Google GTIG Reports First AI-Developed Zero-Day for Mass Exploitation

A popular open-source web-based system-administration tool (vendor unnamed) and internet-facing infrastructure running it

A cybercrime actor used a large language model to discover and weaponize a 2FA-bypass zero-day for a planned mass-exploitation campaign; Google Threat Intelligence Group identified and disrupted it through responsible disclosure before use

The LLM reasoned about a hardcoded trust assumption in the tool's 2FA enforcement logic, a semantic flaw that traditional scanners and fuzzers miss; the generated Python exploit carried LLM hallmarks including educational docstrings and a hallucinated CVSS score