Google says it found the first zero-day it believes was developed with AI — and it was a logic flaw, not a memory bug

Google Threat Intelligence Group published its AI Threat Tracker on 12 May 2026, and buried in it is a first:

For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.

The detail underneath that sentence is more useful than the sentence.

What the vulnerability was

A 2FA bypass in a popular open-source, web-based system administration tool. GTIG does not name it.

The nature of it is the point:

It stems not from common implementation errors like memory corruption or improper input sanitization, but a high-level semantic logic flaw where the developer hardcoded a trust assumption.

That is not the kind of bug automated tooling finds. GTIG says so directly:

While fuzzers and static analysis tools are optimized to detect sinks and crashes, frontier LLMs excel at identifying these types of high-level flaws and hardcoded static anomalies… they have an increasing ability to perform contextual reasoning, effectively reading the developer's intent to correlate the 2FA enforcement logic with the contradictions of its hardcoded exceptions.

A fuzzer finds a crash. It cannot find "the developer wrote an exception here that contradicts the rule they wrote there", because nothing crashes. That requires reading intent.

Note the caveat on the bypass itself: it requires valid user credentials first. It is a bypass of the second factor, not of authentication.

How Google knows AI was involved

It does not, exactly, and it says so:

Although we do not believe Gemini was used, based on the structure and content of these exploits, we have high confidence that the actor leveraged an AI model

The tells were in the artefact: a Python script with educational docstrings, a hallucinated CVSS score, and a structured Pythonic format.

A hallucinated severity score in a working exploit is a good detail. It is the sort of thing a model adds because exploit write-ups usually have one, and that a human exploit developer would not bother inventing.

GTIG disclosed to the vendor and says its proactive counter discovery may have prevented its use in a planned mass-exploitation campaign.

The actors, and what they actually used AI for

Five PRC-nexus groups are named, and none of the use cases are exotic:

Two of those five are about getting cheap access to models, not about capability. That is worth noticing. A meaningful share of observed "AI threat activity" is threat actors solving the same billing problem everyone else has.

Also named: TeamPCP/UNC6780, which compromised PyPI and GitHub — the campaign behind the poisoned LiteLLM releases — and Operation Overload, a pro-Russia influence campaign using suspected AI voice cloning to impersonate journalists.

The malware is where AI is genuinely load-bearing

Six families, and the design of one of them is a real shift.

PROMPTSPY — an Android backdoor that calls the Gemini API to drive the device itself. Its agent module serialises the device's UI hierarchy to XML via the Accessibility API, posts it to gemini-2.5-flash-lite, and executes the returned CLICK and SWIPE instructions at the coordinates the model computes.

It captures and replays biometric authentication, draws invisible overlays over uninstall buttons, and updates its C2, Gemini API keys and VNC relays at runtime.

That is malware that navigates an unfamiliar app by looking at it, rather than by having its screens hardcoded. It is the difference between a script and an operator.

The others: PROMPTFLUX (dynamic code modification via LLM), HONESTCUE (VBScript obfuscation via the Gemini API), CANFAIL and LONGSTREAM (decoy logic for evasion), and SANDCLOCK (a credential stealer delivered through the TeamPCP supply-chain compromises).

Google says no app containing PROMPTSPY was found on Google Play, and Play Protect covers known versions.

Google's own limits on the story

GTIG is notably restrained, and the restraint is the most quotable part:

Throughout early 2026, we observed that threat actors have not yet achieved breakthrough capabilities to bypass the core security logic of frontier models.

On influence operations:

we have not identified this generated content in the wild, and none of these attempts have created breakthrough capabilities for IO campaigns.

And on where the AI advantage actually applies: LLMs excel at semantic logic flaws but struggle to navigate complex enterprise authorization logic.

So the honest summary is narrow. AI found one class of bug that traditional tooling is bad at. It did not make attackers generally better.

The other half: Google is doing the same thing

Two of its own agents get named. Big Sleep, which found a real-world vulnerability Google says was "imminently going to be used by threat actors". And CodeMender, an experimental agent that automatically fixes critical code vulnerabilities.

That is the actual shape of this. The capability that found a hardcoded trust assumption in an open-source admin tool is available to whoever runs it, and both sides are running it.

What to take from it

• Audit for the bug class, not the tool. Hardcoded exceptions in authentication logic, trust assumptions in config parsing, contradictions between an enforcement rule and its carve-outs. These survived years of fuzzing because fuzzing cannot see them.
• Your 2FA implementation is the place to look first. That is where this one was.
• Treat "AI-assisted" claims sceptically and read the caveats. GTIG has "high confidence" from artefact structure, and says outright it does not think its own model was used.
• Watch Accessibility-service permissions on Android fleets. PROMPTSPY's entire capability rests on that one grant.
• Do not over-read this. One zero-day, one bug class, and a vendor that says the frontier models have not been broken.