On May 11, 2026, Google's Threat Intelligence Group reported it had detected the first known instance of a criminal group using artificial intelligence to build a working zero-day exploit. The target was a two-factor authentication bypass in a popular open-source administration tool, prepared for a mass exploitation campaign. AI-augmented attackers are no longer a research demo.
What Google Actually Found
Google Cloud's Threat Intelligence Group (GTIG) published a report detailing the first time it has caught cybercriminals using an AI model to develop a zero-day exploit and prepare it for active deployment.
The exploit was a two-factor authentication (2FA) bypass written in Python and targeting a widely-used open-source, web-based system administration tool. Google has not publicly named the affected vendor, citing responsible disclosure, but worked with the vendor to patch the flaw before the planned attack went live. According to Bloomberg and CNBC reporting on the same day, the criminal threat actor planned to use the exploit in a "mass exploitation event," and Google's intervention likely prevented its use.
John Hultquist, chief analyst at Google's threat intelligence arm, told Fortune that the moment cybersecurity experts had warned about for years has arrived: malicious hackers arming themselves with AI to supercharge their ability to break into the world's computers. Defenders and researchers have been raising this flag for at least two years. As of this month, it is a documented operational reality, not a tabletop scenario.
How Google Knew the Exploit Was AI-Generated
Identifying machine-written code in the wild is harder than it sounds. GTIG attributed AI authorship based on a pattern of forensic markers in the captured exploit script:
- Overly explanatory docstrings. Production exploit code is usually terse and obfuscated. The captured script was heavily commented in a textbook style with educational explanations of each step.
- A hallucinated CVSS severity rating. The script contained a made-up severity score that did not match any real CVE assignment, a tell-tale sign of LLM output.
- Clean, structured Python. The code followed a textbook Pythonic format with detailed help menus and a clean ANSI color class implementation, more like a tutorial than an in-the-wild attack tool.
- Semantic flaw discovery. The vulnerability itself was a hardcoded trust assumption in the tool's login logic, not a memory corruption or input sanitization bug. That kind of high-level reasoning over login flow is exactly what large language models do well.
Google's analysts wrote that they have "high confidence" the threat actor "leveraged an AI model" and that they "do not believe Gemini was used," though they did not name a specific tool.
This Is Not the First AI-Powered Threat Google Has Reported
The May 11 disclosure builds on a pattern GTIG has been tracking for nearly a year. In its November 2025 AI Threat Tracker, Google identified malware families that, for the first time, queried large language models at runtime rather than only during development:
- PROMPTFLUX is a VBScript dropper that calls Gemini's API to rewrite its own source code roughly every hour, asking the model to act as "an expert VB Script obfuscator." The result is a malware family that mutates its own signature on a schedule. The runtime self-rewriting behavior is structurally similar to the legitimate self-improving agent patterns we covered with Anthropic's Dreaming feature, but pointed at evasion rather than capability.
- PROMPTSTEAL is a data theft tool tied to APT28, a Russian state-backed group, that queries an open-source LLM (Qwen2.5-Coder-32B-Instruct) through Hugging Face to generate Windows commands for live data exfiltration.
What changed in May 2026 is the move from runtime LLM use during an attack to LLM authorship of the exploit itself. The first wave used AI as part of an active payload. The second wave is now using AI to discover and weaponize the vulnerability in advance.
We covered the defensive side of this same shift earlier this year when Anthropic's Project Glasswing used the Mythos model to find thousands of zero-days autonomously. The defensive case and the offensive case are converging on the same underlying capability. Whoever runs the cycle faster wins the round.
Why a 2FA Bypass Is the Worst Possible First Demo
The choice of target matters as much as the use of AI. Most enterprise security programs assume that multi-factor authentication is a backstop that materially raises the cost of credential theft and account takeover. A working 2FA bypass on a widely-deployed admin tool collapses that assumption for the specific surface it touches.
A few practical implications:
Compromised credentials become more dangerous. If MFA on a critical admin surface can be bypassed by a single AI-written script, every leaked or phished credential associated with that tool is suddenly back to single-factor risk. Breach response playbooks that lean on "but they did not have the second factor" need to be re-examined.
The attack surface is now research-velocity. Manual vulnerability research takes weeks or months per qualified bug. If AI can compress that to hours for certain classes of semantic logic flaws, the cadence at which new zero-days appear in widely-deployed tools is going to accelerate. Patch programs that assumed a multi-week window between disclosure and exploitation are working from outdated assumptions.
Open-source admin tooling sits in the blast radius. The targeted tool was open source, which made it accessible to the AI for analysis. Most enterprises have unaudited open-source utilities in their stack. The same code that makes those tools transparent and improvable also makes them legible to an attacker's LLM.
The Strategic Picture for Enterprise Buyers
This is a breaking story, not a settled one, but a few strategic points already follow.
AI-augmented attackers are now an assumption, not a hypothesis. Threat models built before May 2026 that treated AI-built exploits as a near-future risk should be updated. The question is no longer whether attackers will use AI at scale, but how fast their advantage compounds before defenders close the gap.
The defender side has the same toolkit. Anthropic's Mythos model and similar systems are now scanning the same open-source code that attackers are scanning. Enterprise security programs that have not yet adopted AI-assisted vulnerability discovery, dependency monitoring, and patch prioritization are giving up symmetric leverage.
MFA hygiene is not a complete answer anymore. MFA still raises the cost of low-skill attacks and remains essential. But programs that treat MFA as a checkbox compliance control rather than one layer of defense in depth are exposed. Detection engineering, anomaly monitoring on admin tools, and assumption auditing matter more than they did six months ago.
Vendor due diligence now includes the AI question. When you renew a security tool, ask the vendor what they have done to harden their own product against AI-assisted bug discovery, and what their disclosure relationship is with frontier labs and groups like GTIG. Vendors who cannot answer have not started thinking about the problem.
What This Does Not Mean
A measured read is important. A few things this story does not establish:
It is not the end of MFA or 2FA. A bypass in one tool does not collapse the MFA model. Most 2FA implementations remain effective, and the right response is layered defense, not abandonment of the control.
It is not a green light for vendor panic. A single confirmed case is a signal, not a base rate. Most organizations will not face an AI-built zero-day this quarter. The right posture is updated threat modeling, not budget restructuring on a one-week news cycle.
It is not a regulatory question yet. GTIG handled responsible disclosure with the affected vendor. There is no current rule requiring enterprises to disclose AI-augmented intrusion attempts specifically. That may change, and our governance framework for growing companies covers how to set up your own internal reporting standards before regulation arrives.
How to Update Your Security Posture This Quarter
Five concrete actions worth scoping in the next ninety days:
- Map your open-source admin and operations tooling. Identify the tools in the same category as the one GTIG flagged: web-based system administration, internal devops, infrastructure consoles, and similar. Confirm patch cadence and named ownership for each.
- Re-validate MFA coverage end to end. Confirm there are no admin paths where MFA can be bypassed via session replay, recovery flows, or first-party tools. Treat MFA as a layer to be tested, not assumed.
- Add detection content for AI-authored payloads. The forensic markers GTIG used (overly explanatory comments, hallucinated CVSS, suspicious docstring patterns) are now legitimate detection signals. Update your endpoint and code-review tooling accordingly.
- Subscribe to a frontier threat intelligence feed. Whether GTIG, Recorded Future, Mandiant, or a peer source, ensure your security team is reading first-party AI threat reporting weekly, not quarterly.
- Review your incident response playbook for AI-specific contingencies. Add scenarios for AI-assisted lateral movement, AI-generated phishing, and AI-augmented vulnerability research. The playbook your team built in 2023 likely does not cover them.
What Vectrel Is Telling Clients
In our advisory work this month, two messages have been consistent. First, the AI security shift is symmetric, so the right answer is matching the attacker's tooling cadence rather than racing to a one-time fix. Second, governance for AI use inside the company is now adjacent to security: the way you control which models touch your code is also the way you control which models could be turned against you.
Key Takeaways
- On May 11, 2026, Google's Threat Intelligence Group reported the first detected AI-built zero-day exploit in active criminal use, targeting a 2FA bypass in a popular open-source admin tool.
- GTIG identified AI authorship through forensic markers: hallucinated CVSS scores, overly explanatory docstrings, and clean Pythonic structure.
- The discovery builds on a November 2025 GTIG report identifying PROMPTFLUX and PROMPTSTEAL, the first malware families to query LLMs during execution.
- A 2FA bypass as the first AI-built zero-day puts pressure on a control most enterprises treat as a baseline assumption.
- Practical response: map open-source admin tooling, re-validate MFA coverage, add detection content for AI-authored payloads, and update incident response playbooks.
Not sure where AI-augmented threats fit in your security roadmap? Book a discovery call and we will help you figure that out, no strings attached.