want to see and support the realization of the vision that I have talked about over the last years,” he said. “It is one of the most exciting times to be a builder on Ethereum.”
Meanwhile, Aue said in a post on X that the role is not something that he takes “lightly,” given the “weight of responsibility.” He added that the decisions he makes “will be guided by a principled insistence on the properties of what we’re building (censorship resistance, open source, privacy, security).”
Cryptocurrency wallet makers and security companies are pushing out post-quantum products even though large-scale quantum computers capable of breaking Bitcoin do not exist yet.
The US National Institute of Standards and Technology (NIST) finalized its first post-quantum cryptography standards in 2024 and called for migrations before 2030.
As standards bodies plan for a gradual cryptographic transition, parts of the wallet market are already monetizing that future.
“I do feel that it is a bit of a fear tax. We know that quantum computers are far away — still five to 15 years away,” Alexei Zamyatin, co-founder of Build on Bitcoin (BOB), told Cointelegraph.
Bitcoin is trading roughly 50% below its October 2025 all-time high. Among the handful of theories attempting to explain crypto’s recent decline is a growing concern that quantum computing risks may be deterring institutional capital from Bitcoin.
Bitcoin’s 2026 decline pulled the cryptocurrency below $70,000. Source: CoinGecko
The quantum risk is not zero, and it is not sudden
The quantum vulnerability often discussed is Bitcoin’s Elliptic Curve Digital Signature Algorithm, which authorizes transactions. In theory, a powerful quantum computer could derive a private key from an exposed public key and claim the coins sitting in an address.
Today’s quantum hardware isn’t capable of breaking the elliptic curve signatures. But that doesn’t mean threat actors are waiting around for a technical breakthrough.
“Many users expect a single ‘Q-Day’ in the future when cryptography suddenly fails. In reality, risk accumulates gradually as cryptographic assumptions weaken and exposure increases,” Kapil Dhiman, CEO and co-founder of Quranium, told Cointelegraph.
“Harvest now, decrypt-later strategies are already active, meaning data and signatures exposed today are being collected against future capability,” he said.
Related: What if quantum computers already broke Bitcoin?
In Bitcoin’s case, the concern is for older exposed public keys. Once a public key appears onchain, it remains permanently visible. Modern address formats obscure public keys until coins are spent.
CoinShares Bitcoin researcher Christopher Bendiksen said that just 10,230 Bitcoin (BTC) sit in addresses with publicly exposed public keys that would be vulnerable to a sufficiently powerful quantum attack.
The CoinShares researcher said 1.62 million BTC is in wallets holding under 100 BTC, which would take too long to unlock. Source: CoinShares
The quantum fear business
While the Bitcoin community debates how far away quantum computing is, crypto wallet makers are operating on their own clock.
Trezor’s Safe 7 is marketed as a “quantum-ready” hardware wallet. Separately, qLabs recently introduced the Quantum-Sig wallet, which it claims embeds post-quantum signatures directly into its signing process.
Crypto wallet makers are already rolling out quantum-ready hardware. Source: Trezor
BOB’s Zamyatin argued that wallet-level defenses would not solve Bitcoin’s quantum risk. Bitcoin transactions are authorized using a signature scheme embedded in the protocol itself. If that cryptography were ever broken, the fix would require a protocol-level change.
“I personally wouldn’t invest a lot of money into a quantum wallet right now because I don’t even know what protection it gives me for Bitcoin. It can’t really give me any protection, in my opinion, because Bitcoin doesn’t have a quantum-resistant signature scheme yet.”
Ada Jonušė, executive director at qLabs, agreed that full quantum resilience requires protocol-level defense. However, brushing off modern infrastructure as a fear tax overlooks the transitional nature of security upgrades.
“Quantum risk is not binary. Even before a protocol-level migration occurs, there is a real ‘harvest now, decrypt later’ threat,” she told Cointelegraph, claiming that qLabs’ approach reduces exposed key surface.
“Quantum readiness is about proactive infrastructure planning, not fear monetization,” Jonušė said.
Related: Bitcoin’s quantum countdown has already begun, Naoris CEO says
Trezor also admitted that blockchains themselves need to change their cryptography and protocol. But Tomáš Sušánka, the company’s chief technology officer, told Cointelegraph that wallets can implement protections right away instead of waiting for protracted blockchain upgrades.
“Once the blockchains upgrade, wallets must also support the same algorithms to remain compatible,” Sušánka said. He added that Trezor Safe 7 uses a post-quantum algorithm to protect against future quantum computers forging digital signatures and signing malicious firmware updates.
Market incentives and Bitcoin’s governance hurdle
Unlike iPhones, which are released almost every year, hardware wallets and other security products typically have multi-year product lifecycles. Introducing post-quantum features in a new product gives a reason for customers to buy a new device, even if the threat is distant.
“Yes, parts of the crypto industry do have incentives to amplify quantum risk, but that incentive is increasingly driven by regulatory and institutional alignment, not short-term sales alone,” said Dhiman, whose Quranium powers the Qsafe wallet.
“For most users, quantum-secure wallets today function as long-term insurance. The responsible approach is to acknowledge the transition ahead, avoid urgency driven by fear and choose systems designed to evolve without forcing abrupt replacements.”
Several blockchains are advancing with post-quantum strategies, but Bitcoin has been relatively hesitant. Some of the network’s most influential voices have brushed off the threat as a problem for the future.
Unlike Bitcoin, Ethereum has a widely recognized figurehead. Co-founder Vitalik Buterin has advocated for post-quantum preparations, and the network has been steering in that direction.
For Bitcoin, the issue is social consensus, coordination and the willingness to act, according to Zamyatin.
“It’s not like [Bitcoin has] one person that everyone will follow. It will require a broad social consensus, which is very hard to achieve,” he said.
Wallet makers agree that full quantum protection has to come from the protocol. But even if the risk is years away, they can act as insurance to help investors sleep better at night, though some argue they amount to a fear tax.
Magazine: Is China hoarding gold so yuan becomes global reserve instead of USD?
Cointelegraph Features and Cointelegraph Magazine publish long-form journalism, analysis and narrative reporting produced by Cointelegraph’s in-house editorial team and selected external contributors with subject-matter expertise. All articles are edited and reviewed by Cointelegraph editors in line with our editorial standards. Contributions from external writers are commissioned for their experience, research or perspective and do not reflect the views of Cointelegraph as a company unless explicitly stated. Content published in Features and Magazine does not constitute financial, legal or investment advice. Readers should conduct their own research and consult qualified professionals where appropriate. Cointelegraph maintains full editorial independence. The selection, commissioning and publication of Features and Magazine content are not influenced by advertisers, partners or commercial relationships.
Patrick Witt, Executive Director of the President’s Council of Advisors for Digital Assets, discussed the ongoing push for the crypto legislation and the federal government’s management of Bitcoin during a Yahoo Finance interview earlier today, stressing the need for regulatory clarity and institutional engagement.
Witt explained that the House passed its version of the Clarity Act last year, and the Senate is drafting its own amendments.
Sections of the bill addressing the Commodity Futures Trading Commission (CFTC) have cleared the Agriculture Committee, while portions covering the Securities and Exchange Commission (SEC) remain in the Senate Banking Committee. A markup scheduled for January was postponed, and Witt said discussions are underway to resolve outstanding issues.
“We are taking it so seriously,” he noted, emphasizing the need for compromise on concerns such as stablecoin yields and deposit flight.
“We’ve taken it so seriously,” he said, “It’s why we’ve hosted the different interested stakeholders here at the White House, and we’re going to continue to stay at the table and encourage them to find a compromise on this issue.”
Great joining @YahooFinance this morning to discuss the status of the CLARITY Act. There are trillions of dollars in institutional capital on the sidelines waiting to get into this space. Regulatory clarity is the unlock. 🔓 https://t.co/7sGga1rmmG
While the Clarity Act focuses on regulatory clarity, Witt highlighted the government’s Bitcoin holdings as a separate but critical priority.
Following an executive order, agencies halted uncontrolled liquidation of digital assets, preventing potential losses that “could have been tens of billions of dollars.”
He said efforts are underway to centralize oversight, ensure proper accounting of wallets holding Bitcoin and other digital assets, and explore ways to increase the government’s holdings in a budget-neutral manner.
Witt pointed to existing legislation from Senator Cynthia Lummis and a forthcoming House bill from Representative Begich, which would formalize authority over government digital assets.
“Ultimately, if Congress decides, we could add to that stockpile with outright purchases,” he said, noting that such acquisitions would require appropriations approval.
Witt spent some time in the interview stressing the broader implications for U.S. leadership in digital finance. Centralizing asset management safeguards public resources while positioning the United States to engage more strategically in Bitcoin markets.
“There are trillions of dollars in institutional capital on the sidelines waiting to get into this space,” Witt said via X regarding the interview.
Witt also noted that improved regulatory clarity under the Clarity Act allows both banks and crypto firms to operate with confidence, creating opportunities for innovation and institutional participation.
He emphasized that banks and crypto companies are moving toward collaboration. “There’s tremendous opportunity for the JPMorgans of the world to engage in crypto activities,” he said.
With committee reconciliation and Senate floor time still pending, Witt signaled a sense of urgency.
“We’ve got to get this done,” he said, framing crypto legislation and government Bitcoin oversight as complementary steps to secure U.S. influence in crypto.
Passing the CLARITY crypto structure bill could improve market sentiment amid the ongoing downturn, according to United States Treasury Secretary Scott Bessent.
The stalling of the CLARITY bill over concerns voiced by crypto industry executives has negatively impacted the industry, Bessent told CNBC on Friday. He said:
“In a time when we are having one of these historically volatile sell-offs, I think some clarity on the CLARITY bill would give great comfort to the market, and we could move forward from there.
I think if the Democrats were to take the House, which is far from my best case, then the prospects of getting a deal done will just fall apart,” Bessent continued.
Bessent discusses the importance of passing the CLARITY crypto market structure bill ahead of the 2026 US midterm elections. Source: CNBC
He said that getting the bill passed “as soon as possible” and sent to US President Donald Trump for signature by spring, which occurs between late March and late June in the US, is important, given the potential shift in the balance of power in the 2026 midterm elections.
Related: White House officials met with crypto, banking reps to discuss stablecoins
The 2026 midterm elections could throw a wrench in Trump’s crypto agenda
The balance of power typically shifts in US midterm election years, Joe Doll, the former general counsel at non-fungible token (NFT) marketplace Magic Eden, told Cointelegraph.
“President Trump has a two-year unimpeded mandate that can be weakened greatly in the 2026 mid-term elections and reversed in the 2028 elections,” economist Ray Dalio said in January.
This potential political shift could reverse the Trump administration’s pro-crypto policies, if they are not codified into law, Dalio warned.
The Republican Party holds a slim four-seat majority in the US House of Representatives, with 218 seats compared to 214 seats held by the Democratic Party, according to data from the US House.
Polymarket 2026 US midterm election odds. Source: Polymarket
47% of traders on the prediction market Polymarket project that power will be split in the 2026 midterms, with each political party taking control of one chamber of Congress.
The Polymarket odds of a full sweep by the Democratic Party, meaning they claim a majority in both chambers, is 37% at the time of this writing.
Magazine: Crypto wanted to overthrow banks, now it’s becoming them in stablecoin fight
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently. Read our Editorial Policy https://cointelegraph.com/editorial-policy
Fellow analyst Ted Pillows said the “chances of a deeper correction would increase” if the $65,000-$66,000 support does not hold.
“To the upside, if Bitcoin reclaims the $70,000 level, it could rally 8%-10% really quickly.”
BTC/USD two-day chart. Source: Ted Pillows
From a technical perspective, BTC’s price action has been forming a V-shaped recovery chart pattern on the four-hour chart, as shown below.
The BTC/USD pair is retesting a key area of resistance defined by the 20-period EMA at $67,500 and the 200-week exponential moving average (EMA) at $68,000.
Bulls need to push the price above this level to increase the chance of a rally to the pattern’s neckline at $72,000.
As Cointelegraph reported, if Bitcoin breaks $72,000, it will revive the hopes of a recovery toward the 20-day EMA at $76,000 and eventually, the 50-day simple moving average (SMA) above $85,000, bringing the total gains to 26%.
Liquidation risk builds near $80,000
Exchange order-book liquidity data from CoinGlass showed Bitcoin’s price pinned below two walls of asks centered just below $75,000 and around $80,000.
“$BTC liquidations are stacking well above $72K, and around the area from $77K to $80K,” Bitcoin analyst ZordXBT said in his latest post on X.
Below the spot price, bid orders were lying down to $64,500, “where I have my limit orders placed,” the analyst said, adding:
“If the market holds itself here, it can very easily eat those liquidity bubbles.”
Bitcoin liquidation heatmap. Source: CoinGlass
The chart above suggests that if the $72,000-$75,000 level is broken, it could spark a liquidation squeeze, forcing short sellers to close positions and driving prices toward $80,000, which is the next major liquidity cluster.
Zooming in, Ted Pillows highlighted significant bid clusters at $65,000 and ask orders around $68,000, saying that the price is likely to revisit these areas to wipe out the liquidity.
“I think a revisit of $65,000 and a pump to $68,000 will both happen soon.”
This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision. While we strive to provide accurate and timely information, Cointelegraph does not guarantee the accuracy, completeness, or reliability of any information in this article. This article may contain forward-looking statements that are subject to risks and uncertainties. Cointelegraph will not be liable for any loss or damage arising from your reliance on this information.
Google’s Threat Intelligence Group has released its latest report on AI dangers.
The report suggests state-sponsored hackers use tools like Google’s own Gemini to speed up their cyberattacks.
Hackers are taking an interest in agentic AI to put AI fully in control of attacks.
Google’s Threat Intelligence Group (GTIG) is sounding the alarm once again on the risks of AI, publishing its latest report on how artificial intelligence is being used by dangerous state-sponsored hackers.
This team has identified an increase in model extraction attempts, a method of intellectual property theft where someone queries an AI model repeatedly, trying to learn its internal logic and replicate it into a new model.
Our new Google Threat Intelligence Group (GTIG) report breaks down how threat actors are using AI for everything from advanced reconnaissance to phishing to automated malware development.
More on that and how we’re countering the threats ↓ https://t.co/NWUvNeBkn2
While this is worrying, it isn’t the main risk that Google is voicing concern over. The report goes on to warn of government–backed threat actors using large language models (LLMs) for technical research, targeting and the rapid generation of nuanced phishing lures.
The report highlights concerns over the Democratic People’s Republic of Korea, Iran, the People’s Republic of China and Russia.
Gemini and phishing attacks
These actors are reportedly using AI tools, such as Google’s own Gemini, for reconnaissance and target profiling, using open-source intelligence gathering on a large scale, as well as to create hyper-personalized phishing scams.
“This activity underscores a shift toward AI-augmented phishing enablement, where the speed and accuracy of LLMS can bypass the manual labor traditionally required for victim profiling”, the report from Google states.
“Targets have long relied on indicators such as poor grammar, awkward syntax, or lack of cultural context to help identify phishing attempts. Increasingly, theat actors now leverage LLMs to generate hyper-personalized lures that can mirror the professional tone of a target organization”.
For example, if Gemini were given the biography of a target, it could generate a good persona and help to best produce a scenario that would effectively grab their attention. By using AI, these threat actors can also more effectively translate in and out of local languages.
As AI’s ability to generate code has grown, this has opened up doors for its malicious use too, with these actors troubleshooting and generating malicious tooling using AI’s vibe coding functionality.
The report goes on to warn about a growing interest in experimenting with agentic AI. This is a form of artificial intelligence which can act with a degree of autonomy, supporting tasks like malware development and its automation.
Google notes its efforts to combat this problem through a variety of factors. Along with creating Threat Intelligence reports multiple times a year, the firm has a team constantly searching for threats. Google is also implementing measures to bolster Gemini into a model which can’t be used for malicious purposes.
Through Google DeepMind, the team attempts to identify these threats before they can be possible. Effectively, Google looks to identity malicious functions, and remove them before they can pose a risk.
While it is clear from the report that use of AI in the threat landscape has increased, Google notes that there are no breakthrough capabilities as of yet. Instead, there is simply an increase in the use of tools and risks.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
