Google: AI-Powered Hacking Became an Industrial-Scale Threat in Three Months

Google's threat analysis group has released an alarming report: in three months, AI-powered hacking has gone from a niche, future-looking threat to a real, industrial-scale phenomenon. Criminal groups and state actors are already using commercial AI models to find, develop and scale cyberattacks.

Three Months From Theory to Practice

The speed of escalation is unprecedented. As recently as late 2025, AI in the context of hacking was discussed mainly in academic circles, and only a handful of enthusiasts worked on vulnerabilities. Now it is a mass phenomenon. Google is recording not isolated incidents but a systemic trend: organizations around the world are facing waves of attacks in which vulnerability discovery, malware generation and phishing are coordinated with the help of AI.

The report does not disclose specific figures for breaches, but the hint of "industrial scale" speaks for itself. We are no longer talking about dozens of incidents, but hundreds or thousands. It will get worse: AI is becoming more accessible, prices are falling, and criminals are learning to optimize their hacking tools.

Who Is Using AI for Attacks

Google identifies several categories of threat actors:

• Organized criminal groups — use AI for automated vulnerability discovery, phishing campaign development and malware code generation
• State intelligence services — apply more sophisticated techniques, including targeted attacks on critical infrastructure
• Independent hackers and small groups — previously struggled to compete with professionals; now AI has leveled their access to tools
• Ready-made DaaS platforms — services are appearing on dark markets with offers such as "AI-powered exploit code development to order"

Google does not specify which AI models the attackers use, but it is clear they are available commercial solutions (GPT, Claude, local models). No secret developments are needed — ordinary LLMs are powerful enough.

Why AI Is So Effective for Hackers

AI's strength is that it sees code and systems very differently from humans. The models are trained on millions of lines of code and documentation. Here is what that produces:

• Exhaustive vulnerability search — AI scans millions of lines and finds potential holes thousands of times faster than a human
• Working exploit code generation — what once took an experienced hacker hours of manual work is now written in minutes
• Personalized phishing — AI creates emails and messages that seem more natural and convincing
• Adaptation to defenses — when a company closes one vulnerability, AI retrains and finds alternative paths

Most dangerous of all: AI doesn't get tired, doesn't make mistakes out of boredom, and can keep millions of targets in view at once. Where a veteran hacker could check a dozen companies in a week, AI will check a million.

What This Means

This is a signal of escalation. Google is not merely reporting on a new threat — it is a warning that security under the old rules is over. Defending against AI-powered attacks requires something entirely different: continuous vulnerability hunting by red teams, AI-powered monitoring, and architecture built on the assumption that a breach can happen at any moment.

The coming months will be critical for companies that fail to invest in modernizing their security.