Artificial Intelligence

Google Caught an AI-Built Zero-Day—And Says It’s Just the Beginning

Google Threat Intelligence Group found the first confirmed AI-developed zero-day exploit, disrupting a mass attack campaign before it launched. The implications are just starting to sink in.

Criminal hackers used artificial intelligence to build a working zero-day exploit — and Google caught them before they could use it. The discovery, detailed in a report released Monday by Google’s Threat Intelligence Group, marks the first confirmed instance of threat actors deploying AI to discover and weaponize a previously unknown vulnerability.

The exploit targeted a widely used open-source web-based system administration tool. It allowed attackers to bypass two-factor authentication once they had valid user credentials — a semantic logic flaw where the developer hardcoded a trust assumption that contradicted the application’s authentication enforcement. Google worked with the vendor to patch the flaw before the planned mass exploitation campaign could execute.

Neither the specific tool nor the criminal group was named. But John Hultquist, chief analyst at GTIG, described the threat actors as having a “strong record of high-profile incidents and mass exploitation,” suggesting they are well-known among cybersecurity practitioners.

The AI Fingerprints That Gave Them Away

The researchers knew they were looking at AI-generated code before they even finished reading the script. The Python exploit contained artifacts that no human developer would leave behind: a hallucinated CVSS severity score referencing a vulnerability that doesn’t exist, educational docstrings that read like training data annotations, and a clean, textbook-style Pythonic format that real exploit writers simply don’t use.

“We finally uncovered some evidence this is happening,” Hultquist told CyberScoop. “This is probably the tip of the iceberg and it’s certainly not going to be the last.”

GTIG said it has “high confidence” that an AI model was used throughout the exploit’s development, but ruled out Google’s own Gemini and Anthropic’s Mythos as the models involved. The vulnerability itself — a hardcoded trust assumption that bypassed 2FA — is precisely the kind of high-level semantic flaw that traditional security scanners struggle to detect but that frontier language models can reason about by analyzing a developer’s intent.

This is the offensive mirror of what Google’s own defenders demonstrated in late 2024, when the Big Sleep AI agent — a collaboration between Google Project Zero and DeepMind — found a real zero-day vulnerability in SQLite. The difference is that Big Sleep was designed to protect. This time, someone flipped the same capability toward attack.

State Actors Are Already in the Game

The zero-day discovery is the headline, but the GTIG report documents a broader acceleration. Nation-state hacking groups from China, North Korea, and Russia have moved well beyond using AI as a writing assistant for phishing emails. They are integrating it across the full attack chain.

North Korea’s APT45 has been observed sending thousands of repetitive prompts to recursively analyze vulnerabilities and validate proof-of-concept exploits — building an arsenal that would be impractical to manage without AI assistance, according to the SiliconANGLE report on GTIG’s findings. A China-linked actor, designated UNC2814, used expert-persona jailbreaking to push Gemini into researching pre-authentication remote code execution flaws in TP-Link router firmware.

Russia-nexus actors have deployed two malware families, CANFAIL and LONGSTREAM, that use AI-generated decoy code to obscure malicious functionality. CANFAIL contains LLM-authored comments explicitly describing blocks of code as unused filler, while LONGSTREAM includes 32 separate instances of code querying the system’s daylight saving time status — a repetitive, functionally irrelevant pattern designed to make the script appear benign to analysts.

Agentic tools are also being folded into operations. A China-nexus actor was observed using the Hexstrike and Strix frameworks alongside the Graphiti memory system to autonomously probe a Japanese technology firm and an East Asian cybersecurity platform, pivoting between reconnaissance tools without human intervention.

From Productivity Boost to Autonomous Attack

The trajectory is clear. In early 2025, GTIG observed threat actors using generative AI primarily as a productivity multiplier — drafting phishing lures, translating content, supporting different phases of the attack lifecycle. By November, adversaries had begun developing agentic AI capabilities for malware tooling. By February 2026, GTIG documented the first AI-integrated malware in active operations. Now, AI is building zero-days.

“There’s a misconception that the AI vulnerability race is imminent,” Hultquist said. “The reality is that it’s already begun. For every zero-day we can trace back to AI, there are probably many more out there.”

The implications cut both ways. Google’s own Big Sleep agent proved AI can find vulnerabilities defenders miss — the same class of semantic logic flaw that the criminal zero-day exploited. The question is no longer whether AI will change cybersecurity. It’s whether defenders can use it faster than attackers can, and whether the current regulatory frameworks are built for a world where zero-days can be manufactured at scale — or whether AI security tools can adapt fast enough.

Hultquist put it plainly: “If criminals are doing it, then state actors with significant resources probably are too. Each new generation of models will reduce the need for expert-developed harnesses, but they are almost certainly out there.”

Google disclosed the vulnerability to the vendor before the attack could launch, and a patch has been issued. The tool remains unnamed, the criminal group unidentified, the AI model unspecified. What’s confirmed is the precedent — and the probability that the next one won’t be caught in time.

FAQ

What is a zero-day exploit?

A zero-day exploit targets a vulnerability that the software vendor has no prior knowledge of and no existing fix for. The term “zero-day” refers to the number of days the vendor has had to address the flaw — zero.

How did Google determine the exploit was AI-generated?

The Python exploit code contained several hallmarks of AI output: a hallucinated CVSS severity score (referencing a vulnerability that doesn’t exist), educational docstrings characteristic of LLM training data, and a clean, textbook-style Python format inconsistent with how human exploit developers write code.

What specific tool was targeted?

Google declined to identify the tool, describing it only as a “popular open-source, web-based system administration tool.” The vulnerability has been patched.

Was Google’s Gemini AI used by the attackers?

No. GTIG stated it does not believe Gemini or Anthropic’s Mythos were used in developing the exploit. The specific AI model involved was not identified.

What is Big Sleep?

Big Sleep is Google’s own AI agent, developed jointly by Google Project Zero and DeepMind, that found a real zero-day vulnerability in SQLite in late 2024. It demonstrated AI’s defensive potential — the same capability that attackers are now replicating on the offensive side.