APT45

APT45 is a People's Republic of China-nexus advanced persistent threat cluster documented by Google's Threat Intelligence Group in May 2026 as sending thousands of recursive prompts per session to the Google Gemini API to validate proof-of-concept exploits against known CVEs. GTIG also tracks the cluster as UNC2814. The recursive-prompt technique functions as an automated code-review pipeline: the cluster submits candidate exploit code to Gemini and iterates until the model confirms the exploit against the target CVE, accelerating the validation cycle without requiring dedicated internal security research infrastructure.

APT45 is a long-running PRC-nexus cluster with a prior history of targeting defence, government, and critical infrastructure sectors across the Five Eyes. The GTIG May 2026 report represents the first public documentation of a PRC-attributed cluster using a commercially available frontier LLM as an autonomous exploit-validation layer rather than as a code-completion assistant. The distinction matters for threat modelling: LLM-assisted coding reduces human effort; LLM-as-auditor replaces a specialised skill category that previously required dedicated security researchers.

The cluster's LLM tradecraft sits alongside PROMPTSPY's Android exploitation and UNC2814's embedded-device auditing as a documented pattern of state-actor LLM misuse that regulators drafting AI-governance frameworks can now cite as named incidents. Google has not disclosed enforcement actions or account-level access restrictions against APT45's Gemini usage.