Since its February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. On May 11, that tracking produced something the security community had long anticipated but never confirmed: a real-world case of AI being used to build a working zero-day exploit.
Google disclosed that it identified an unknown threat actor using a zero-day exploit that was likely developed with an AI system, marking the first time the technology has been put to use in the wild in a malicious context for vulnerability discovery and exploit generation. The attack was stopped before it caused damage, but the technical evidence it left behind is what makes this case significant.
John Hultquist, the chief analyst at GTIG, characterized it as "a taste of what's to come" and "the tip of the iceberg," adding that this case was just the first "tangible evidence" of these sorts of attacks.
What the Exploit Actually Did
GTIG observed prominent cybercrime threat actors partnering to plan a mass vulnerability exploitation operation. Their analysis of exploits associated with this campaign identified a zero-day vulnerability implemented in a Python script that enables the user to bypass two-factor authentication (2FA) on a popular open-source, web-based system administration tool.
The vulnerability, described as a 2FA bypass, requires valid user credentials for exploitation. It stems from a high-level semantic logic flaw arising from a hard-coded trust assumption, something LLMs excel at spotting. That last point is worth sitting with. Traditional static analysis tools and fuzzers are built to catch memory corruption bugs and crash-inducing inputs. They are not designed to reason about authentication logic at the semantic level.
As the report put it: "While fuzzers and static analysis tools are optimized to detect sinks and crashes, frontier LLMs excel at identifying these types of high-level flaws and hardcoded static anomalies."
GTIG worked with the impacted vendor to responsibly disclose this vulnerability and disrupt the threat activity. The flaw has since been patched.
How Researchers Knew AI Was Involved
GTIG didn't just assume AI was used. They found specific forensic markers in the exploit code itself.
Although they do not believe Gemini was used, based on the structure and content of the exploits, they have high confidence that the actor leveraged an AI model to support the discovery and weaponization of this vulnerability. The script contains an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLM training data.
