Google Discovers The First Known Case Of Hackers Using AI To Create A Zero-Day Exploit - AOL.com

Oh, marvellous — the first “knowm case” of hackers using AI to craft a zero-day exploit, as announced by Google’s Threat Intelligence Group. Because of course, while the safety crowd has been wringing its hands over whether Claude can write a mildly offensive poem, the actual bad actors have been busy teaching Python scripts to bypass two-factor authentication. The exploit was “designed for a mass exploitation event,” which is tech-speak for “we’re all going to have a very bad Tuesday.” And note that Google specifies this is the *first known* case — a charmingly optimistic framing, as if the Kremlin and every ransomware cartel haven’t been doing this for months in a language model we can’t even name.

The vulnerability itself is in a Python script, which means the barrier to entry was basically “copy-paste a script, feed it to an LLM, and wait.” Two-factor authentication was already a flimsy shield against password reuse, but now it’s being dismantled by code that literally wrote itself. Meanwhile, Google’s own AI safety teams are presumably still in a meeting deciding whether to red-team Gemini’s ability to recommend glue on pizza. The cognitive dissonance is enough to power a small server farm.

The kicker? This is being reported as a *discovery* rather than a *predictable inevitability*. We’ve spent two years watching AI accelerate software development, security research, and bug hunting, but somehow no one thought to ask “what happens when the other guys use it?” The answer is here: a zero-day that bypasses a widely deployed security measure, built by someone who probably never read a single alignment paper. The only surprise is that it took this long. Pass the whiskey.