Google detects AI-developed zero-day exploits in cyberattack attempt
Google reported that its threat intelligence team detected hackers using commercial AI tools to develop zero-day exploits targeting two-factor authentication systems. The threat actors, linked to multiple nation-states, successfully shifted AI-based hacking from an emerging threat to widespread industry-scale attacks within three months, though Google said it proactively prevented the specific attacks it discovered.
What happened
Google's Threat Intelligence Group detected hackers using AI models to plan and execute large-scale zero-day vulnerability exploitation attacks targeting two-factor authentication processes.
The report identified that threat actors used commercial AI tools such as OpenClaw to discover zero-day vulnerabilities—software flaws unknown to developers—to target companies, government institutions, and other organizations.
Groups linked to China, North Korea, and Russia have shown significant interest in using AI to discover vulnerabilities, according to Google's findings.
Reported impact
Within three months, AI-based hacking practices evolved from an early threat into industry-scale attacks, according to Google's threat intelligence team.
The capability of AI to automatically write code has made exploitation of software vulnerabilities faster, more widespread, and harder to detect compared to conventional methods.
Index analysis
Google stated the AI model used was not its own Gemini model. Anthropic previously delayed the mass release of its advanced model Mythos due to concerns it could be misused by cybercriminals to identify vulnerabilities.
Anthropic stated that Mythos is capable of finding zero-day vulnerabilities in all major operating systems and web browsers, determining the discovery required coordinated defensive action.
OpenAI announced GPT-5.5-Cyber, a variant of its latest AI model currently under limited review by cybersecurity teams with specialized capacity.
Governance controls
Google stated it proactively prevented the planned hacker attacks. The White House held a special meeting with business leaders and technology executives to discuss the threat.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.