Google GTIG: First AI-Generated Zero-Day Exploit Identified; State Actors Expand AI-Assisted Cyber Operations – May 2026

Google's Threat Intelligence Group (GTIG) has identified the first confirmed zero-day exploit believed to have been developed using AI, targeting an unnamed open-source web administration tool to bypass two-factor authentication. The Python exploit's structure — including hallucinated CVSS scores and LLM-characteristic formatting — provided high-confidence evidence of AI involvement. The attack was foiled before mass exploitation. GTIG also reported broader trends of Chinese (APT27, APT45) and North Korean (UNC2814, UNC5673, UNC6201) threat actors using AI for vulnerability discovery, while Russian actors employed AI-generated code to obfuscate malware and AI voice cloning in influence operations.

AI-generated from linked source reports. See our correction policy.