'This is the tip of the iceberg': Google experts say they have seen hackers using AI to discover and weaponize a zero-day for the first time
Google says AI helped attackers find a zero-day first. The flaw let them bypass 2FA in a popular admin tool before vendors reacted quickly. LLMs spotted the hardcoded trust assumption humans missed in that script. Defenders should patch, hunt, and harden AI guardrails immediately across scripting pipelines now.
Key points
- Google caught AI-led zero-day hunting.
- Attackers used a semantic flaw in Python to bypass 2FA before rollout.
- LLMs read intent better than fuzzers do.
- GTIG says UNC2814 and WooYun data helped prompt research across TP-Link firmware and OFTP.
- Defenders should treat guardrails and hunting as urgent now.
This is one of fifty stories I surfaced this week from Surface — a tiny slice of the full feed.
