Google Reports First Observed Zero-Day Exploit Developed With AI Assistance

Google’s Threat Intelligence Group disclosed on May 12, 2026 that it had identified the first zero-day exploit developed with the aid of AI. The vulnerability could have enabled an attacker to bypass two-factor authentication on a popular open-source web-based administration tool.

Prominent cyber threat actors were partnering to exploit it before the group worked with the impacted vendor to disclose the exploit and disrupt the potential attack.

A zero-day exploit is an unpatched vulnerability being seen for the first time. ” Researchers had found at the end of 2025 that common AI tools for productivity could be used to aid cyberattacks.

These tools lowered the skill barrier for attackers, helping them write more sophisticated phishing emails, understand vulnerabilities, and create harmful code. The GTIG report, published on May 12, 2026, highlighted this case as its top finding. Threat actors from China and North Korea have demonstrated significant interest in capitalizing on AI for vulnerability discovery.

One method used is training an LLM with real-world vulnerability cases. A threat actor inputted a database of 85,000 vulnerability cases collected on the Chinese bug bounty platform WooYun between 2010 and 2016. Feeding the 85,000 cases into the LLM allowed it to steer the model to approach code analysis like a seasoned expert and identify logic flaws.

GTIG found a sophisticated shift toward agentic AI-enabled attacks. In an attack against an unnamed Japanese tech firm and prominent East Asian cybersecurity platform, the threat actor used tools that automated identification and validation of vulnerabilities and switched between tools for reconnaissance based on the AI’s internal reasoning.