3AUG

GTIG names the first LLM-written working zero-day

3 min read

16:08UTC

Google's Threat Intelligence Group documented the first criminal use of a Large Language Model to write a working zero-day, a Python 2FA bypass intercepted before mass deployment, alongside four AI-augmented threat clusters spanning DPRK-, PRC- and Russia-nexus operators.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A regulator can now name a working LLM-written exploit by file, by actor, and by interception date.

Google's Threat Intelligence Group (GTIG) published a 11 May 2026 report documenting the first confirmed criminal-actor case of a working zero-day exploit written by a Large Language Model: a Python two-factor authentication bypass targeting a widely deployed web administration tool, intercepted before mass deployment ¹ ². Mandiant, the incident-response firm Google acquired for $5.4 billion in 2022 and now publishes attribution work under GTIG, co-authored the analysis.

The same report names four state-actor clusters by tradecraft. PROMPTSPY, an Android backdoor first surfaced by ESET in February 2026, is confirmed to use Google's Gemini API for autonomous device navigation, biometric capture, and on-device user-interface automation. UNC2814, a People's Republic of China-nexus cluster, runs Gemini as a 'senior security auditor' persona for embedded-device code review. APT45, also PRC-nexus, sends thousands of recursive prompts per session to validate proof-of-concept exploits against known CVEs. Russia-nexus malware families CANFAIL and LONGSTREAM wrap their payloads in 32 or more LLM-generated benign queries to obscure malicious logic from static analysis.

The defensive track ran on the same date. Google's autonomous vulnerability-discovery agent Big Sleep found its first real-world unknown bug, and CodeMender began auto-patching critical code paths. The AI-augmented threat picture now sits alongside the multi-vector supply-chain pressure documented across the SAP, OpenVSX and PyPI compromises and the UNC1069 Axios npm intrusion . For regulators drafting AI-misuse provisions, the analytic shape changes. GTIG's intercept gives them a named Python artefact, a named target tool, and a named LLM-generation event to anchor policy text on.

Deep Analysis

In plain English

For the first time, security researchers at Google confirmed that a criminal group used an AI chatbot to write a working piece of malware from scratch, a computer program designed to bypass two-step login verification. Previous cases of AI being used in hacking had been assistive; this is the first confirmed case of the AI producing the working attack itself.

Deep Analysis

Root Causes

The convergence of three structural conditions enabled this threshold crossing: freely available frontier LLM access at zero marginal cost per query; open-source model fine-tuning that removes safety mitigations without requiring significant compute budget; and the absence of any vendor liability framework that would penalise an LLM provider for outputs used in downstream criminal activity.

The same GTIG report documenting offensive AI use also documents Google's defensive AI tools finding their first real-world vulnerability. Both tracks share the same underlying model capability. The structural asymmetry is that defenders operate within institutional constraints, responsible disclosure, patch timelines, and legal review, that attackers do not.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Stuxnet in 2010, attributed to the US and Israel and publicly disclosed that year, crossed the threshold of the first confirmed state-authored cyber-physical weapon: code designed to cause real-world physical destruction.

The 2010 disclosure changed the international security conversation permanently, shifting cyber from espionage to warfare. GTIG's 2026 report may represent an analogous threshold: the first confirmed criminal-authored AI-generated weapon, changing the attacker-capability baseline permanently.

Counter-parallel: The 2017 EternalBlue leak from the NSA Equation Group, and its subsequent deployment in WannaCry and NotPetya, showed that the most devastating cyber events of that era required no novel AI authorship. They required a leaked capability applied at scale. LLM-written exploits, even if individually well-crafted, still require delivery infrastructure, targeting intelligence, and operational security that LLMs do not supply.

The Google-Wiz close at $32 billion in March 2026 priced the LLM-security category on the assumption that AI-defence tooling would be the structural winner of the next enterprise security cycle. GTIG's report complicates that thesis: if the defender (Cisco AI Defense) has had its source code stolen (event-00) and the LLM proxy (LiteLLM, event-03) has been breached, the AI-security supply chain itself has become the attack surface.

For procurement Teams, the immediate cost implication is a new diligence layer: the AI-defence vendor's own security posture is now a material input to the purchase decision, adding friction to a market the Wiz acquisition assumed would scale rapidly.

Consensus view: GTIG's report marks the crossing of a capability threshold that the security research Community had forecast in principle since at least 2023: a working, intercepted exploit produced by an LLM, not merely assisted by one. Oxford Internet Institute researchers note the distinction between AI-assisted code generation, already widespread, and autonomous zero-day synthesis, previously theoretical at criminal-actor level.

Counter-view: The Citizen Lab at the University of Toronto argues the intercepted Python 2FA bypass represents a single incident at one target, not evidence that criminal AI-exploit synthesis has achieved scale. Capability is not the same as operational tempo; state actors (UNC2814, APT45) are using Gemini as an auditing layer, not a generative exploit factory, which implies the bottleneck remains human targeting judgment.

Key tension: Google's own autonomous defence tools, Big Sleep and CodeMender, found a real-world bug on the same day GTIG reported the first LLM-written criminal exploit, placing Google in the position of both the discoverer of the threat category and the primary commercial beneficiary of the market for AI-defence tooling.

First Reported In

Update #4 · AI joins the breach column on both sides

Google Threat Intelligence Group· 20 May 2026

Read original →

Causes and effects

This Event

GTIG names the first LLM-written working zero-day

The named-incident threshold for AI-assisted exploit development has been crossed. Regulators and procurement teams now have a worked artefact, not a theoretical capability claim, to anchor policy on.

Led to

Five Eyes warn AI threat is months away

GTIG's confirmation of the first LLM-written zero-day directly contextualises the Five Eyes months-not-years AI threat assessment.

Occurred 22 Jun 2026

Read story →

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.