Summary: On May 12, 2026, Google Threat Intelligence Group reported the first confirmed zero-day exploit believed to be AI-developed, targeting an open-source web administration tool and bypassing two-factor authentication. GTIG rated confidence in AI authorship as high, cited educational docstrings and a hallucinated CVSS score as evidence, and said Google’s early discovery may have prevented mass exploitation.
May 12, 2026 delivered a milestone nobody in security wanted. On that day, Google’s Threat Intelligence Group (GTIG) published a report confirming — a first — that a threat actor holds a zero-day exploit believed to have been developed with AI. The victim was a widely used open-source, web-based system administration tool, and the flaw gets past two-factor authentication. GTIG’s read was that the actor had a mass exploitation event in the works, and that Google’s move to proactively uncover the exploit “may have prevented its use.”
Nothing here is speculative: the report merges Mandiant incident response data with Gemini telemetry and picks up where the same team’s February 2026 study left off. Its message, in plain terms, is that exploit code written by AI has left the theory stage and turned up in the wild. For security and engineering teams, the useful question has shifted — it is no longer whether language models can produce exploits, but which of your defensive assumptions just expired.
Inside the First AI-Authored Zero-Day
Begin with what this bug is not: it belongs to neither the classic memory-corruption nor the input-sanitization family. It is a semantic logic flaw sitting at a high level of abstraction — a trust assumption baked into the code — and it lets an attacker with valid credentials slip past 2FA. GTIG rates its confidence that an AI model generated the exploit as high, while stating outright that Gemini was not the model involved. Responsible disclosure with the vendor has already run its course, which is why the product goes unnamed.
The part that should worry everyone most is the planned mass exploitation. Pair a zero-day with scripted attacks at volume, and AI has effectively repriced vulnerability development — out of elite-team budget territory and down to what an ordinary criminal enterprise can afford.
The Evidence Behind the AI Attribution
The forensic trail here is unusually tangible. The exploit is riddled with educational docstrings, one of which documents a hallucinated CVSS score — a number the code miscomputed and then wrote into its documentation regardless. The overall design is Python straight out of a textbook: exhaustive help menus and a tidy _C class for ANSI colors, exactly the fingerprints LLM training data tends to leave.
The vulnerability class itself is the subtler clue. Scanners cope reasonably well with memory-safety and injection flaws, but a dormant logic error that “appear[s] functionally correct” slips past them almost entirely. Reading source code, weighing the developer’s stated intent against the shipped implementation, and dragging unnoticed corner cases out of version history — that is the contextual reasoning frontier LLMs are built for. What AI changes is not the speed of exploit writing; it is access to a whole category of bug that used to be practically unfindable.
Malware That Morphs Itself, Backdoors That Run on Gemini
The report also charts how far AI has worked its way into attack tooling. PROMPTFLUX rewrites its own source code just-in-time while executing. HONESTCUE calls the Gemini API to cook up VBScript obfuscation payloads on demand, leaving static signatures empty-handed. CANFAIL — Russia-nexus, aimed at Ukraine — has an LLM generate realistic-looking decoy logic that does nothing, and LONGSTREAM conceals a downloader inside admin-style code that reads coherently but performs no real function.
The most fully realized specimen is PROMPTSPY, an Android backdoor that ESET was first to identify. Its GeminiAutomationAgent module reaches gemini-2.5-flash-lite over HTTP POST, hands the model an XML serialization of the victim’s UI hierarchy from the Accessibility API, and translates the replies into simulated CLICK and SWIPE gestures; the prompt wears a benign persona to slip past safety filters. The backdoor captures PIN and pattern unlocks for replay, shields the Uninstall button with an invisible overlay to intercept taps, stays resident through FCM wake-ups, and rotates its C2, Gemini API keys, and VNC relay while running. Google has shut down the associated infrastructure and verified that no infected apps made it into the Play store. The report further logs APT45 sending thousands of repetitive prompts to recursively analyze CVEs and validate PoCs, and TeamPCP going after Trivy, Checkmarx, and LiteLLM through PyPI packages and malicious PRs — the same supply-chain playbook as the recent autonomous npm worm.
Three Lessons for Defenders
First, write logic flaws into your threat model. Semantic defects are home ground for AI-assisted attack, so code review and threat modeling need to explicitly account for hardcoded trust assumptions. Second, the attack surface is on the move. Malware that rewrites itself mid-execution and backdoors driven by cloud LLMs drain static signatures and one-shot forensics of their worth, turning behavioral detection and runtime sandboxes into baseline requirements. Third, the defense holds weapons of equal caliber: Google’s Big Sleep has already used AI to get ahead of attackers, finding vulnerabilities a threat actor was on the verge of exploiting, while CodeMender automates the patching pipeline. AI multiplies whichever side wields it well; losing is what happens to the side that falls behind.