Google Intercepts First AI-Built Zero-Day Exploit

For the first time, Google has detected and blocked a zero-day exploit that cybercriminals created with the help of artificial intelligence. The event points to a new level of cybersecurity threat: criminals now use AI to develop exploits faster and more efficiently than ever before.

A targeted attack on 2FA

Unidentified criminal groups were preparing a large-scale attack on the two-factor authentication (2FA) system of an open-source web application for managing system infrastructure. IT administrators around the world use the application to manage servers and corporate networks.

The exploit let attackers bypass 2FA entirely and gain access to protected administrator accounts. In criminal hands, that access meant the ability to steal confidential company data, install malware or hold a corporate network hostage.

Google Threat Intelligence detected the attempt at a critical moment, literally just before launch. Specialists were able to block the vulnerability, notify the application's developers and release a fix. That saved potentially thousands of corporate networks from compromise and data leaks.

How AI sped up exploit development

Before large language models, building a zero-day exploit took months of manual work, deep knowledge of the target application's architecture and constant testing. Now cybercriminals can use AI to speed up that process significantly.

Modern language models can:

• Automatically generate vulnerability code from a simple description of an idea
• Analyze large volumes of a target application's open-source code in a matter of minutes
• Test different attack variants in parallel, without human involvement
• Optimize code to evade detection by security systems and antivirus software
• Cut development from weeks or months to days or even hours

This is the first confirmed case of a zero-day exploit created with AI tools. Google notes that such attacks will become more frequent as AI models improve and access to them gets cheaper.

Google's response and defense

The company immediately released a fix for the vulnerability and recommends that administrators update their software to the latest version. Specialists also advise strengthening additional layers of authentication and not relying on 2FA alone as the only defense.

The incident showed that a single authentication factor is no longer enough against advanced attacks that can be developed very quickly. Companies need to adopt layered defense, including monitoring for anomalous employee activity, restricting access by IP address, using VPNs for critical operations and running regular security audits.

Why this is urgent

Zero-days used to be rare and expensive weapons, available only to state-sponsored hackers and specialized criminal groups. Developing such an exploit required hiring experienced specialists and months of work.

Now the situation has changed. Any criminal group can afford a subscription to an AI service, which costs from $20 to $200 a month. That means zero-day exploits are becoming a democratized tool in the hands of ordinary cybercriminals.

What this means

Cyberattacks are evolving in real time alongside artificial intelligence. Companies need to move from reactive to proactive security: not wait for breaches, but anticipate attacks and prevent them. That takes investment in modern monitoring technology, employee training, regular testing of defenses and continuous infrastructure updates.