Google Detects First AI-Generated Zero-Day Exploit
Google Detects First AI-Generated Zero-Day Exploit
https://www.securityweek.com/google-detects-first-ai-generated-zero-day-exploit/
Publish Date: 2026-05-11 09:04:00
Source Domain: www.securityweek.com
For the first time, Google has identified a zero-day exploit believed to have been developed using artificial intelligence.
The company published a new report on Monday summarizing its observations on the use of AI in the cyber threat landscape, drawing on data collected recently by Gemini, Google Threat Intelligence Group (GTIG), and Mandiant.
One of the most notable findings is that a prominent cybercrime group leveraged AI to develop a zero-day exploit designed to bypass two-factor authentication (2FA) on an open source web-based system administration tool. The exploit was implemented in a Python script.
The hacker group and the targeted tool have not been named, but Google said it worked with the impacted vendor to prevent mass exploitation, which appeared to be the threat actor’s plan.
“Although we do not believe Gemini was used, based on the structure and content of these exploits, we have high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability,” Google explained.
It added, “For example, the script contains an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLMs training data (e.g., detailed help menus and the clean _C ANSI color class).”
Google highlighted that Chinese and North Korean state-sponsored threat actors have been particularly interested in leveraging AI for vulnerability discovery.
A China-linked actor was observed deploying agentic tools such as Strix and Hexstrike in attacks targeting a Japanese tech firm and a major East Asian cybersecurity company.
UNC2814, a Chinese group known for targeting telecoms and government organizations, used a persona-driven jailbreak — in which the AI is instructed to act as a senior security auditor — to enhance vulnerability research on embedded devices,…
