Google says it has identified what it describes as the first publicly known case of hackers using artificial intelligence to develop a zero-day exploit that can bypass two-factor authentication (2FA) on thousands of servers.
The discovery was disclosed this month by Google’s Google Threat Intelligence Group (GTIG).
According to Google, the attackers targeted a previously unknown flaw in a popular open-source web-based system administration tool. The company did not identify the software vendor or release technical details about the vulnerability.
GTIG said the exploit was designed to bypass 2FA protections after valid user credentials had already been obtained. Two-factor authentication is widely used by banks, companies, and online platforms as an added layer of security beyond passwords.
John Hultquist of Google’s Threat Intelligence Group said the incident shows that AI-assisted cyberattacks are no longer theoretical.
“It’s here,” Hultquist said. “The era of AI-driven vulnerability and exploitation is already here.”
Google said the flaw was discovered in a Python script and involved what it described as a “high-level semantic logic flaw” caused by a hard-coded trust assumption inside the software.
The company said it believes an AI model was used to help discover and weaponize the vulnerability. According to GTIG, the exploit code exhibited characteristics commonly associated with large language model-generated code, including highly structured formatting, detailed help menus, and educational-style code comments.
Google said the script also contained a hallucinated Common Vulnerability Scoring System (CVSS) score, which investigators considered another sign of AI involvement.
The company said it worked with the affected vendor to disclose the vulnerability responsibly and develop a patch before widespread exploitation occurred.
Google did not identify the attackers or say whether they were linked to a government. The company also said there is no evidence that its own Gemini AI model was used in the operation.
Cybersecurity researchers said the case is significant because previous examples of AI-assisted cybercrime mostly involved phishing emails, social engineering, or reconnaissance rather than the creation of working zero-day exploits.
Ryan Dewhurst, Head of Threat Intelligence at watchTowr, said AI is accelerating the pace of cyberattacks.
“Discovery, weaponization, and exploitation are faster,” Dewhurst said. “We’re not heading toward compressed timelines; we’ve been watching the timelines compress for years.”
The reports also noted that no independent organization has publicly verified Google’s technical findings. Neither the Federal Bureau of Investigation nor the Cybersecurity and Infrastructure Security Agency had publicly commented on the incident as of late May 2026.
Google said organizations should continue using 2FA but also strengthen other defenses, including hardware security keys, behavioral monitoring systems, rapid patch management, and network segmentation.
The company warned that AI is increasingly being used in cyber operations for malware development, vulnerability research, and automated attacks, creating what it described as a growing “arms race” between attackers and defenders.
