Google unleashes Gemini AI agents on the dark web

Summary

Google's Gemini AI agents are crawling the dark web, sifting through upward of 10 million posts a day to find a handful of threats relevant to a particular organization. Available now in public preview, the dark web intelligence service built into Google Threat Intelligence uses Gemini's models to build a profile of a user's organization. It then scours the dark web to determine the security risks it faces. Google threat hunters told The Register that their internal tests show it can analyze millions of daily external events with 98 percent accuracy. "We are now processing every post from the dark web using Gemini, and from there distilling down what threats actually matter," Google Threat Intelligence product manager Brandon Wood told us, adding that this includes initial access broker activity, data leaks, insider threats, and other intel. "We're seeing anywhere from eight to 10 million events a day, and we're able to distill that down in very short throughput," he said. For comparison, traditional dark-web monitoring tools mostly scrape for key terms and use regex to match those terms, generating between 80 percent and 90 percent false positives, according to Wood. "It mostly just creates noise for the threat intel team," he said. Here's how the new service works. A customer – let's say Acme Bank – opens the dark web monitoring module for the first time. They confirm they are Acme Bank, and Gemini builds a customer profile. "Within a couple of minutes, we return a profile with a deep understanding of the customer, their environment, their business operations, VIPs, brands, technology," Wood said. "They are things that are open source, publicly available, and we provide citations of all of that content as well, trying to shrink the black boxes of AI and LLMs." Google's tool next automatically generates alerts, going back seven days to classify potential threats. The AI agents tag dark web data and then perform a vector comparison to detect stolen data or malicious...