Google says it has intercepted what it believes is the first zero-day exploit in the wild built with the help of generative AI. The Google Threat Intelligence Group (GTIG) disclosed on May 11, 2026 that it disrupted an attack targeting two-factor authentication on an unnamed open-source, web-based system administration tool, after spotting tells in the exploit's Python script that pointed to a large language model.
GTIG described the attackers as 'prominent cyber crime threat actors' preparing a 'mass exploitation event.' The exploit took advantage of what Google's researchers called 'a high-level semantic logic flaw where the developer hardcoded a trust assumption' in the platform's 2FA system — a class of bug that requires reading code semantically, not just pattern-matching.
What gave the AI authorship away was sloppy. Google's researchers flagged a 'hallucinated CVSS score' inside the script — an invented severity rating of a kind that LLMs routinely fabricate — alongside 'structured, textbook' formatting consistent with LLM training data. In other words, the exploit was written the way a chatbot writes, with confident citations of things that don't exist.
Key facts
- 01Google Threat Intelligence Group disclosed on May 11, 2026 the first zero-day exploit it has tied to AI-assisted development.
- 02The exploit targeted two-factor authentication on an unnamed open-source, web-based system administration tool.
- 03GTIG said 'prominent cyber crime threat actors' were preparing a 'mass exploitation event' before Google disrupted it.
- 04Tells in the Python script included a 'hallucinated CVSS score' and 'structured, textbook' formatting consistent with LLM output.
- 05Google said it 'does not believe Gemini was used' to build the exploit.
Google said it 'does not believe Gemini was used' to produce the code. The company did not name a suspected model. The disclosure lands weeks after the publication of a Linux vulnerability found with AI assistance and amid wider discussion of cybersecurity-focused AI systems like Anthropic's Mythos, which the European Central Bank cited last week as a class of tool it is studying defenses against.
“Google researchers flagged a 'hallucinated CVSS score' and 'structured, textbook' formatting in the Python script — telltale signs the exploit was drafted by a large language model.”— Jaeden Schafer
GTIG's report sketches a broader pattern. Hackers are running 'persona-driven jailbreaking' — prompting AI systems to behave as a security expert in order to extract vulnerability research — and are feeding whole repositories of vulnerability data into models to mine for weaknesses. Google also pointed to use of OpenClaw in ways that suggest 'an interest in refining AI-generated payloads within controlled settings to increase exploit reliability prior to deployment.'
The defensive picture is messier than the offensive one. GTIG noted that 'adversaries increasingly target the integrated components that grant AI systems their utility, such as autonomous skills and third-party data connectors.' That is the surface area expanding fastest in 2026 — agentic tools, browser-using assistants, MCP servers, retrieval connectors — and it is being mapped by attackers at the same time vendors are shipping it.
Google's framing is that AI lowers the floor for exploit development rather than raising the ceiling. A skilled attacker did not need an LLM to find a hardcoded trust assumption in a 2FA flow. But a less skilled one, with access to a model that will draft a Python proof-of-concept, can now produce working exploit code faster than before. Google describes that as a shift in volume, not in sophistication.
There are caveats worth holding onto. Google did not publish the script, did not name the targeted tool, and did not identify the threat actors. The CVSS-score hallucination is suggestive evidence of LLM involvement, not proof — a human author copying from a model's output would leave the same fingerprints, and a human author imitating LLM style could fake them. The disclosure is also Google's own account of an incident it disrupted, which limits independent verification.
For the AI industry, the report sharpens a tension that has been building all year. Frontier labs are racing to ship coding agents capable of writing, running, and patching software end-to-end — the same capability set that, pointed sideways, drafts exploit code. Anthropic has leaned into the offensive-security angle with Mythos. Google's own GTIG disclosure is, in part, a marketing argument that the same model capabilities, defended properly, catch the attackers using them. The next year of AI security policy will be written around which of those framings holds up under more incidents like this one.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
