Google Says Cybercrime Group Likely Used AI to Develop Zero-Day Exploit

Summary

Google says a cybercrime group likely used AI to develop a zero-day exploit targeting an unnamed open-source system administration tool’s 2FA. Google worked with the vendor to prevent mass exploitation.

Key points

Google assessed with high confidence that a prominent cybercrime group likely used an AI model to discover and weaponize a zero-day, though it said Gemini was not believed to be involved.
The exploit, implemented in Python, was designed to bypass 2FA on an unnamed open-source web-based system administration tool; Google did not name the group or tool.
Google said it worked with the affected vendor to prevent what appeared to be the actor’s plan for mass exploitation.
Google reported interest in AI-assisted vulnerability discovery among Chinese and North Korean state-sponsored actors.
A China-linked actor used agentic tools including Strix and Hexstrike in attacks targeting a Japanese technology firm and a major East Asian cybersecurity company.
UNC2814 used a persona-driven jailbreak to assist vulnerability research on embedded devices, including TP-Link firmware with OFTP implementations.
North Korean group APT45 sent thousands of repetitive prompts to analyze CVEs and validate proof-of-concept exploits.

Article Details

Event Type: Google reported a zero-day exploit believed to have been developed with AI, alongside threat actors’ use of AI for vulnerability research and exploit validation.
Impact: The unnamed exploit was designed to bypass two-factor authentication on an unnamed open-source web-based system administration tool. Google said the actor appeared to be planning mass exploitation and that it worked with the impacted vendor to prevent it. Google assessed with high confidence that an AI model likely supported discovery and weaponization of the vulnerability, but said it did not believe Gemini was used.