Google says cybercriminals have now crossed a major line in cybersecurity after detecting what it believes is the first known AI-assisted zero day cyberattack.
Quick Summary – TLDR:
- Google detected a zero day exploit likely developed with AI assistance.
- The attack targeted a popular open source administration tool.
- The exploit could bypass two factor authentication.
- Researchers say this may only be the beginning of AI powered cyberattacks.
What Happened?
Google’s Threat Intelligence Group and Mandiant researchers revealed that a criminal hacking group likely used an artificial intelligence model to discover and weaponize a previously unknown software vulnerability.
The exploit was designed to bypass two factor authentication in a popular open source web based system administration platform. Google says it worked with the software vendor quickly enough to patch the flaw before attackers could launch a large scale campaign.
New: Google researchers say a cybercrime group used AI to create a zero-day tool designed to bypass two-factor authentication, the first such case caught by Google’s Threat Intelligence Group.
— SolanaFloor (@SolanaFloor) May 11, 2026
Source: Bloomberg pic.twitter.com/oH4tX9a9XN
Google Says AI Is Now Helping Hackers Find Vulnerabilities
For years, cybersecurity experts warned that AI could eventually help hackers discover hidden flaws in software faster than humans. Until now, there had been little public evidence of that happening in real world attacks.
Google now says that has changed.
According to the company, researchers found strong indicators that the exploit code was generated with the help of an AI model. The company clarified that it does not believe its own Gemini chatbot was involved.
Google explained that the malicious Python script contained several signs commonly associated with AI generated code. This included unusually detailed educational comments, structured formatting, clean help menus, and even a hallucinated CVSS security score that did not actually exist.
“We have high confidence that the actor likely leveraged an A.I. model to support the discovery and weaponization of this vulnerability,” Google said in its report.
Security researchers believe these clues are among the clearest evidence yet that AI is moving from being a support tool for hackers to becoming an active part of cyberattack development.
The Attack Could Have Triggered Mass Exploitation
The zero day vulnerability reportedly allowed attackers to bypass authentication protections, although hackers still needed valid usernames and passwords to gain access.
Google did not reveal the name of the affected software tool or identify the cybercrime group behind the operation. However, the company said the attackers appeared to be preparing for a widespread exploitation campaign before researchers intervened.
John Hultquist, chief analyst at Google Threat Intelligence Group, described the discovery as an early warning sign for the cybersecurity industry.
Hultquist said:
The report also noted that modern AI systems are becoming especially good at finding high level logic flaws that traditional security scanners often miss. Instead of searching for common coding mistakes, AI models can increasingly understand developer intent and identify security contradictions hidden deep inside software logic.
China and North Korea Linked Groups Expanding AI Use
Google’s wider report also revealed that state sponsored hacking groups from China and North Korea are rapidly increasing their use of AI tools.
Chinese linked threat actors reportedly used advanced agentic frameworks such as Strix and Hexstrike during attacks on Japanese technology companies and cybersecurity organizations.
Another Chinese group known as UNC2814 used persona based jailbreak prompts to make AI models behave like senior security auditors while researching vulnerabilities in embedded systems and TP Link firmware.
Meanwhile, North Korean hacking group APT45 reportedly sent thousands of automated prompts to analyze CVEs and validate proof of concept exploits at scale.
Google says AI is helping threat actors automate research, malware development, phishing operations, obfuscation techniques, and even autonomous malware behavior.
AI Is Becoming Both a Weapon and a Target
The report also highlighted growing attacks on AI ecosystems themselves. Researchers observed hackers targeting AI supply chains, developer tools, open source AI components, and API infrastructure to gain broader network access.
At the same time, Google says it is also using AI defensively. The company highlighted projects such as Big Sleep, an AI agent designed to discover software vulnerabilities, and CodeMender, which aims to automatically patch insecure code.
Many experts believe AI could eventually improve cybersecurity by helping developers write safer software. But they also warn that the short term risks are growing rapidly as attackers gain access to increasingly capable AI systems.
SQ Magazine Takeaway
I think this is the moment the cybersecurity industry has been quietly expecting for years. AI is no longer just helping hackers write phishing emails or automate simple tasks. It is now being used to discover serious software vulnerabilities that even experienced researchers can miss.
What stands out here is not just the exploit itself, but how quickly this technology is evolving. If criminal groups are already experimenting with AI generated zero day attacks today, the next few years could completely reshape digital security. Companies that still treat AI threats as theoretical problems are going to fall behind very quickly.
