Google Confirms First AI-Written Exploit: Criminal Group Used LLM to Find and Weaponize 2FA Zero-Day

Google’s Threat Intelligence Group (GTIG) has confirmed what security researchers have been dreading: a criminal organization used a large language model to independently identify and weaponize a zero-day vulnerability—marking the first publicly documented case of AI authoring a functional exploit for a previously unknown flaw.

The vulnerability lived in a popular open-source web-based system administration tool. It was a semantic logic error in the authentication flow: a developer had hardcoded a trust assumption that directly contradicted the application’s 2FA enforcement. Traditional static analysis scanners missed it entirely because the bug required reasoning about the relationship between two separate code paths, not just pattern matching.

The AI found it anyway.

GTIG identified the AI’s authorship through the structure of the Python exploit script the group deployed. The code was littered with extensive educational docstrings, a hallucinated CVSS severity score the LLM invented, structured help menus, and formatting too clean and consistent to have come from a human in a hurry. These are characteristic artifacts of LLM-generated code when the prompt includes instructions like “explain what you’re doing” or “make this usable.”

The group’s intended target was mass 2FA bypass—not a surgical attack against a single organization, but an automated exploitation campaign against every exposed instance of the affected tool. GTIG’s intervention disrupted the campaign before it launched. Responsible disclosure to the affected vendor has been completed, and a patch is available.

This matters beyond the immediate incident. For years, security researchers have debated whether AI would meaningfully lower the bar for finding zero-days. The answer is now empirically yes—at least for logic-level authentication flaws in code with sufficient public training data. The human bottleneck in exploit development has historically been the time required to read and reason about unfamiliar codebases. LLMs eliminate that bottleneck for a category of vulnerabilities that humans routinely overlook because the bug requires holding multiple code paths in mind simultaneously.

What’s concerning is the profile of the attacker. This wasn’t a nation-state APT with unlimited resources—it was a criminal group. The democratization of zero-day discovery was supposed to be a decade away. It’s here.

Google’s full AI Threat Tracker report covers five categories of AI-enabled threat activity, including AI-generated phishing at scale, AI-assisted OSINT, and AI-accelerated malware obfuscation. The zero-day finding is the most significant because it represents AI operating in a domain previously gated by deep technical expertise.

What you should do now: Audit any self-hosted system administration panels (Webmin, phpMyAdmin, Cockpit, similar tools) for pending security updates. Check vendor advisories. Enable network-level access controls so these tools are never exposed to the public internet—they’re a disproportionate target regardless of this specific incident.

The era of AI-assisted vulnerability research is not coming. It arrived.