News · 2026-09-08

Attackers sent more than 100 million prompts to copy Google's models

Google reported on September 8, 2026 that it observed coordinated campaigns exceeding 100 million prompts directed at systematically extracting the capabilities of its AI models. The campaigns concentrated on exactly the areas where Google's models lead — visual and audio understanding, image generation and video generation — in what amounts to industrial-scale copying carried out entirely through the front door.

Key facts

• Google observed coordinated distillation campaigns exceeding 100 million prompts against its models.
• The campaigns targeted specific leading capabilities: visual and audio understanding, image generation and video generation.
• Google separately observed attackers exfiltrating AI API credentials and co-opting victim cloud environments to sustain unauthorized AI workloads, across healthcare, government and media.
• Primary source: From Prompting to Autonomy, Google Cloud threat intelligence, September 8, 2026.

To understand why 100 million prompts is an attack rather than enthusiastic usage, you need distillation. Training a frontier model from scratch requires enormous compute, a very large curated dataset and a research team. But once such a model exists, a much cheaper route to a similar model opens up: ask the good model a very large number of questions, keep its answers, and train a smaller model to imitate them. The expensive part — the judgement about what a good answer looks like — has already been paid for by someone else. The student learns the teacher's behaviour without ever seeing the teacher's weights.

This is a normal, legitimate technique when a lab distills its own model. It becomes model extraction when the teacher belongs to someone else and does not consent. And the only thing that separates the two, operationally, is intent and volume. There is no exploit here, no vulnerability, no CVE. Every one of those 100 million prompts was a well-formed API request that the service was built to answer. The attack surface is the product.

The analogy is a restaurant with a very good chef. Nobody can steal the recipes from the kitchen safe, so instead a competitor sends a hundred thousand customers, one at a time, to order every dish on the menu and take it back to a lab. No door was forced. At sufficient scale, the menu is the recipe.

The choice of targets is the part worth dwelling on. Google says the campaigns went after visual and audio understanding, image generation and video generation — not general chat. Those are the capabilities that are hardest to replicate from public data, that require the most expensive training runs, and where Google's lead is most defensible. Whoever ran these campaigns was not fishing. They were shopping from a list.

Alongside the distillation, Google describes a second and more conventional pattern with an AI twist: attackers targeting proprietary AI models across healthcare, government and media, exfiltrating API credentials, and then co-opting the victims' own cloud environments to keep unauthorized AI workloads running. That is resource theft with an unusually clean profit motive. Inference is expensive, GPU capacity is scarce, and a stolen enterprise cloud account is a way to run your own models on someone else's budget while blending into their normal spend. Google places it alongside espionage and extortion as a growing attacker focus on enterprise AI assets.

Why it matters: this reframes what an AI platform has to defend. Most security thinking about models has concentrated on getting the model to misbehave — jailbreaks, prompt injection, data exfiltration through tool calls. Extraction is the opposite problem. The model behaves perfectly, answers correctly every time, and that flawless behaviour is precisely what is being harvested. Defending against it means rate limits, anomaly detection on query patterns, and terms of service enforcement rather than better refusals — and every one of those defences costs legitimate users something. It also puts a number on an argument that has so far been made mostly in policy documents and courtrooms, including the lobbying filings in which Anthropic named distillation as a concern and OpenAI's did not.

The honest caveat: Google does not say who ran the distillation campaigns, does not say whether they succeeded in producing a usable competing model, and does not explain how it distinguished coordinated extraction from ordinary heavy commercial use — a line that is genuinely hard to draw and that Google, as the party whose commercial interest lies in drawing it narrowly, is the sole judge of here. A hundred million prompts is a striking number precisely because it has no public denominator: we are not told what fraction of traffic that represents. Treat it as a credible account of a real pattern, not as a measurement anyone outside Google can currently check.

Primary source, verified: read the paper →

Ground Truth. (2026, September 8). Attackers sent more than 100 million prompts to copy Google's models. Ground Truth. https://groundtruth.day/news/attackers-sent-more-than-100-million-prompts-to-copy-googles-models.html

@misc{groundtruth:attackers-sent-more-than-100-million-prompts-to-copy-googles-models,
  title  = {Attackers sent more than 100 million prompts to copy Google's models},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/attackers-sent-more-than-100-million-prompts-to-copy-googles-models.html}
}

Topics: cybersecurity · model-extraction · ai-security · supply-chain · distillation · ai-agents