On May 12, 2026, Google’s Threat Intelligence Group (GTIG) published a report announcing a milestone of the worst kind: for the first time, it identified a threat actor holding a zero-day exploit believed to have been developed with AI. The target was a popular open-source, web-based system administration tool, and the flaw bypasses two-factor authentication. GTIG judged that the actor was planning a mass exploitation event — and that Google’s proactive counter-discovery “may have prevented its use.”
This is not a lab thought experiment. The report draws on Mandiant incident response data and Gemini telemetry, and extends a February 2026 study from the same team. It is official confirmation that AI-generated exploit code has moved from theory into the wild. For security and engineering teams, the question is no longer “can LLMs write exploits” but “which of your defensive assumptions just expired.”
The First AI-Developed Zero-Day
The details matter. The vulnerability is not a classic memory-corruption or input-sanitization bug. It is a high-level semantic logic flaw — a hardcoded trust assumption — that lets an attacker with valid credentials bypass 2FA. GTIG assessed with high confidence that an AI model generated the exploit, explicitly noting that Gemini was not the model involved. The group worked with the vendor on responsible disclosure, which is why the product stays unnamed.
The planned mass exploitation is the most alarming part. A zero-day plus a scripted, high-volume campaign means AI has pushed the cost of vulnerability development from elite-team budgets down to criminal-enterprise levels.
How Google Concluded an AI Model Wrote It
The forensic signals are refreshingly concrete. The exploit carried an abundance of educational docstrings — including a hallucinated CVSS score, a rating the code computed incorrectly and then documented anyway. The overall structure is textbook Pythonic: detailed help menus and a clean _C ANSI color class, hallmarks of LLM training data.
The deeper signal is the vulnerability type itself. Traditional scanners are decent at memory-safety and injection issues but nearly blind to dormant logic errors that “appear functionally correct.” Contextual reasoning is exactly where frontier LLMs excel: reading source code, comparing a developer’s intent against the actual implementation, and surfacing corner cases nobody noticed across version history. AI does not just write exploits faster — it finds a different class of bug.
Self-Morphing Malware and Gemini-Powered Backdoors
The same report maps how AI is embedding itself into attack tooling. PROMPTFLUX rewrites its own source code just-in-time at runtime. HONESTCUE queries the Gemini API to generate VBScript obfuscation payloads on the fly, evading static signatures. CANFAIL uses LLM-generated decoy logic (Russia-nexus, targeting Ukraine), while LONGSTREAM buries a downloader inside coherent but inert admin-style code.
The most complete specimen is PROMPTSPY, an Android backdoor first spotted by ESET. Its GeminiAutomationAgent module calls gemini-2.5-flash-lite over HTTP POST, feeding the model an XML serialization of the victim’s UI hierarchy from the Accessibility API and parsing responses into simulated CLICK and SWIPE gestures — with a benign persona baked into the prompt to slip past safety filters. It captures PIN and pattern unlocks for replay, intercepts taps on the Uninstall button with an invisible overlay, persists via FCM wake-ups, and rotates its C2, Gemini API keys, and VNC relay at runtime. Google has disabled the actor’s infrastructure and confirmed no infected apps reached the Play store. Elsewhere, the report logs APT45 running thousands of repetitive prompts to recursively analyze CVEs and validate PoCs, and TeamPCP hitting Trivy, Checkmarx, and LiteLLM through PyPI packages and malicious PRs — the same supply-chain trend as the recent autonomous npm worm.
What Defenders Should Take Away
Three practical conclusions. First, put logic flaws in your threat model: semantic defects are the home turf of AI-assisted attack, so code review and threat modeling must explicitly cover hardcoded trust assumptions. Second, the attack surface is shifting — when malware rewrites itself at runtime and backdoors are driven by cloud LLMs, static signatures and one-shot forensics lose value fast, making behavioral detection and runtime sandboxes table stakes. Third, defenders hold symmetric weapons: Google points to Big Sleep, which has used AI to preemptively find vulnerabilities a threat actor was about to exploit, and CodeMender, which automates the patching pipeline. AI amplifies offense and defense alike; only the side that falls behind loses.
Sources
- Google reports first known real-world AI-crafted zero-day exploit — Google Cloud Blog
- Google finds first AI-developed zero-day that bypasses 2FA — Tom’s Hardware
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.