Google Detects First Known Use of AI to Help Create a Zero-Day Exploit in Open-Source Tool

Google issued a warning on Monday that artificial intelligence had helped criminals successfully develop a zero-day exploit for the first time. The tech giant’s security researchers found evidence that hackers had created such an exploit targeting an unnamed open-source, web-based IT admin tool.

A mass vulnerability exploitation operation targeting the tool was in the works before Google stopped the attack by alerting the vendor.

Zero-day exploits are small programs that target previously-unknown and unpatched vulnerabilities to install malware and access data. The malicious code showed a number of signs that artificial intelligence helped write it. The code was structured in a way highly characteristic of AI, including a textbook use of the Python language and detailed help menus not typically seen in human-written programming.

It also contained an AI hallucination referencing a vulnerability that did not exist. Google said it had discovered hackers working for Chinese and North Korean intelligence using its Gemini AI chatbot to research potential cyberattack targets. In one case, the Chinese-linked cybercrime group UNC2814 tricked Gemini by asking it to act like a network security expert, after which Gemini agreed to look for vulnerabilities in TP-Link routers.

U.S. for security reasons. John Hultquist, chief analyst of the Google Threat Intelligence Group, said North Korea was a very early adopter of AI. He said North Korea was moving from phishing to developing cyberattacks on company and government networks.

“It’s interesting because this is an area where they have typically not focused, preferring to do social engineering,” Hultquist said. ” Google’s discovery of an AI zero-day exploit is the latest in a growing number of instances where hackers used AI as a kind of cybercriminal copilot.