Ledger / May 2026
Criminals build 2FA-bypass zero-day with AI for planned mass exploitation
Strong
GTIG assesses LLM authorship with high confidence from artifacts such as a hallucinated CVSS score; no model is named.
GTIG found a Python zero-day exploit that bypasses 2FA via a hardcoded trust assumption and believes an AI model helped find and weaponize it. It is GTIG's first identified AI-developed zero-day. Google does not name the group or the product.
“For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessGoogle Threat Intelligence Group · 11 May 2026 · primary source
- AI risk and resilience in 2026: A Mandiant special reportMandiant / Google Cloud · 15 Sep 2026 · primary source
- Date
- May 2026
- Disclosed
- 11 May 2026
- Actor
- Unnamed prominent cybercrime actors (criminal), as attributed by Google Threat Intelligence Group
- Targets
- Popular open-source web-based system administration tool (unnamed)
- What the AI did
- Vuln research, Exploit dev
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- Exploit disrupted before the planned mass exploitation; vendor notified.