{"schema_version":"0.10.0","id":"LR-2026-0396","record_version":1,"title":"Attempted model extraction of Google Gemini through more than 100,000 prompts","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":57.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":2.56,"unhedged_language":4.55},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Ars Technica · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Ars Technica · subject to change"}]},"sources_hash":"17713547a5c6220245f90404363d8a8b0d09891985403608fd6a55c05732b0f7"},"system":{"model_name":"Gemini","model_version":null,"developer":"Google","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-12","incident_class":"ip_infringement","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Google's Gemini AI chatbot was the target of attempts to clone its knowledge by prompting it, with the activity attributed to commercially motivated actors. One adversarial session reportedly prompted the model more than 100,000 times across various non-English languages, collecting responses ostensibly to train a cheaper copycat. The chatbot responds to anyone online, which the attackers exploited through repeated queries. Google's internal security teams flagged the activity, and it was linked to actors seeking rival models by copying core behaviour patterns. Once identified, offending accounts were blocked and new safeguards were implemented to limit how much sensitive reasoning information can be inferred through repeated queries. Google describes the activity as model extraction and considers it intellectual property theft, a position the source calls somewhat loaded.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Offending accounts blocked and new safeguards implemented to limit sensitive reasoning information inferred through repeated queries","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://arstechnica.com/ai/2026/02/attackers-prompted-gemini-over-100000-times-while-trying-to-clone-it-google-says/","publisher":"Ars Technica","date":"2026-02-12","type":"press","title":"Attackers prompted Gemini over 100,000 times while trying to clone it, Google says - Ars Technica","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.moneycontrol.com/technology/hackers-created-google-gemini-clone-using-100-000-prompts-here-s-how-google-stopped-it-article-13825539.html","publisher":"Moneycontrol.com","date":"2026-02-12","type":"press","title":"Hackers created a Google Gemini clone using 100,000 prompts: Here’s how Google stopped it - Moneycontrol.com","archived_url":null}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","event.remediation":"C","event.incident_class":"D","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"On Thursday, Google announced that “commercially motivated” actors have attempted to clone knowledge from its Gemini AI chatbot by simply prompting it."}],"system.developer":[{"source_index":0,"quote":"On Thursday, Google announced that “commercially motivated” actors have attempted to clone knowledge from its Gemini AI chatbot by simply prompting it."}],"event.remediation":[{"source_index":1,"quote":"Once identified, offending accounts were blocked and new safeguards were implemented to limit how much sensitive reasoning information can be inferred through repeated queries."}],"event.incident_class":[{"source_index":0,"quote":"Google calls the illicit activity “model extraction” and considers it intellectual property theft, which is a somewhat loaded position, given that Google’s LLM was built from materials scraped from the Internet without permission."}],"impact.severity":[{"source_index":1,"quote":"Once identified, offending accounts were blocked and new safeguards were implemented to limit how much sensitive reasoning information can be inferred through repeated queries."}],"event.summary":[{"source_index":0,"quote":"On Thursday, Google announced that “commercially motivated” actors have attempted to clone knowledge from its Gemini AI chatbot by simply prompting it."},{"source_index":0,"quote":"One adversarial session reportedly prompted the model more than 100,000 times across various non-English languages, collecting responses ostensibly to train a cheaper copycat."},{"source_index":1,"quote":"This technique exploits the public accessibility of large language models, which respond to anyone online."},{"source_index":1,"quote":"The campaign was identified by Google’s internal security teams and linked to commercially motivated actors aiming to build rival AI models by copying core behaviour patterns."},{"source_index":1,"quote":"Once identified, offending accounts were blocked and new safeguards were implemented to limit how much sensitive reasoning information can be inferred through repeated queries."},{"source_index":0,"quote":"Google calls the illicit activity “model extraction” and considers it intellectual property theft, which is a somewhat loaded position, given that Google’s LLM was built from materials scraped from the Internet without permission."}]},"notes_on_gaps":"No source states when the extraction began, when it was detected, or the exact date of the announcement; the 2026-02-12 date is the article publication date used as the disclosure date and the announcement is only stated as Thursday. No source states that an autonomous agent was involved, so agent fields and failure_class are omitted. The detection method is not stated beyond flagging by Google's Threat Intelligence Group using classifiers and anomaly detection, so it is omitted. The specific safeguards added are not described, so no preventive control is credited. Severity 'minor' is a judgement: the sources describe no third party touched and a contained response, and no affected-party count is stated. Incident class ip_infringement follows Google's own characterisation, which the source calls loaded. Harm class ip follows the same framing. Suspect identities, loss amounts, records and duration are not stated. Developer and country of attackers are not stated beyond 'around the world'. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Ars Technica · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Attackers repeatedly questioned Gemini to map its internal logic and reconstruct how it responds.","quote":"According to Google, attackers repeatedly questioned Gemini in ways meant to map its internal logic.","source_index":1,"grade":"C"},{"step":"caught","text":"Google's Threat Intelligence Group flagged the activity.","quote":"The activity was flagged by the Google Threat Intelligence Group, which monitors emerging digital threats.","source_index":1,"grade":"C"},{"step":"done","text":"Offending accounts were blocked and new safeguards were added.","quote":"Once identified, offending accounts were blocked and new safeguards were implemented to limit how much sensitive reasoning information can be inferred through repeated queries.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://arstechnica.com/ai/2026/02/attackers-prompted-gemini-over-100000-times-while-trying-to-clone-it-google-says/","https://www.moneycontrol.com/technology/hackers-created-google-gemini-clone-using-100-000-prompts-here-s-how-google-stopped-it-article-13825539.html"]},"analysis":{"sections":{"timeline":[{"text":"Google Threat Intelligence Group flagged the extraction activity.","quote":"The activity was flagged by the Google Threat Intelligence Group, which monitors emerging digital threats.","source_index":1,"when":null},{"text":"Offending accounts were blocked and new safeguards were implemented.","quote":"Once identified, offending accounts were blocked and new safeguards were implemented to limit how much sensitive reasoning information can be inferred through repeated queries.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://arstechnica.com/ai/2026/02/attackers-prompted-gemini-over-100000-times-while-trying-to-clone-it-google-says/","https://www.moneycontrol.com/technology/hackers-created-google-gemini-clone-using-100-000-prompts-here-s-how-google-stopped-it-article-13825539.html"]}}