Google GTIG Reports First AI Zero-Day Exploit

Google's Threat Intelligence Group disclosed on Monday the first confirmed instance of cybercriminals using artificial intelligence to develop a zero-day exploit, targeting a popular open-source web-based system administration tool to bypass two-factor authentication.

The Python script exploited a semantic logic flaw stemming from a hardcoded trust assumption by developers, allowing unauthorized access but requiring valid user credentials. GTIG researchers identified high-confidence indicators of AI involvement, including educational docstrings, a hallucinated Common Vulnerability Scoring System score and textbook-style formatting typical of large language model output. They ruled out use of Google's Gemini model or Anthropic's Mythos.

GTIG detected the exploit as a prominent cybercrime group prepared a mass exploitation campaign. The group notified the unnamed vendor, which issued a patch, and collaborated with law enforcement to disrupt the operation before deployment. Implementation errors by the actors likely prevented initial success, and no widespread exploitation occurred.

"This is the first time GTIG has identified a threat actor using a zero-day exploit that we believe...