Chronicle/Attacks & incidents

Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use

May 11, 2026AttackMisuse reportSignificance assistant-drafted

Google Threat Intelligence Group reported that cybercriminals planned a mass-exploitation campaign using a two-factor-authentication bypass in an open-source web administration tool, and assessed with high confidence that an AI model supported discovery and weaponization of the flaw. GTIG worked with the vendor on disclosure and disrupted the activity. The same report describes PRC-nexus actors using agentic frameworks such as Hexstrike and Strix for reconnaissance and vulnerability validation, and Android malware (PROMPTSPY) that calls Gemini to drive the device UI.

Why it matters

GTIG calls it the first identified instance of a zero-day exploit it believes was AI-developed by cybercrime actors.

Key facts

As stated in the sources, with where to find them.

GTIG assessed with high confidence that an AI model supported discovery and weaponization of a 2FA-bypass logic flaw; it states it does not believe Gemini was used.AI-developed zero-day section
A suspected PRC-nexus actor used Hexstrike (with a knowledge-graph memory) and the Strix multi-agent pentest framework against a Japanese technology firm and an East Asian security platform.Hexstrike and Strix section
UNC6780 (TeamPCP) supply-chain compromises touched repositories including LiteLLM, Trivy and Checkmarx.Supply chain section

Findings that cite this record

May 11, 2026

Google's threat intelligence team attributes to AI the development of a zero-day exploit that criminal actors prepared for mass exploitation, based on characteristics of the code.

Reportedreported1 evidence record

Key questions this bears on

Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
How are attackers using AI agents in real operations?Increasingly to run parts of intrusions: providers and vendors report agent-driven espionage, extortion and credential theft, and malware that queries LLMs.

Sources

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial AccessGoogle Cloud Blog (GTIG)May 11, 2026Primary sourceAccessed Sep 25, 2026
AI Risk and Resilience: September 2026MandiantSeptember 2026Primary sourceAccessed Sep 25, 2026

Related records

Sep 8, 2026

Google reports attackers moving from prompting to agentic workflows, including a six-hour automated campaign

AttackMisuse reportGoogle Threat Intelligence Group, Mandiant

Nov 5, 2025

Google reports malware that queries LLMs during execution, including APT28's PROMPTSTEAL

AttackMisuse reportGoogle Threat Intelligence Group, APT28

Jan 29, 2025

Google finds government-backed hackers using Gemini for support tasks, not novel capabilities

AttackMisuse reportGoogle Threat Intelligence Group, Google

Aug 27, 2025

Anthropic reports Claude Code used to run a data-extortion campaign against at least 17 organizations

AttackMisuse reportAnthropic

Sep 16, 2026

Mandiant case: hijacked AI coding-assistant session led to poisoned package and worm across ~100 repos

AttackIncidentMandiant

September 2026

ENISA Threat Landscape 2026 expects more kill-chain phases enabled by AI in 2026

PolicyGuidanceENISA

Organizations: Google Threat Intelligence Group, UNC6780 (TeamPCP)
Topics: AI-enabled intrusion Exploit development AI malware Threat intelligence
Attack surface: Agent model Supply chain
Methods: AI-assisted vulnerability exploitation Malicious packages, skills, and extensions
Benchmarks and tools: Gemini
Record: gtig-ai-developed-zero-day-2026 · added 2026-09-25

Cite this record

Fide AI. "Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use." Agentic Cyber Explorer, record gtig-ai-developed-zero-day-2026. https://agentic-cyber-explorer.pages.dev/events/gtig-ai-developed-zero-day-2026/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-gtig-ai-developed-zero-day-2026,
  author = {{Fide AI}},
  title = {Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/gtig-ai-developed-zero-day-2026/},
  note = {Record gtig-ai-developed-zero-day-2026; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.