Google stops first zero-day developed with AI

For the first time, Google has detected a zero-day vulnerability developed by cybercriminals with the help of artificial intelligence. The threat was meant for a mass, coordinated cyberattack, which was stopped before it could be carried out.

A threat to administrators

Google Threat Intelligence Group (GTIG) identified a serious threat from a group of cybercriminals who planned to use a zero-day vulnerability to bypass two-factor authentication. The target was an open-source web system administration tool widely used in the corporate sector. The vulnerability would have given attackers full access to administrators' systems across many organizations.

The cybercriminals were preparing a coordinated attack that would have hit several targets at once. This was not just the development of a single exploit but a full-scale operation aimed at mass exploitation. According to the attackers' plan, breaking the two-factor protection would have opened the door to every administration system in the affected organizations. Such a scenario could have led to the compromise of thousands of companies.

How researchers knew AI had helped

In the exploit's source code, Google's researchers found clear signs that a neural network had been used to create it. Analysis of the Python script revealed odd artifacts typical of LLM-generated content:

• Hallucinated CVSS scores — incorrect, invented severity values that do not match the real danger
• Structured formatting — the code was formatted in a textbook style, with a regularity unusual for this type of exploit
• Odd writing style — a way of commenting and naming variables characteristic of large language models
• Unusual logic — some fragments of the script contained a strange sequence of operations that works but looks unnatural

Such signs appear when an LLM generates code for specialized tasks without fully understanding the security context and the requirements of exploits. A neural network can follow syntax, but does not always grasp semantics.

"This demonstrates a dangerous evolution of cyber threats.

Where AI used to help mainly with mass phishing attacks, it now helps create serious, targeted exploits," Google's researchers note in their report.

The danger of a lower barrier to entry

This is the first documented case of generative AI being used to develop a zero-day exploit. Previously, artificial intelligence was used in cyberattacks, but mainly to automate phishing mailings, create fake profiles and carry out social engineering. A zero-day exploit is a different level of danger altogether.

The main consequence of the discovery is a sharp drop in the barrier to entry for developing serious cyber threats. Cybercriminals no longer need to hire experienced developers with knowledge of web application architecture and vulnerabilities. They can simply ask ChatGPT, Claude or another large language model to help with the exploit code. Even if the code contains errors (like those same hallucinated CVSS scores), the exploit will remain functional and dangerous. This means the number of cyber threats may rise sharply, since development becomes more accessible.

What this means for companies

Google's discovery points to an acceleration of the entire cyber threat development cycle. Companies now need to respond to new vulnerabilities even faster and apply critical-level patches. Delaying a patch by a week can be dangerous.

For large organizations, this means investing not only in perimeter security but also in anomaly monitoring, fast detection of suspicious traffic inside the network, and incident readiness. AI-developed exploits may be less sophisticated, but there will be more of them, and they will appear faster.