Google Finds Signs of AI-Assisted Zero-Day Before Planned Mass Exploitation
Summary
Google says it found signs that AI was used to develop a zero-day affecting an unnamed open-source administration tool. The vendor patched it before a cybercrime group could begin mass exploitation.
Key points
- Google’s Threat Intelligence Group said an unnamed cybercrime group was preparing to use the exploit in a mass-exploitation campaign.
- The flaw affected a Python script that could be used to bypass two-factor authentication in an unnamed open-source web administration tool.
- The vendor patched the vulnerability; Google withheld its identity and details of how researchers discovered it.
- Google cited Python documentation strings, heavily annotated code and a fabricated CVSS score as signs of AI involvement.
- Google said it is confident AI played a meaningful role in developing the exploit, but has not determined whether AI also discovered the vulnerability.
Article Details
- Event Type
- Google identified an apparent AI-developed zero-day exploit and alerted the affected vendor before a reported mass-exploitation campaign began.
- Impact
- The undisclosed vulnerability affected a Python script in an unnamed popular open-source web-based administration tool and could be used to bypass two-factor authentication. Google said the vulnerability was patched before widespread abuse. GTIG assessed that a cybercrime group was preparing to use the exploit and was fairly confident AI played a meaningful role in its development, but had not determined whether AI also discovered the vulnerability.