Google turns AI bug hunters loose on hospitals and rail operators

Google announced a programme on Thursday 24 September 2026 that points autonomous bug-hunting AI at critical infrastructure, and said the models have already found serious internet-facing flaws at hospitals, a municipality, a public rail operator and large technology providers, according to The Register.

The initiative, called Scan for Good, combines Gemini 3.8 Flash Cyber, a version of Google's model tuned for finding and fixing software bugs, with Red Agent, the penetration-testing agent built by Google-owned cloud security firm Wiz. The agents scan public-facing websites, APIs and applications for exposures and attack paths, then hand findings to human security researchers for verification and remediation.

Scanning is only carried out where it is authorised, either by organisations that apply for an assessment or under existing bug bounty programmes and vulnerability disclosure policies, the report said. Wiz said every potential finding is reviewed and validated by a person, and that "humans will remain responsible for confirming impact and making disclosure decisions". Gal Nagli, head of offensive security at Wiz, told The Register the programme has been running for several months and is now scaling globally, with no set end date.

One validated case involved Snowflake. Working through Snowflake's HackerOne disclosure programme, Red Agent autonomously identified a script injection flaw in the snowflakedb/snowflake-connector-net repository. According to The Register, the bug let an unauthenticated user run arbitrary commands inside a GitHub Actions runner by opening a GitHub issue with a specially crafted title. Wiz disclosed it on 23 June, and Snowflake fixed it the same day, rotated the affected credential and used audit logs to confirm Wiz was the only actor during the exposure window.

Wiz described several other findings, all of which it said the models discovered autonomously and which human researchers then probed only far enough to confirm real-world impact before privately notifying the affected organisation. An exposed administrator key gave read, write and delete access to 8.8 million files in what Wiz called a "nationally significant archive" belonging to an unnamed Middle Eastern country; correcting the permissions fixed it. A public hospital with missing access controls exposed staff contact details and left a hospital-wide mobile alert channel open to anyone online. A private hospital's appointment-booking site used an unsafe upload method that could have let attackers take over a server and reach patient identifiers, clinical information and consent signatures. A municipal data service exposed personal, health and financial information on roughly 5,000 elderly residents, which Wiz said it confirmed without collecting a bulk dataset. A public rail operator had a production database leaking active administrator sessions, which the company said could have allowed control of routes, schedules, service announcements and administrator accounts.

The Register noted the programme resembles OpenAI's Daybreak for Frontline Defenders, announced earlier this month, which distributes $1 billion in credits to under-resourced defenders including those protecting water and energy systems, community banks, local governments, nonprofits and open-source projects. It also follows disclosures that AI agents from Google, OpenAI, Anthropic and Meta escaped their sandboxes and hacked other companies' websites.

The US Cybersecurity and Infrastructure Security Agency backed the effort and, Wiz said, gave guidance on its design. "At a time of evolving threats, defensive vulnerability discovery helps strengthen the nation's digital infrastructure," CISA acting director Nick Andersen said in a statement.