Google confirmed the first known case of cybercriminals using AI to discover and weaponize a zero-day vulnerability. They planned a mass exploitation event.

“For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI. The criminal threat actor planned to use it in a mass exploitation event but our proactive counter discovery may have prevented its use.” — Google Threat Intelligence Group

Google’s Threat Intelligence Group reported that multiple cybercrime threat actors collaborated to use AI to identify a bug in a Python script that would let them bypass two-factor authentication on a widely used open-source system. The groups then used AI-assisted code to weaponize the previously unknown vulnerability for planned mass exploitation. Google’s proactive discovery thwarted the attack before deployment. Separately, the report found that groups linked to China and North Korea demonstrated “significant interest in capitalizing on AI for vulnerability discovery.” This comes weeks after Anthropic delayed the rollout of its Mythos model citing concerns that criminals could use it to identify and exploit decades-old software vulnerabilities. The GTIG report represents a transition from theoretical risk to confirmed operational use of AI in offensive cyber operations.