Google Announces First-Ever Discovery of Zero-Day AI Exploit

We can now add cybercrime to the list of growing concerns associated with artificial intelligence. Google’s Threat Intelligence Group (GTIG) said it has discovered, for the first time, a threat actor using a zero-day exploit that it believes was developed by AI. “Zero day vulnerabilities are often the most dangerous because they are unknown to targets, leaving them with zero days to prepare for the attack.

Google said in the report that the threat actor planned to use it as part of a “mass exploitation event” but that its proactive discovery “could have prevented its use.” Google added that it did not believe its own Gemini models had been used, but that it still had “high confidence” that an AI model was involved in discovering the vulnerability and weaponizing an exploit.

The GTIG report did not identify the target, but said Google notified the unnamed company, which then fixed the problem. Google also did not reveal the malicious actors, but suggested that those associated with China and North Korea had shown “significant interest” in using AI to exploit security vulnerabilities.

Given how quickly AI models have evolved for everyday use, it is no surprise that they are being used for malicious purposes. In an interview with The New York TimesJohn Hultquist, GTIG’s chief analyst, called it “a taste of what’s to come” and “the tip of the iceberg,” adding that this case was only the first “hard evidence” of these types of attacks. Google said in its report that threat actors have used AI at different stages of a cyberattack, but that “AI can also be a powerful tool for defenders.” Like Google, other companies are using AI models to take preventative measures. Last month, Anthropic announced Project Glasswing, an initiative tasked with using Claude Mythos Preview to find and defend against “high-severity vulnerabilities.”