Hackers weaponize AI for zero-day exploits, Google warns

For years, cybersecurity teams warned that generative AI would lower the bar for junior hackers. Now, the ceiling is officially rising, too.

Google's Threat Intelligence Group (GTIG) revealed that a cybercrime actor used an AI model to discover and weaponize an unpatched zero-day vulnerability in a popular open-source system administration tool. It marks the first time GTIG has caught a threat group actively building a zero-day exploit with AI for an intended mass-exploitation campaign.

The script included a hallucinated CVSS score

The targeted flaw was a two-factor authentication bypass. It was not a classic memory corruption bug or missing input check that traditional fuzzers easily spot. Instead, it was a high-level semantic logic flaw caused by hardcoded trust assumptions left behind by developers.

Frontier LLMs excel at parsing contextual intent, making it easy to spot contradictions between authentication logic and hardcoded exceptions. GTIG knew AI was behind the exploit script because the code retained obvious machine footprints: textbook Pythonic formatting, elaborate help menus, clean ANSI color classes, and docstrings featuring a hallucinated CVSS vulnerability score.

State-sponsored actors are industrializing similar tactics. GTIG observed China-linked group UNC2814 using persona prompts to trick models into acting as senior security auditors to dissect firmware. Another group fed an AI model a Claude code plugin packing 85,000 historic vulnerabilities from the archived Chinese bug bounty platform WooYun to sharpen its hunting instincts.

Meanwhile, North Korea-linked APT45 sent thousands of automated, recursive prompts to validate PoC exploits across CVEs. Russian actors are using AI to craft polymorphic malware, while autonomous malware like PROMPTSPY is now reading target system environments on the fly to generate its own next commands.

Why it matters

We think this shifts the fundamental calculus of software security. Finding zero-days used to require elite domain expertise, significant time, and deep budgets. By using LLMs to read developer intent and pairing them with distilled vulnerability datasets, adversaries are automating logic-flaw discovery that legacy fuzzers and static analyzers miss entirely.

For enterprise defense and software maintainers, this is an immediate headache. Your static scanners might clear a repository because the code compiles cleanly and sanitizes inputs, but an attacker's LLM can spot that a hardcoded exception undermines the entire auth chain in seconds. If autonomous tools like PROMPTSPY can dynamically adapt to local environments without calling home, static signature detection is essentially dead on arrival.

The clever part of the attacker playbook is not raw model power, but orchestration: chaining automated account cycling to bypass usage limits, feeding models specialized real-world breach archives, and testing payloads inside agentic sandboxes like OpenClaw. Defenders have no real choice but to fight automation with automation, leaving teams that lack dedicated AI security tooling at a widening disadvantage.