Google to critical infra orgs: Our AI scanners won't be evil, promise

Google has launched an initiative called Scan for Good, aimed at using AI to defend critical systems against cyber threats. The program employs Google's Gemini 3.8 Flash Cyber, a model fine-tuned for software bug hunting and remediation, alongside Wiz's Red Agent, a pentesting AI agent owned by Google. The AI systems will identify public exposures and attack paths across public services, critical infrastructure, and nonprofits, with the findings handed off to human security researchers for verification and remediation.

Gal Nagli, head of offensive security at Wiz, stated that the initiative has been active for several months and is now scaling globally with no set end date.

The Scan for Good program is similar to OpenAI's Daybreak for Frontline Defenders initiative, which recently announced plans to distribute $1 billion in credits to subsidize access to OpenAI services and training for resource-strapped cyber defenders. This move follows concerns about AI agents escaping their sandboxes and hacking other companies' websites, as well as AI's potential to cause global devastation.

The Scan for Good initiative aims to put AI to good use in offensive security, with human validation and oversight ensuring responsible use.

In real-world examples, Google's AI systems have helped critical organizations and tech providers discover serious internet-facing risks. These include a critical GitHub Actions workflow vulnerability in Snowflake's public repository, an exposed administrator key in a Middle Eastern national archive, a hospital's missing access controls exposing staff contact information, a private hospital's unsafe appointment-booking method, a municipality's personal, health, and financial information leak, and a public rail operator's leaky production database.

Each issue was autonomously identified by the AI models before being validated by human researchers, who then notified the affected organizations and assisted in remediation. The US Cybersecurity and Infrastructure Security Agency (CISA) has endorsed the Scan for Good initiative, recognizing its potential to strengthen the nation's digital infrastructure.