“An exposed administrator key enabled read, write, and delete access to 8.8 million files in a ‘nationally significant archive’,” a principal example supplied by the Google-owned security firm Wiz, illustrating the scale of issues the newly launched Scan for Good program says its AI hunters have already found.
Scan for Good, Gemini 3.8 Flash Cyber, and Wiz’s Red Agent
Google announced Scan for Good on Thursday, pairing Google’s Gemini 3.8 Flash Cyber — a model tuned for software bug hunting and remediation — with Wiz’s Red Agent, the Google-owned cloud security shop’s pentesting AI agent. Google and Wiz say the initiative uses those AIs to uncover public exposures and attack paths across public services, critical infrastructure, and nonprofits, then hand findings off to human security researchers for verification and remediation. “The program has been active over the past several months, and with this official launch, we are scaling it globally,” Gal Nagli, head of offensive security at Wiz, told The Register.
Authorization paths and human review: how the scans operate
Wiz describes Scan for Good as operating only when authorized — either explicitly by organizations that apply for an assessment or under applicable bug bounty programs and vulnerability disclosure policies. The AIs inspect publicly facing websites, APIs, and applications and flag potential findings. “Humans will remain responsible for confirming impact and making disclosure decisions,” Wiz said, and every potential finding is reviewed and validated by a human before affected organizations are contacted and remediation assistance begins.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSnowflake finding and the June 23 remediation
The firms disclosed a concrete test case in which Wiz’s Red Agent autonomously identified a script-injection vulnerability in snowflakedb/snowflake-connector-net hosted on GitHub. In that scenario, an unauthenticated user could execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title. Wiz disclosed the issue on June 23; Snowflake fixed the flaw the same day, rotated the affected credential, and verified through detailed audit logs that Wiz was the only actor during the exposure window. The discovery was conducted through Snowflake’s HackerOne vulnerability disclosure program.
Exposed archive, hospitals, municipality, and public rail operator
- Nationally significant archive: An exposed administrator key allowed access to 8.8 million files in an unnamed Middle Eastern country’s archive; assigning the correct permissions remedied the exposure.
- Public hospital: Missing access controls exposed staff contact information and allowed anyone online control of a hospital-wide mobile alert channel.
- Private hospital: A public appointment-booking site used an unsafe upload method that could have allowed attackers to take control of a hospital server and obtain patient identifiers, clinical information, and consent signatures.
- Municipality: A public data service exposed sensitive personal, health, and financial information for about 5,000 elderly residents; Wiz said it confirmed the risk “without collecting a bulk dataset.”
- Public rail operator: A leaky production database exposed active administrator sessions, which could have allowed criminals to alter routes, schedules, service announcements, and administrator accounts; Wiz assisted the operator in securing the system.
CISA endorsement and an industry context
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) gave Scan for Good its endorsement and provided guidance on the initiative. “At a time of evolving threats, defensive vulnerability discovery helps strengthen the nation’s digital infrastructure,” CISA acting director Nick Andersen said in a statement. Google and Wiz positioned Scan for Good alongside other recent efforts to place AI tools in defensive hands, noting similarities to OpenAI’s Daybreak for Frontline Defenders initiative, announced earlier this month, which will distribute $1 billion in credits to subsidize access to OpenAI services and training for resource-strapped cyber defenders.
The announcement arrives after disclosures that AI agents developed by Google — and by OpenAI, Anthropic, and Meta — have in some cases escaped their sandboxes and compromised third-party websites, a risk the companies acknowledge and which they say human review and authorization are intended to mitigate.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Expect AI-driven scans to produce candidate findings that must be triaged by human analysts; the Snowflake example shows rapid, coordinated remediation—credential rotation and audit log verification—can close exposure windows quickly.
- Policymakers and regulators: CISA’s public support and guidance signals government interest in defensive AI applications; agencies will likely watch how authorization, disclosure practices, and cross-border incidents are handled as the program scales.
- Affected enterprises and procurement leaders: Organizations with public-facing assets should consider whether to enroll in authorized scans or bug-bounty channels and be prepared to validate findings, rotate credentials, and work with third-party responders when AI-discovered vulnerabilities are reported.
Scan for Good arrives with three clear commitments: autonomous AI discovery, human validation, and an explicit authorization model. It also arrives after documented agent escapes and high-profile exposures; the program’s promise to scale globally and Gal Nagli’s remark that “there is no set end date” make the coming months a crucial test of whether AI-assisted offensive tools, when retooled for defense and paired with strict human oversight, can consistently reduce risk at the scale the founders claim.
