AI-Driven Zero-Day Exploit Disrupted by Google

Severity: High (Score: 76.0)

Sources: Cybersecuritynews, Mandiant, saif.google, Insurancebusinessmag, www.anrdoezrs.net

Summary

On May 11, 2026, Google Threat Intelligence Group (GTIG) reported a significant incident where cybercriminals used artificial intelligence to develop a zero-day exploit targeting an unnamed open-source web-based system administration tool. This exploit allowed attackers to bypass two-factor authentication, marking the first confirmed case of AI-assisted exploit development. GTIG identified AI signatures in the exploit's code, including a 'hallucinated' CVSS score and structured formatting typical of AI-generated outputs. Google intervened before the exploit could be weaponized, notifying the affected vendor and preventing mass exploitation. The incident highlights an alarming trend where adversaries are increasingly embedding AI into their operations, with notable interest from groups linked to China and North Korea. GTIG anticipates that this is just the beginning of a broader trend in AI-assisted cyberattacks. Key Points: • First confirmed use of AI to develop a zero-day exploit by cybercriminals. • Exploit allowed bypassing two-factor authentication in a widely used system administration tool. • Google disrupted the attack before it could cause damage, highlighting the growing threat of AI in cybercrime.

Key Entities

• Apt27 (apt_group)
• Apt45 (apt_group)
• TeamPCP (apt_group)
• DDoS (attack_type)
• Malware (attack_type)
• Phishing (attack_type)
• Ransomware (attack_type)
• Supply Chain Attack (attack_type)
• Operation Overload (campaign)
• China (country)
• Democratic People's Republic Of Korea (country)
• North Korea (country)
• People's Republic of China (country)
• Russia (country)
• CWE-287 - Improper Authentication (cwe)
• generativelanguage.googleapis.com (domain)
• Canfail (malware)
• HonestCue (malware)
• Longstream (malware)
• Promptflux (malware)
• PromptSpy (malware)
• T1041 - Exfiltration Over C2 Channel (mitre_attack)
• T1059.006 - Python (mitre_attack)
• T1059 - Command and Scripting Interpreter (mitre_attack)
• T1190 - Exploit Public-Facing Application (mitre_attack)
• T1195 - Supply Chain Compromise (mitre_attack)
• Android (platform)
• GitHub (platform)
• Google Play Protect (platform)
• Google Play Services (platform)
• Linux (platform)
• Python (tool)
• Big Sleep (tool)
• Big Sleep Agent (tool)
• Claude (tool)
• Gemini (tool)