Google's Threat Intelligence Group has uncovered the first zero-day exploit believed to be developed by artificial intelligence, marking a concerning milestone in cyber threats. Zero-day vulnerabilities represent particularly dangerous attacks as they're unknown to targets, leaving no time for preparation. Google's discovery prevented a planned "mass exploitation event" by the threat actor.

The unnamed company received notification from Google and patched the vulnerability. While Google doesn't believe its own Gemini models were involved, the company has high confidence an AI model helped discover and weaponize the exploit. The threat appears linked to actors associated with China and North Korea, who have shown interest in using AI for security exploits.

John Hultquist, GTIG's chief analyst, called this discovery "the tip of the iceberg" and "tangible evidence" of AI-powered cyberattacks. While threat actors leverage AI at various attack stages, defensive measures are also advancing. Anthropic recently announced Project Glasswing, using Claude Mythos Preview to identify high-severity vulnerabilities, demonstrating how AI tools can counter emerging threats.