Google Stops First AI-Made Cyberattack Before It Strikes

Google's security researchers just won a crucial battle in the emerging war between AI-powered defenders and AI-armed hackers.

The Google Threat Intelligence Group discovered cybercriminals using artificial intelligence to develop a zero-day exploit targeting a web-based system administration tool. This marks the first confirmed case of AI being used to create an actual cyberattack in the wild.

The hackers planned a "mass exploitation event" that would have bypassed two-factor authentication, the security feature protecting everything from email to banking apps. Millions of users could have been vulnerable.

Google's team spotted telltale signs that AI helped write the attack code. The Python script included a "hallucinated CVSS score," a type of mistake that AI models are known to make. The code also showed "structured, textbook" formatting consistent with how large language models organize information.

The exploit took advantage of hardcoded trust assumptions in the platform's authentication system. Essentially, the developers had built in a security flaw without realizing it, and AI helped criminals find it.

The Bright Side

Google successfully disrupted the attack before any damage occurred. Their quick detection shows that while AI might help hackers, it's also making defenders smarter and faster.

The discovery reveals both the challenge and the opportunity ahead. Google's report notes that hackers are teaching AI models to act like security experts, feeding them entire databases of known vulnerabilities, and using specialized tools to refine their AI-generated attacks.

But security teams now know what AI-assisted attacks look like. They can spot the patterns, recognize the telltale signs, and move faster to protect systems before criminals strike.

Google confirmed they don't believe their own Gemini AI was used in creating this exploit. The company is sharing its findings to help other security teams recognize similar threats.

This cat-and-mouse game between AI defenders and AI attackers is just beginning, but the good guys just proved they can win.