Google Threat Intelligence Reports First AI-Developed Zero-Day Used by Criminals

On 11 May 2026 Google's Threat Intelligence Group (GTIG) published a report on how adversaries are using AI across the attack lifecycle. Its most notable finding was the first case the group has attributed with high confidence to an AI-assisted zero-day exploit developed by financially motivated criminals. The vulnerability allowed two-factor authentication to be bypassed in a popular open-source, web-based system administration tool, and it surfaced while GTIG was analysing preparations for a mass exploitation campaign. Google coordinated disclosure with the vendor and said the activity was disrupted before deployment.

The attribution rested on the exploit's structure rather than on account telemetry. The Python script carried textbook docstrings, a hallucinated CVSS score, tidy help menus and a colour-output class, traits GTIG associates with LLM-generated code. More significant was the nature of the bug: a high-level logic flaw built on a hard-coded trust assumption, not a memory-corruption defect. Fuzzers and static analysers are tuned for crashes and sinks; language models, the report argues, are comparatively good at spotting code that looks functionally correct but is strategically broken.

The rest of the report catalogues broader trends. Chinese and North Korean state-linked groups were observed using persona-based jailbreaks and curated vulnerability datasets, including an 85,000-case CVE corpus, to automate research. Malware families such as PROMPTFLUX and PROMPTSPY used models at runtime, the latter an Android backdoor that drives a device's UI autonomously via an automation agent. GTIG also documented industrial-scale abuse of model access through relay and registration pipelines, an AI voice-cloning influence operation targeting journalists, and the TeamPCP supply-chain campaign that compromised PyPI packages and GitHub Actions to steal cloud credentials.

The timing sharpened the debate about offensive AI. Within the same fortnight Anthropic reported that its restricted Mythos model had found thousands of high-severity flaws in open-source software, and OpenAI was previewing a model it described as competitive on exploit benchmarks. Defenders now face a window in which AI-discovered vulnerabilities can be generated faster than maintainers can patch them, and the Verizon DBIR released the same month reported that exploitation of vulnerabilities had overtaken credential theft as the leading breach entry point.

What it means for leaders

• Shrink patch windows for internet-facing tools. Logic flaws in admin consoles, VPN portals and CI systems are exactly what LLM-assisted research finds first; prioritise them in vulnerability management and assume disclosure-to-exploit intervals measured in hours.
• Use the same capability defensively. Google points to its own Big Sleep and CodeMender agents; boards should ask security teams whether AI-assisted code review and triage are in the toolchain, and under what governance.
• Harden the software supply chain. The TeamPCP campaign shows that AI tooling itself (LiteLLM, Trivy, agent skill hubs) is a target; require provenance checks, pinned dependencies and secret scanning for AI dev pipelines.
• Update threat models and tabletop exercises. Include AI-driven reconnaissance, autonomous mobile malware and voice-cloned executives in incident-response scenarios.
• Report and share. GTIG's frameworks (SAIF, CoSAI) are a reasonable reference; map internal AI security controls to them and to NIST AI RMF "Measure" outcomes so findings can be exchanged with peers and regulators.