Hackers Are Finding Zero-Day Vulnerabilities Using AI: Google

Google reports the first confirmed instance of cybercriminals employing AI to discover and weaponize zero-day vulnerabilities. This development requires business leaders to re-evaluate defensive strategies against automated, logic-based exploits that bypass traditional security measures, threatening corporate data integrity, and authentication protocols.

Google identified hackers that utilized an AI model to detect previously unknown software vulnerabilities, representing the first documented case of machine learning being used in the wild to facilitate mass exploitation, says the company. The discovery highlights a transition from theoretical risks to active operational threats. 

"We believe this is the tip of the iceberg. This problem is probably much bigger; this is just the first tangible evidence that we can see," says John Hultquist, Chief Analyst, Google Threat Intelligence Group.

For several years, the cybersecurity community has debated the potential of AI to automate the identification of undisclosed software flaws, known as zero-day vulnerabilities. These vulnerabilities are holes in code that remain unknown to the original software developers. Historically, discovering such flaws required significant human expertise and time, making them rare and valuable. In black markets, high-functioning zero-day exploits have fetched prices exceeding US$1 million.

Google Threat Intelligence Group (GTIG) reports that this barrier has been breached. Criminal actors now leverage large language models (LLMs) to reduce the effort needed to identify, validate, and weaponize software flaws. This acceleration occurs as the technology industry and the US government re-evaluate how to regulate advanced versions of AI. 

Models such as Mythos, which Anthropic announced in October 2024, demonstrate the scale of this shift. Anthropic reported that Mythos identified thousands of zero-day vulnerabilities across every major operating system and web browser, including flaws that had remained undetected for decades. Consequently, the company restricted access to the model to a limited number of organizations and government agencies in the United States and the United Kingdom.

Technical Implementation and AI Indicators

The specific zero-day vulnerability detected by GTIG within the last few months targeted a popular open-source, web-based system administration tool. The exploit, written in the Python programming language, allowed attackers to bypass two-factor authentication. While the attack required valid user credentials to be successful, it was designed for a mass vulnerability exploitation operation.

Researchers at Google express high confidence that an AI model supported the discovery of this flaw. This conclusion stems from unusual features embedded in the code that indicate machine authorship. The Python script contained an abundance of educational docstrings and used a structured, textbook-style layout highly characteristic of LLM training data. 

For example, the script included detailed help menus and a clean ANSI color class. Furthermore, the model generated a hallucinated Common Vulnerability Scoring System (CVSS) score, which is a common error in AI-generated technical output. The flaw itself was a high-level semantic logic error rather than a memory corruption bug. The software developer had hardcoded a trust assumption into the code that undermined authentication enforcement.  

Google says that LLMs are particularly effective at identifying these types of flaws because they can reason about the intent of a developer and detect contradictions in logic that traditional scanning tools often miss.

Rob Joyce, former Cybersecurity Director, National Security Agency, says the evidence tying the code to an AI model is persuasive. Joyce describes the specific characteristics of the code as the closest thing to a fingerprint at a crime scene. This sentiment is shared by Ryan Dewhurst, Head of Threat Intelligence, watchTowr, who says that discovery and weaponization are now occurring at faster rates. Dewhurst notes that defenders do not have the option to opt out of this compressed timeline.

Expanding Threat Landscape: PromptSpy and State Actors

The integration of AI into cyberattacks extends beyond vulnerability discovery into autonomous malware operations. Google identifies "PromptSpy" as a prominent example of this trend. PromptSpy is an Android malware that abuses the Gemini API to analyze the current screen of a victim and provide instructions to the device.

PromptSpy features an autonomous agent module that navigates the Android user interface and interprets real-time user activity to determine its next action. The malware is capable of capturing biometric data to replay authentication gestures, such as a lock screen PIN or a pattern. To prevent uninstallation, the malware uses a module to identify the coordinates of the "Uninstall" button and serves an invisible overlay to block touch events, making the button appear unresponsive.

State-sponsored threat actors are also adopting these technologies. UNC2814, a group linked to China, prompted Gemini to assume the role of a network security expert to support vulnerability research into embedded device targets, including TP-Link firmware. Similarly, the North Korean group APT45, also known as Andariel, sent thousands of repetitive prompts to analyze different CVEs and validate proof-of-concept exploits.

Institutional and Regulatory Response

The use of specialized tools further lowers the entry barrier for cybercriminals. Some threat actors have begun experimenting with a specialized GitHub repository named "wooyun-legacy." This repository functions as a plugin for the Claude model and contains over 5,000 real-world vulnerability cases collected by the Chinese platform WooYun between 2010 and 2016. This historical data provides a training ground for models to identify similar patterns in modern software.

Google says that it has taken steps to disrupt these activities by disabling assets related to PromptSpy and notifying the affected software vendors of the 2FA bypass flaw. These notifications allowed developers to release patches before the hackers could execute their planned mass exploitation.