Case gtig-unc2814-tplink-rceState actor AI opsWorldwide
PRC-nexus UNC2814 posed as C/C++ security auditor to get Gemini hunting TP-Link bugs
UNC2814 used expert-persona prompts and false narratives to have Gemini research pre-authentication remote code execution in embedded devices, TP-Link firmware and Odette File Transfer Protocol code.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- May 11, 2026
- Location
- Worldwide
- Target
- Embedded devices, TP-Link firmware and OFTP implementations
- Severity
- Medium
- Triggered by
- UNC2814 (China)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
UNC2814 used expert-persona prompts and false narratives to have Gemini research pre-authentication remote code execution in embedded devices, TP-Link firmware and Odette File Transfer Protocol code.
Impact: Vulnerability research against widely deployed network devices; exploitation not confirmed.
Who triggered it
Actor: UNC2814 (China)
Attribution: GTIG assesses a PRC nexus for UNC2814.
Motive: Exploit development for espionage
How it happened
Attack vector: Persona-based jailbreaking for vulnerability research
Root cause: Role-play prompts bypass intent checks on vulnerability analysis
Timeline
- Expert-persona prompts target TP-Link firmware and OFTP implementations
- GTIG publishes the case and disables the accounts
Response
Accounts disabled; classifiers hardened against persona prompting.
Current status: Contained
Sources (open in a new tab)
- GTIG AI Threat Tracker May 2026 cloud.google.com
- Secure Blink coverage secureblink.com
Cite this case
PRC-nexus UNC2814 posed as C/C++ security auditor to get Gemini hunting TP-Link bugs. AI Threat Watch, case gtig-unc2814-tplink-rce, May 11, 2026. https://aithreat.io/cases/gtig-unc2814-tplink-rce/
Permanent link: https://aithreat.io/cases/gtig-unc2814-tplink-rce/