Google Caught a Cybercrime Group Using AI to Build a Zero-Day Exploit

Since its February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. On May 11, that tracking produced something the security community had long anticipated but never confirmed: a real-world case of AI being used to build a working zero-day exploit.

Google disclosed that it identified an unknown threat actor using a zero-day exploit that was likely developed with an AI system, marking the first time the technology has been put to use in the wild in a malicious context for vulnerability discovery and exploit generation. The attack was stopped before it caused damage, but the technical evidence it left behind is what makes this case significant.

John Hultquist, the chief analyst at GTIG, characterized it as "a taste of what's to come" and "the tip of the iceberg," adding that this case was just the first "tangible evidence" of these sorts of attacks.

What the Exploit Actually Did

GTIG observed prominent cybercrime threat actors partnering to plan a mass vulnerability exploitation operation. Their analysis of exploits associated with this campaign identified a zero-day vulnerability implemented in a Python script that enables the user to bypass two-factor authentication (2FA) on a popular open-source, web-based system administration tool.

The vulnerability, described as a 2FA bypass, requires valid user credentials for exploitation. It stems from a high-level semantic logic flaw arising from a hard-coded trust assumption, something LLMs excel at spotting. That last point is worth sitting with. Traditional static analysis tools and fuzzers are built to catch memory corruption bugs and crash-inducing inputs. They are not designed to reason about authentication logic at the semantic level.

As the report put it: "While fuzzers and static analysis tools are optimized to detect sinks and crashes, frontier LLMs excel at identifying these types of high-level flaws and hardcoded static anomalies."

GTIG worked with the impacted vendor to responsibly disclose this vulnerability and disrupt the threat activity. The flaw has since been patched.

How Researchers Knew AI Was Involved

GTIG didn't just assume AI was used. They found specific forensic markers in the exploit code itself.

Although they do not believe Gemini was used, based on the structure and content of the exploits, they have high confidence that the actor leveraged an AI model to support the discovery and weaponization of this vulnerability. The script contains an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLM training data.

A hallucinated CVSS score is a particularly telling detail. No human security researcher writing an exploit would invent a severity rating and embed it in a docstring. That's an LLM filling in a gap it doesn't actually know the answer to, exactly the kind of artifact that distinguishes machine-generated code from human-written code.

GTIG is fairly confident the threat group was using AI in a meaningful way throughout the entire process, but has yet to determine if the technology also discovered the vulnerability it ultimately developed into an exploit. Whichever AI model the attackers used, Google is confident it wasn't Gemini or Anthropic's Mythos.

Nation-State Actors Are Already in the Race

The cybercrime case is the headline, but the full GTIG report documents a much broader pattern of AI-assisted threat activity across nation-state groups.

Threat actors associated with the People's Republic of China and the Democratic People's Republic of Korea have demonstrated significant interest in capitalizing on AI for vulnerability discovery.

Specific observed behaviors include:

• The North Korean threat actor known as APT45 sent "thousands of repetitive prompts" that recursively analyze different CVEs and validate proof-of-concept exploits.
• UNC2814, a Chinese group known for targeting telecoms and government organizations, used a persona-driven jailbreak, in which the AI is instructed to act as a senior security auditor, to enhance vulnerability research on embedded devices, including TP-Link firmware with OFTP implementations.
• A cluster of Russia-nexus intrusion activity targeted Ukrainian organizations to deliver AI-enabled malware dubbed CANFAIL and LONGSTREAM, both of which use LLM-generated decoy code to conceal their malicious functionality.

As Google noted in its report: "This results in a more robust arsenal of exploit capabilities that would be impractical to manage without AI assistance."

Key Technical Highlights

AI-driven coding has accelerated the development of infrastructure suites and polymorphic malware by adversaries. These AI-enabled development cycles facilitate defense evasion by enabling the creation of obfuscation networks and the integration of AI-generated decoy logic in malware linked to suspected Russia-nexus threat actors.

Additional findings from the GTIG report:

• Threat actors are now industrializing access to premium AI models using automated account creation, proxy relays, and account-pooling infrastructure.
• "Threat actors now pursue anonymized, premium-tier access to models through professionalized middleware and automated registration pipelines to illicitly bypass usage limits. This infrastructure enables large-scale misuse of services while subsidizing operations through trial abuse and programmatic account cycling."
• The report also spotlighted obfuscated LLM access, in which threat actors pursue anonymized access to models to illicitly bypass usage limits, and supply chain attacks in which adversaries target AI environments and software dependencies as an initial access vector.

Google's Defensive Response

Google isn't only documenting the threat. Last year, the company introduced Big Sleep, an AI agent developed by Google DeepMind and Google Project Zero that actively searches for unknown security vulnerabilities in software. Big Sleep has since found its first real-world security vulnerability and assisted in finding a vulnerability that was imminently going to be used by threat actors, which GTIG was able to cut off beforehand.

Google recently introduced CodeMender, an experimental AI-powered agent using the advanced reasoning capabilities of its Gemini models to automatically fix critical code vulnerabilities.

As GTIG put it: "Attackers rarely shy away from experimentation and innovation, but neither do we."

Final Thoughts

What makes this case technically interesting isn't just that AI was used to build an exploit. It's where AI turned out to be effective. Hard-coded trust assumptions in authentication flows are exactly the kind of high-level semantic bugs that automated tooling consistently misses. The fact that an LLM found and weaponized one suggests that certain categories of vulnerability, previously requiring deep manual code review, are now within reach of well-prompted models.

Hultquist put it plainly: "There's a misconception that the AI vulnerability race is imminent. The reality is that it's already begun. For every zero-day we can trace back to AI, there are probably many more out there." That framing matters. The security community has spent years treating AI-assisted exploitation as a future threat model. This case closes that argument.

As Ryan Dewhurst, watchTowr's Head of Threat Intelligence, told The Hacker News: "AI is already accelerating vulnerability discovery, reducing the effort needed to identify, validate, and weaponize flaws. This is today's reality: discovery, weaponization, and exploitation are faster. We're not heading toward compressed timelines; we've been watching the timelines compress for years." The defenders who adapt fastest to that reality will be the ones who stay ahead of it.

What do you think about AI being used offensively in the wild? Drop your thoughts in the comments.

---