Google Uncovers First AI-Generated Zero-Day Exploit in Cybercrime Campaign Google has identified the first known zero-day exploit developed with the assistance of artificial intelligence, marking a significant evolution in cyber threats. In a report published Monday, Google’s Threat Intelligence Group (GTIG) and Mandiant detailed how a prominent cybercrime group used AI to craft a Python-based exploit targeting an open-source web administration tool, specifically designed to bypass two-factor authentication (2FA). While Google did not disclose the threat actor or the affected software, it confirmed collaboration with the vendor to mitigate potential mass exploitation. Analysis of the exploit’s structure including educational docstrings, a hallucinated CVSS score, and a "textbook" Pythonic format suggests the use of a large language model (LLM) in its development. Google clarified that its own AI, Gemini, was not involved. The report also highlights state-sponsored actors leveraging AI for vulnerability research. Chinese-linked groups, including UNC2814, have employed agentic tools like Strix and Hexstrike in attacks on a Japanese tech firm and an East Asian cybersecurity company. UNC2814 further used AI-driven "persona-driven jailbreaks" instructing models to act as senior security auditors to analyze vulnerabilities in embedded devices, such as TP-Link firmware. North Korea’s APT45, meanwhile, deployed AI to automate the analysis of CVEs and validate proof-of-concept (PoC) exploits at scale, enabling a more robust arsenal than manual methods could achieve. Beyond exploit development, the report outlines AI’s role in autonomous malware operations, defense evasion, and supply chain attacks, as well as threat actors’ growing interest in premium LLM access. This incident underscores AI’s dual-edged impact on cybersecurity, where both attackers and defenders are rapidly integrating advanced tools into their strategies.