Hackers Used AI to Build a Zero-Day Exploit That Bypasses Two-Factor Authentication: Google

In brief

• Google's Threat Intelligence Group confirmed that cybercriminals used AI to develop a zero-day exploit targeting a popular open-source web administration tool.
• Google said this is the first time the company has identified AI-assisted zero-day development in the wild.
• Google worked with the affected vendor to patch the vulnerability before the campaign scaled, but said threat actors linked to China and North Korea are also actively using AI for vulnerability research and exploit development.

Cybercriminals used an AI model to discover and weaponize a zero-day vulnerability in a popular open-source web administration tool, according to Google’s Threat Intelligence Group.

In a report published Monday, Google said the flaw let attackers bypass two-factor authentication, and warned that the attackers were preparing a mass exploitation campaign before the company intervened. It is the first time Google has confirmed AI-assisted zero-day development in the wild.

“As the coding capabilities of AI models advance, we continue to observe adversaries increasingly leverage these tools as expert-level force multipliers for vulnerability research and exploit development, including for zero-day vulnerabilities,” Google wrote. “While these tools empower defensive research, they also lower the barrier for adversaries to reverse-engineer applications and develop sophisticated, AI-generated exploits.

The report comes as researchers and governments warn that AI models are accelerating cyberattacks by helping hackers find vulnerabilities, generate malware, and automate exploit development.

“Though frontier LLMs struggle to navigate complex enterprise authorization logic, they have an increasing ability to perform contextual reasoning, effectively reading the developer's intent to correlate the 2FA enforcement logic with the contradictions of its hardcoded exceptions,” the report said. “This capability can allow models to surface dormant logic errors that appear functionally correct to traditional scanners but are strategically broken from a security perspective.”

According to Google, the unnamed attackers used AI to identify a logic flaw where the software trusted a condition that bypassed its two-factor authentication protections. Unlike traditional scanners that search for broken code or crashes, the AI analyzed how the software was intended to work and detected the contradiction, allowing attackers to bypass the security check without breaking the encryption itself.

“AI-driven coding has accelerated the development of infrastructure suites and polymorphic malware by adversaries,” Google wrote. “These AI-enabled development cycles facilitate defense evasion by enabling the creation of obfuscation networks and the integration of AI-generated decoy logic in malware that we have linked to suspected Russia-nexus threat actors.”