Reported by 1 outlet

Timeline

1. original reporting

   Google detects first confirmed AI-generated zero-day exploit — threat actors industrializing vulnerability discovery

   bleepingcomputer.com · 155d ago · May 12th, 2026

   Google's Threat Intelligence Group (GTIG) has confirmed the first documented case of a threat actor developing a functional zero-day exploit using AI. The exploit targeted a popular open-source web-based administration tool, bypassing its two-factor authentication by exploiting a hardcoded trust assumption in a Python script — a high-level semantic logic bug that AI systems excel at identifying, distinct from memory corruption or fuzzing-discovered flaws. GTIG discovered the exploit before mass exploitation began and notified the vendor, who patched it. The exploit code carried unmistakable AI fingerprints: extensive educational docstrings, highly structured Pythonic formatting, and a hallucinated CVSS severity score the attackers forgot to remove. The responsible cybercrime group has a "strong record of high-profile incidents and mass exploitation." Google is confident the AI model used was neither Gemini nor Anthropic's Mythos. Beyond this single case, GTIG documents that Chinese APT groups (APT27, UNC2814, UNC5673) are using expert persona prompts to bypass AI safety filters and analyze router firmware for RCE flaws, North Korean actors (APT45) are automating recursive CVE analysis at machine speed, and Russia-linked groups are using AI-generated decoy code (CANFAIL, LONGSTREAM, HONESTCUE) to blind security analysts. The Android backdoor PROMPTSPY directly integrates with the Gemini API to read device interfaces, interpret system states, and simulate physical taps to capture biometric data.