Google says a criminal hacking crew just gave a preview of AI-powered cybercrime. In new research, the company reports with "high confidence" that attackers used an artificial intelligence model to uncover and weaponize a previously unknown security hole in a widely used open-source web admin tool—a so-called zero-day vulnerability, because developers have zero days to fix it. The bug, found in Python code, could have let hackers sidestep two-factor authentication, though they still needed valid user credentials, the New York Times reports. Google says it alerted the software maker in time to get a fix out and declined to name either the product or the hackers.
Cybersecurity experts say it's the first documented case of a zero-day flaw being exploited primarily with help from AI, a shift they've long warned about. Clues that a model was involved included unusually wordy explanatory text embedded in the code, described by former NSA cybersecurity chief Rob Joyce as "the closest thing yet to a fingerprint at the crime scene." The Google Threat Intelligence Group report says researchers also found clues like "hallucinated CVSS scores" that pointed to the use of AI, the Verge reports.
"It's a taste of what's to come," chief Google Threat Intelligence Group analyst John Hultquist tells the Times. "We believe this is the tip of the iceberg. This problem is probably much bigger; this is just the first tangible evidence that we can see." The incident lands as governments debate tighter oversight of advanced AI systems, and as firms like Anthropic tout models capable of finding thousands of flaws across major operating systems and browsers—a capability that could either harden defenses or supercharge attackers.
,
uBlock 
,
and
Ghostery 
)
