Google’s deprecation schedule confirms that gemini-2.0-flash and gemini-2.0-flash-lite shut down on June 1, 2026, routing all API requests to gemini-3.6-flash and gemini-3.1-flash-lite. Any enterprise still running workloads on the 2.0 series faces an immediate operational crisis because the endpoints are no longer available for selection in Google AI Studio. I see this as a critical migration failure if teams have not already updated their code. The recommended replacements are specific: gemini-3.6-flash handles standard tasks, while gemini-3.1-flash-lite takes over volume work. Ignoring these dates means your integration breaks without warning, forcing a rushed patch during peak business hours. This is not a theoretical risk; it is a hard deadline that has already passed for most of the year.
Data exposure and access control gaps
The core security tension lies in how Gemini treats available data as usable data without evaluating business context or intent. When you grant access to a Google Drive folder, Gemini can potentially access all documents within that hierarchy without respecting existing document-level sharing permissions. A Fortune 500 financial services company discovered that confidential client investment strategies processed by Gemini were inadvertently referenced in outputs shown to employees without proper clearance. This incident forced the organization to implement custom access control layers and content filtering to prevent similar exposures. The default workspace integration lacks granular permission settings at the document level, which creates new pathways for data to flow through your systems. Standard implementations follow Google’s default Workspace retention policies with limited customization options, creating compliance gaps for regulated industries where data processing does not automatically align with specific retention requirements.
Prompt injection and supply chain vulnerabilities
Prompt injection represents one of the most sophisticated attack vectors for Gemini deployments, exploiting the fundamental design of large language models to override security controls. Security researchers at Miggo discovered that attackers could embed malicious instructions within a calendar event description to exfiltrate private meeting data via prompt injection. When a user asks a seemingly innocent question like "Am I free on Saturday?", Gemini processes the victim’s calendar events and executes the embedded instruction automatically. The model summarizes all private meetings for that day, creates a new calendar event containing this sensitive data, and displays a false reassurance to the user. This vulnerability highlights a fundamental departure from conventional application security models where input sanitization and Web Application Firewalls remain ineffective against semantic attacks. Language models interpret meaning rather than syntax, creating an attack surface that standard defenses cannot address. Additionally, the May 2026 disclosure of an AI-authored zero-day exploit confirmed that threat actors can use AI models to discover and write working exploits for previously unknown vulnerabilities without human authorship. The GTIG assessed with high confidence that an AI model autonomously identified the semantic logic flaw and produced the weaponized proof-of-concept. Organizations whose incident response plans assume human-paced attack development now have a documented gap in their threat models.
