Google Launches AI Security Scanner for Critical Infrastructure
Gemini-powered 'Scan for Good' initiative autonomously detects vulnerabilities in hospitals, transit systems, and public services.
1AI-powered vulnerability hunting
Google's Scan for Good initiative deploys Gemini 3.8 Flash Cyber and Wiz's Red Agent to autonomously detect security flaws in critical infrastructure. The system has already identified risks at hospitals, municipal systems, and tech providers. Unlike traditional scanning, these AI agents map attack paths across interconnected systems. Findings are verified by human researchers before disclosure, maintaining accountability in the remediation process.
2Real-world impact demonstrated
The program uncovered an exposed administrator key granting access to 8.8 million files in a Middle Eastern national archive. Another discovery revealed a public hospital's unsecured mobile alert channel controllable by anyone online. These weren't theoretical vulnerabilities - Wiz confirmed actual exposure windows before notifying affected organizations. The AI models stop analysis upon confirming real-world impact to avoid overreach.
3Snowflake vulnerability case study
During a bug hunt through Snowflake's HackerOne program, Wiz's Red Agent found a script injection flaw in snowflakedb/snowflake-connector-net. The vulnerability allowed GitHub issue titles to execute arbitrary commands. Reported and fixed on June 23, this demonstrated the AI's ability to find complex, chained vulnerabilities in public repositories. Snowflake rotated credentials and verified no other actors accessed systems during exposure.
4Transportation system risks
The AI detected a public rail operator's production database leaking active admin sessions. This could have let attackers control routes, schedules, and service announcements - effectively disrupting entire transit networks. Unlike traditional pentesting, the AI models analyze system interactions at scale. Wiz assisted the operator in securing the system before exploitation occurred.
5Healthcare sector exposures
Multiple hospital vulnerabilities were discovered, including an appointment booking system allowing server takeover and access to patient records. Another case exposed staff contacts and hospital-wide alert controls. The AI systems prioritize findings by potential impact rather than scanning indiscriminately. Healthcare institutions received private notifications with remediation guidance, avoiding public disclosure until fixes were implemented.
6Regulatory and industry alignment
CISA endorsed the initiative, providing guidance on defensive vulnerability discovery. The partnership between Google DeepMind and Wiz mirrors OpenAI's Daybreak program supporting frontline defenders. Both initiatives address growing concerns about AI safety by demonstrating controlled, beneficial applications. The timing follows recent disclosures about AI agents escaping sandboxes, highlighting the need for responsible deployment frameworks.
7Operational safeguards
Scan for Good operates under strict boundaries: organizations must opt-in via assessments or existing bug bounty programs. Every AI finding undergoes human validation before disclosure. Wiz emphasizes humans retain final decision-making on impact assessment and remediation. The program avoids bulk data collection, instead confirming risks through targeted verification methods that preserve privacy.
8Shifting security paradigms
The initiative represents a strategic shift from reactive to proactive defense at scale. By combining AI's pattern recognition with human expertise, it addresses the growing asymmetry between attackers and defenders. As critical infrastructure faces increasingly sophisticated threats, such partnerships between tech firms and security specialists may become essential for maintaining operational resilience across essential services.