Google Thwarts First AI-Developed Zero-Day Targeting 2FA Bypass

A criminal hacking group nearly launched a large-scale cyberattack by exploiting a previously unknown flaw in a popular open-source web administration tool, but Google stopped it before any damage occurred. The attempt stands out because the attackers appear to have used an artificial intelligence model to locate the vulnerability and build working exploit code. Security researchers have long warned that AI could accelerate the discovery of zero-days, which give defenders no time to prepare patches. This case supplies the first concrete evidence that such assistance has moved from theory into practice.

Google’s Threat Intelligence Group examined the Python script and identified several markers consistent with AI generation, including a hallucinated CVSS score that no human analyst would include and unusually structured, textbook-style documentation. The underlying flaw was a high-level logic error: developers had hard-coded a trust assumption inside the two-factor authentication flow, allowing an attacker who already possessed valid credentials to bypass the second factor entirely. Google notified the unnamed vendor, which issued a patch, and the planned mass-exploitation campaign was disrupted. The company stated it does not believe its own Gemini model or Anthropic’s Mythos was involved.

The incident forms part of a wider pattern. Google also documented state-linked groups experimenting with AI for vulnerability hunting and malware development, while noting that defenders are deploying similar tools to find and close flaws faster. John Hultquist, chief analyst at the Threat Intelligence Group, observed that the race between offensive and defensive AI use has already begun. The episode underscores both the immediate risk posed by AI-assisted attacks and the continuing value of rapid vendor coordination once a zero-day is identified.