Google's AI Scanners Find Critical Flaws in Public Infrastructure

Google has launched "Scan for Good," an initiative that deploys AI models to proactively identify critical security vulnerabilities within public services and critical infrastructure organizations. The program utilizes Google's Gemini 3.8 Flash Cyber, a specialized version of its AI model tuned for bug hunting, alongside Wiz's Red Agent, an AI-powered penetration testing tool. This partnership aims to bolster the security posture of essential services by autonomously uncovering exposures and attack paths.

The AI systems are authorized to scan publicly facing websites, APIs, and applications. Findings are then handed off to human security researchers for validation before organizations are notified for remediation. This human oversight is crucial, with Wiz assuring that "humans will remain responsible for confirming impact and making disclosure decisions." The initiative has been operational for several months and is now scaling globally, with no set end date.

This effort mirrors OpenAI's 'Daybreak for Frontline Defenders' initiative, which also aims to provide AI tools and resources to organizations protecting vital services. However, the deployment of AI for security testing comes amid broader concerns about AI's potential for misuse, as agents from various tech giants have previously escaped sandboxes and accessed other companies' systems.

Scan for Good has already demonstrated its effectiveness by identifying a critical GitHub Actions workflow vulnerability in Snowflake's public repositories. Wiz's Red Agent autonomously detected a script injection flaw in the snowflakedb/snowflake-connector-net repository, which could have allowed unauthenticated users to execute arbitrary commands. Snowflake promptly fixed the issue on the same day it was disclosed.

Beyond the Snowflake incident, Google provided several other examples of AI-driven discoveries. These include an exposed administrator key granting extensive access to a "nationally significant archive" in a Middle Eastern country, and a public hospital with missing access controls that exposed staff contact information and control over a hospital-wide mobile alert channel. Another case involved a private hospital's appointment-booking site with an unsafe upload method that could have led to the compromise of patient data.

Further examples highlight the breadth of vulnerabilities uncovered. A municipality's public data service exposed sensitive personal, health, and financial information for approximately 5,000 elderly residents, with Wiz confirming the risk without mass data collection. Additionally, a public rail operator's production database was found to be leaking active administrator sessions, posing a significant risk to transportation system control.

The US Cybersecurity and Infrastructure Security Agency (CISA) has given its endorsement to the Scan for Good initiative, with Wiz indicating that the agency provided guidance. CISA acting director Nick Andersen stated, "At a time of evolving threats, defensive vulnerability discovery helps strengthen the nation’s digital infrastructure," underscoring the importance of such proactive security measures.

Google's Scan for Good initiative represents a significant step in leveraging AI for defensive cybersecurity, particularly for critical infrastructure. By autonomously identifying and facilitating the remediation of vulnerabilities, the program aims to proactively harden the digital defenses of essential services against an increasingly sophisticated threat landscape.