← Back to feed

Google’s Threat Intelligence Group (GTIG) published its AI Threat Tracker report on May 11, documenting what it calls the first confirmed case of an AI-generated zero-day exploit deployed in the wild by criminal actors.

The target: a two-factor authentication bypass in a popular open-source, web-based system administration tool. The method: a Python script. The plan: mass exploitation. The outcome: Google caught it, coordinated disclosure with the vendor, and a patch shipped before the campaign got off the ground.

The Code Gave It Away

GTIG didn’t name the tool or the threat group, but they’re confident AI was involved. The script contained what the report calls “an abundance of educational docstrings,” including a hallucinated CVSS severity score — exactly the kind of artifact that emerges when an LLM generates exploit code from training data patterns rather than from a human operator’s shorthand.

The broader formatting matched LLM output: detailed help menus, the clean _C ANSI color class, structured textbook Pythonic architecture that no human writing an exploit would bother with.

“Although we do not believe Gemini was used,” the report states, “we have high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability.”

The flaw itself is significant. It stemmed from a semantic logic error — a developer hardcoded a trust assumption that created a 2FA exception the authentication flow didn’t account for. Traditional scanners miss this class of bug. They look for crashes and sink patterns. LLMs can read developer intent across a codebase and surface the contradiction.

“Frontier LLMs excel at identifying these types of high-level flaws and hardcoded static anomalies,” GTIG wrote. “Though frontier LLMs struggle to navigate complex enterprise authorization logic, they have an increasing ability to perform contextual reasoning, effectively reading the developer’s intent to correlate the 2FA enforcement logic with the contradictions of its hardcoded exceptions.”

The Wider Campaign

The zero-day finding sits inside a larger pattern documented in the same report.

China’s UNC2814 used expert-persona jailbreaking on Gemini — instructing the model to act as a senior security auditor specializing in embedded devices — to research remote code execution flaws in TP-Link router firmware and Odette File Transfer Protocol implementations. A separate China-nexus actor deployed Strix, Hexstrike, and the Graphiti memory system to autonomously probe a Japanese tech firm and an East Asian cybersecurity company, pivoting between reconnaissance tools based on internal reasoning with minimal human oversight.

North Korea’s APT45 sent thousands of repetitive prompts to recursively analyze CVEs and validate proof-of-concept exploits. The goal is a “more robust arsenal of exploit capabilities that would be impractical to manage without AI assistance.”

Russia deployed CANFAIL and LONGSTREAM, malware families with AI-generated junk code designed to confuse analysts. The “Operation Overload” influence campaign used AI voice cloning to insert fabricated audio into legitimate news footage targeting Ukraine, France, and the United States.

GTIG also flagged PROMPTSPY, an Android backdoor that calls the Gemini API at runtime to interpret on-screen UI elements and generate touch coordinates autonomously — an agentic attack that navigates infected devices without a human in the loop.

What It Means

The 2FA bypass case matters less for its immediate damage — the patch shipped, the campaign may have been disrupted by implementation errors in the exploit itself — than for what it signals about the capability curve.

“There’s a misconception that the AI vulnerability race is imminent,” said John Hultquist, chief analyst at GTIG. “The reality is that it’s already begun. For every zero-day we can trace back to AI, there are probably many more out there.”

The tell-tale LLM fingerprints in this case (hallucinated scores, docstring verbosity) are implementation artifacts from less capable or less carefully prompted models. Those fingerprints will disappear as operators get better at prompting and models get better at stripping training data patterns from output. GTIG’s ability to identify AI-generated exploits by their code style is not a permanent advantage.

Numbers

• Zero-days confirmed AI-generated in the wild: 1 (first documented case)
• Vendor patch status: issued before mass exploitation
• Nation-state groups observed using AI for vuln research: China (UNC2814, unnamed actor), North Korea (APT45), Russia (influence ops)
• Agentic attack frameworks observed: Strix, Hexstrike, Graphiti (recon/pivot), PROMPTSPY (Android device navigation)
• Google’s defensive countermeasure: Big Sleep vuln-discovery agent, CodeMender patching tool, account disabling for Gemini abuse