On 11 May 2026, Google Threat Intelligence Group (GTIG) reported that, for the first time, it had identified a threat actor using a zero-day exploit that it believes was developed with AI. Prominent cybercrime groups were planning a mass exploitation campaign with the exploit, which bypassed two-factor authentication in a popular open-source system administration tool, and GTIG says its proactive discovery may have prevented it from being used. The report also documents AI-assisted malware, attacks on AI software supply chains and agent tooling abuse, and it shows attackers moving from using AI as a research assistant to building it into their operations.

Key Facts#

  • Published: 11 May 2026 on the Google Cloud blog, based on Mandiant incident response engagements, observations from Gemini and GTIG research. It follows a February 2026 report.
  • The zero-day: A two-factor authentication bypass, implemented in a Python script, in a popular open-source, web-based system administration tool. Exploiting it requires valid user credentials first.
  • Why GTIG suspects AI: The script contained many educational docstrings, a hallucinated CVSS score and a clean, textbook structure typical of LLM output. GTIG does not believe Gemini was used.
  • Response: GTIG worked with the affected vendor to disclose the flaw and disrupt the planned campaign.
  • Supply chain attacks: In late March 2026, a group tracked as TeamPCP (UNC6780) claimed responsibility for compromising GitHub repositories and Actions, including projects associated with Trivy, Checkmarx, LiteLLM and BerriAI, and stole cloud secrets from build environments.
  • AI-enabled malware: GTIG describes PROMPTSPY, an Android backdoor that uses the Gemini API to navigate the device interface autonomously, along with several malware families that use LLM-generated code for evasion.

What Happened#

The headline case matters because of the type of flaw involved. According to GTIG, the vulnerability was not memory corruption or missing input sanitization, which fuzzers and static analysis tools are built to find. It was a semantic logic flaw: the developer had hardcoded a trust assumption that contradicted the tool's 2FA enforcement. GTIG argues that frontier models are good at exactly this kind of reasoning, reading a developer's intent and spotting where the code breaks it, which lets them surface bugs that look correct to traditional scanners.

State-backed groups show the same interest. GTIG observed actors linked to China and North Korea using persona-based jailbreaks, such as asking a model to act as a senior security auditor, and one group, APT45, sending thousands of repetitive prompts to analyze CVEs and validate proof-of-concept exploits. Actors also experimented with agent tools such as OpenClaw alongside deliberately vulnerable test environments, and with a Claude Code skill plugin that primes a model with more than 85,000 historical vulnerability cases.

The report also covers evasion. Malware families such as CANFAIL and LONGSTREAM, linked to Russia-nexus activity against Ukrainian organizations, pad their code with LLM-generated decoy logic, and a China-nexus actor used Gemini to speed up development of a tool for managing an anonymization network. Other actors have built middleware and automated sign-up pipelines to obtain anonymous, premium access to models and to bypass usage limits.

Background#

GTIG has published a series of reports on adversarial AI use. Earlier ones described malware such as PROMPTFLUX and HONESTCUE, which call the Gemini API to rewrite or obfuscate themselves. This report describes a transition from nascent experiments to what GTIG calls the "industrial-scale application" of generative models in attack workflows, and it treats AI systems as a target as well as a tool.

That second theme covers supply chains and agent ecosystems. GTIG maps the incidents to Google's Secure AI Framework risk categories, including insecure integrated components and rogue actions. It singles out the LiteLLM compromise because an AI gateway that connects to many model providers can expose API keys across an organization. It also cites early February 2026 reporting by VirusTotal researchers on malicious packages disguised as OpenClaw skills, which could run code, download payloads and steal local data with the broad permissions that agent grants.

Why It Matters for Developers#

  • Review authentication logic for hardcoded exceptions. Allowlists that skip MFA for certain accounts, networks or clients are the kind of flaw AI now finds cheaply. Enforce second factors through central policies rather than scattered conditionals, and cover them with integration tests. The ASP.NET Core authentication guide and integration testing guide show how.
  • Treat AI gateways and SDKs as high-value dependencies. A compromised package that brokers model calls sees every API key it uses. Pin versions, review updates and keep provider keys in a vault or behind managed identities, as covered in the secrets management guide.
  • Harden build pipelines. TeamPCP stole AWS keys and GitHub tokens directly from build environments. Use short-lived credentials with federated identity, pin third-party actions to exact commits and scope tokens narrowly. The CI/CD with GitHub Actions guide covers these controls.
  • Vet agent skills and plugins like executables. Anything that extends an agent inherits its permissions.
  • Use AI on defense as well. GTIG highlights Google's Big Sleep agent for finding vulnerabilities and CodeMender for fixing them, and similar AI-assisted review of your own code can catch logic flaws before attackers do. Our coverage of Project Glasswing shows how quickly AI-driven discovery is scaling.

What's Next#

GTIG notes that attackers rarely shy away from experimentation, and its report points toward more autonomous, agent-driven operations and continued targeting of AI infrastructure. Google says it is disabling malicious accounts, strengthening product safeguards and expanding AI-driven defense. The open question for defenders is scale: if AI makes logic-flaw discovery routine for criminals, organizations will need faster patching and more automated detection to keep up. That is an inference from the report rather than a GTIG forecast, but it matches what vendors and maintainers were already reporting in 2026.

Sources#