Google's own threat intelligence team confirmed that state-linked hackers used Gemini to research vulnerabilities and speed up attacks against real organisations, some of them based in the United Kingdom. For British founders and CTOs, this is not a distant story about a foreign AI lab. It is a direct signal that the AI tools your team already uses daily are also being weaponised against you.
What is the Concept
AI-assisted hacking means attackers using large language models like Gemini, ChatGPT, or Claude as force multipliers rather than replacements for skill. Instead of manually writing phishing emails or debugging exploit code line by line, an attacker asks the model to do it faster and with fewer telltale mistakes. Google's Threat Intelligence Group documented threat actors using Gemini for translating phishing lures into fluent English, refining malware code, and researching known vulnerabilities in target systems, including firms in the UK.
This is not a Gemini-specific flaw. Every major model faces the same pressure, because the same reasoning ability that helps a developer in Manchester or Leeds ship faster also helps an attacker attack faster. AI has quietly become dual-use infrastructure, and most British SMEs have not updated their security posture to reflect that.
Why It Matters in the UK (2025-2026 Context)
Through 2025, UK security vendors reported a sharp rise in AI-generated phishing campaigns, with some studies showing AI-written lures achieving higher click-through rates than human-written ones because the grammar, tone, and personalisation are simply better. Heading into 2026, UK boards are asking a new question in risk committees: not 'are we using AI safely' but 'are we prepared for attackers who are using AI against us.'
For British SMEs and mid-market companies, this shift matters more than it does for large enterprises, because smaller teams typically lack a dedicated security operations centre. A ten-person finance team in Birmingham that used to spot clumsy phishing emails by their broken English now faces messages that read like they came from a native-speaking vendor. The ICO has also signalled closer scrutiny of how organisations secure AI tools handling personal data under UK GDPR.
How AI Is Changing This
Here is the contrarian point: the same AI capability that creates the threat is also the fastest available defence. Organisations that ban AI tools outright, hoping to reduce risk, usually end up less safe, because employees route around the ban using personal accounts with zero logging or oversight. The better model, which we call the Visible Perimeter Framework, treats AI usage like network traffic: not something to block, but something to monitor, log, and govern with the same discipline applied to email and VPN access.
Under this framework, every AI tool used for business purposes sits behind single sign-on, every prompt involving company data is logged, and every employee completes a short AI-risk briefing the same way they complete phishing training. This turns AI from an unmanaged shadow-IT risk into a monitored, auditable system, which is exactly what UK regulators and cyber-insurers are starting to expect.
Real-World Examples (Prefer United Kingdom)
Google publicly named over a dozen state-sponsored groups, including actors linked to Iran, China, North Korea, and Russia, who attempted to use Gemini for vulnerability research, script development, and reconnaissance against organisations before Google shut the accounts down. Separately, UK-based cybersecurity firms have documented AI-generated business email compromise attempts against mid-sized manufacturing and logistics firms in the Midlands and the North West, where the fraudulent 'CEO' email was drafted by a language model fine-tuned on the real executive's public writing style.
These are not hypothetical scenarios. They are documented incidents showing the same pattern: AI does not invent new categories of attack, it removes the friction that used to slow attackers down and give UK defenders time to react.
Practical Insights / Actions
Founders and CTOs should treat this as an operations problem, not just an IT problem. Start by inventorying which AI tools employees already use, sanctioned or not, because you cannot govern what you cannot see. Then require that any AI tool touching customer data, financial data, or source code goes through single sign-on so usage is logged and revocable.
The hidden opportunity here is that UK companies who formalise AI governance early are increasingly winning enterprise deals, because procurement teams at larger customers now ask vendors directly how they control AI tool usage internally.
Future Outlook
Expect AI-usage governance to become a standard line item in UK cyber-insurance underwriting by 2026, the same way multi-factor authentication became a prerequisite for cover a few years ago. Model providers like Google will keep tightening abuse detection, but attackers will keep finding new jailbreak techniques, so the arms race will not resolve itself from the vendor side alone.
The organisations that come out ahead will be the ones that stopped asking 'should we allow AI' in 2024 and started asking 'how do we monitor AI' in 2026.
Conclusion
Google Gemini being used by hackers to target UK businesses is not a reason to fear AI, it is a reason to govern it properly. The founder mistake is treating AI adoption and AI security as separate projects on separate timelines. They are the same project. British businesses that build visibility into their AI usage now, rather than after an incident, will be the ones still standing when the next wave of AI-assisted attacks arrives. RP SoftTech works with UK SMEs to audit AI tool usage and build practical, enforceable AI security policies that don't slow teams down.