Google Says It Stopped the World's First AI‑Built Zero-Day Exploit

Google's Threat Intelligence Group says it has disrupted what it believes is the first real‑world zero‑day exploit developed with the help of AI.

A major cybercrime group (which the Threat Intelligence team claims is widely known, but did not name) allegedly targeted a popular open‑source web‑based system administration tool to gain initial access to corporate systems. The attackers created an exploit that could bypass two‑factor authentication, potentially allowing them to take over accounts managed through the tool.

Google found that an AI model likely helped the threat actors discover and exploit the security flaw in the code. Their Python script was very detailed, with tutorial‑style comments and docstrings, and a "hallucinated" CVSS security score that does not match any real entry in official databases. This pattern closely matches the telltale signs of AI‑generated code.

The Threat Intelligence Group adds that the bug ...