GTIG: First Confirmed AI-Assisted Zero-Day — High Confidence, Model Unnamed
Google’s Threat Intelligence Group documents the first publicly confirmed cybercrime zero-day developed with AI assistance — a 2FA bypass in a popular open-source web admin tool, patched before mass exploitation. High-confidence LLM fingerprints; model unnamed. Same day as OpenAI Daybreak.
AI-assisted offense left the whitepaper phase. GTIG’s claim is carefully scoped: first publicly confirmed case with strong evidence — not “first ever” — and the model used is not named.
Google Threat Intelligence Group (May 11) published an AI Threat Tracker report documenting a cybercrime actor using AI to discover and weaponize a zero-day — a 2FA bypass via a logic flaw (hardcoded trust assumption) in a widely used open-source web administration tool. The actor planned mass exploitation; Google worked with the vendor to patch before deployment. GTIG assesses high confidence that an AI model assisted throughout discovery and weaponization.
The zero-day case
Implemented as a Python script exploiting a high-level semantic logic error rather than classic memory corruption. LLM-indicative traits cited: abundant educational docstrings, a hallucinated CVSS score, textbook Pythonic structure with clean formatting and detailed help menus, patterns consistent with LLM training data. GTIG notes this is likely not the first such case but is the first publicly confirmed with strong evidence.
State-sponsored and broader tactics
PRC- and DPRK-linked clusters: persona-driven jailbreaking, distilled vulnerability datasets (e.g. wooyun-legacy scale), high-volume recursive CVE/PoC prompting, agentic tooling. Broader tracker themes: AI obfuscation/polymorphism (PROMPTFLUX, HONESTCUE, CANFAIL, LONGSTREAM), autonomous malware (PROMPTSPY), information ops, supply-chain attacks on AI environments (TeamPCP/UNC6780), obfuscated premium-LLM access middleware. Defenders (including Google’s Big Sleep and CodeMender) apply similar techniques.
Claims vs checks
Findings are GTIG primary — threat-intel confidence language, not a courtroom attribution of a specific lab model. Same-day OpenAI Daybreak launch is the defensive counterpart on the calendar. Traditional techniques remain in play; AI is one factor.
Limits
- Specific model unnamed.
- “High confidence” is GTIG’s assessment standard — not third-party re-analysis of the exploit corpus.
- Threat landscape evolves faster than any single tracker snapshot.
Sources
- Google Cloud / GTIG: “Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access” (May 11, 2026).
- CyberScoop, Krebs on Security follow-ups (May 11, 2026).