---
title: Google Warns of Hackers Using AI to Create Working Zero-Day Exploit
description: AI-driven cyber threats escalate as hackers use AI to build a zero-day exploit, bypass 2FA, and deploy malware globally.
canonical_url: https://codekeeper.co/ticker/ai-driven-cyber-threats-and-zero-day-exploits
---

# Google Warns of Hackers Using AI to Create Working Zero-Day Exploit

AI-driven cyber threats escalate as hackers use AI to build a zero-day exploit, bypass 2FA, and deploy malware globally.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 12, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

The exploit was real, and the plan was mass exploitation. A criminal group built it with AI help; Google's Threat Intelligence Group found it first, worked with the vendor on a fix, and disrupted the operation before it ran. Neither the group nor the tool, a popular open-source web administration platform, has been named. The Python script bypassed 2FA — it needs valid credentials to start — by exploiting a hardcoded trust assumption in the enforcement logic, the kind of semantic flaw scanners miss. GTIG has high confidence an AI model helped: educational docstrings, textbook Pythonic structure, a hallucinated CVSS score. It doesn't believe Gemini was used. State actors are scaling the same approach: China's UNC2814 posed as a binary security expert to get Gemini auditing TP-Link firmware, and North Korea's APT45 fired thousands of recursive prompts at CVEs and PoC exploits. GTIG notes frontier models still struggle with complex enterprise authorization logic. PROMPTSPY is the sharper end: an Android backdoor that reads the on-screen UI, sends it to gemini-2.5-flash-lite, and acts on the JSON commands it gets back — clicking and swiping through the device unsupervised. No PROMPTSPY apps reached Google Play, and Play Protect covers known versions. Russian operators padded CANFAIL and LONGSTREAM with LLM-written decoy code — 32 daylight-saving queries in one downloader — so malware reads as benign. TeamPCP monetised credentials stolen via SANDCLOCK through ransomware partnerships. Google disabled the accounts involved; the Big Sleep agent found the flaw in time, and CodeMender, which proposes fixes, is still experimental. **Source:** [Cybersecurity News](https://cybersecuritynews.com/ai-zero-day-exploit/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fai-driven-cyber-threats-and-zero-day-exploits%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical RCE Flaws in Cursor IDE Let Attackers Escape Sandbox With Zero Clicks Aug 12, 2026](https://codekeeper.co/ticker/cursor-ide-vulnerabilities-remote-code-execution)

[Cyberattacks Chrome Zero-Day Exploit Spread to Four Spy Groups Within Days Sep 10, 2026](https://codekeeper.co/ticker/bluemoon-exploit-kit-targets-chrome-windows)

[Cyberattacks Ceva Logistics Cyberattack Disrupts European Operations, Exposes Customer Data Aug 26, 2026](https://codekeeper.co/ticker/ceva-logistics-cyberattack-disrupts-operations)

[Accenture Confirms Security Incident After Hacker Claims Source Code Theft Aug 12, 2026](https://codekeeper.co/ticker/accenture-data-breach-azure-keys-stolen)