Google Disrupts AI-Assisted Zero-Day Targeting Web Administration Platform

Google’s Threat Intelligence Group said it detected and disrupted what it described as the first observed zero-day exploit likely developed with artificial intelligence assistance, targeting a widely used open-source web administration platform. The flaw reportedly involved a semantic logic weakness in the platform’s two-factor authentication flow, and Google said the exploit appeared intended for mass exploitation before the vendor was notified and issued a patch. Researchers cited indicators of LLM involvement in the exploit code, including unusually didactic docstrings, textbook-style formatting, and even a hallucinated CVSS score, while noting they had high confidence an AI model helped both identify the vulnerability and weaponize it.

The incident comes amid broader evidence that AI is becoming embedded across the attack lifecycle. Google and other researchers reported threat actors using large language models for reconnaissance, phishing preparation, troubleshooting, malware development, and increasingly autonomous attack orchestration, including malware able to assess victim environments and execute commands with less human oversight. Check Point Research separately described the VoidLink Linux malware framework as an example of AI-assisted malware development at operational scale, with a single developer allegedly producing more than 88,000 lines of code in under a week using an AI-powered IDE, while other reporting linked China-, North Korea-, and Russia-aligned activity to AI-enabled exploit research, decoy code, voice cloning, and Android malware automation.