Google Finds First Evidence of Hackers Using AI to Develop Zero-Day Attack

Google's Threat Intelligence Group (GTIG) said attackers are expanding their use of generative AI beyond writing phishing emails and malware to finding software vulnerabilities and generating attack tools. The case marks the first time Google has obtained evidence that AI helped develop a zero-day exploit that was deployed in a real-world attack, increasing pressure on companies to patch vulnerabilities and strengthen defenses more quickly.

Google disclosed on May 12 that hackers had used AI to identify a zero-day vulnerability and build an exploit, aiming to bypass two-factor authentication (2FA) and deploy it at scale. Google intervened to help block the attack. GTIG also identified state-backed hacking groups from North Korea, China and other countries as users of AI agent tools to accelerate attacks. It did not disclose the number of victims, financial losses or details of the vulnerability.