Case gtig-china-ctf-pretextState actor AI opsWorldwide
China-nexus actor bypassed Gemini refusal with CTF pretext to get exploitation guidance
A suspected China-nexus group asked Gemini to find flaws on a compromised system, was refused, then reframed the request as a capture-the-flag exercise and got exploitable guidance reused for phishing and web shells.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Nov 5, 2025
- Location
- Worldwide
- Target
- Compromised systems in the actor's intrusion campaign
- Severity
- Medium
- Triggered by
- Unnamed China-nexus group
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
A suspected China-nexus group asked Gemini to find flaws on a compromised system, was refused, then reframed the request as a capture-the-flag exercise and got exploitable guidance reused for phishing and web shells.
Impact: Guardrail bypass yielded operational guidance; downstream victims not detailed.
Who triggered it
Actor: Unnamed China-nexus group
Attribution: GTIG assessed a PRC nexus; group not named.
Motive: Espionage
How it happened
Attack vector: Jailbreak-by-pretext against model safety guardrails
Root cause: Guardrails treated CTF framing as benign
Timeline
- Actor reuses CTF-framed guidance for phishing, exploitation and web-shell development
- GTIG publishes the case after disabling the actor's assets
Response
Assets disabled; classifiers and model hardened against the pretext.
Current status: Contained
Sources (open in a new tab)
- GTIG AI Threat Tracker November 2025 cloud.google.com
- Hendry Adrian mirror hendryadrian.com
Cite this case
China-nexus actor bypassed Gemini refusal with CTF pretext to get exploitation guidance. AI Threat Watch, case gtig-china-ctf-pretext, Nov 5, 2025. https://aithreat.io/cases/gtig-china-ctf-pretext/
Permanent link: https://aithreat.io/cases/gtig-china-ctf-pretext/