12OCT

GTIG names the first LLM-written working zero-day

3 min read

10:55UTC

Google's Threat Intelligence Group documented the first criminal use of a Large Language Model to write a working zero-day, a Python 2FA bypass intercepted before mass deployment, alongside four AI-augmented threat clusters spanning DPRK-, PRC- and Russia-nexus operators.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A regulator can now name a working LLM-written exploit by file, by actor, and by interception date.

Google's Threat Intelligence Group (GTIG) published a 11 May 2026 report documenting the first confirmed criminal-actor case of a working zero-day exploit written by a Large Language Model: a Python two-factor authentication bypass targeting a widely deployed web administration tool, intercepted before mass deployment⁠¹⁠². Mandiant, the incident-response firm Google acquired for $5.4 billion in 2022 and now publishes attribution work under GTIG, co-authored the analysis.

The same report names four state-actor clusters by tradecraft. PROMPTSPY, an Android backdoor first surfaced by ESET in February 2026, is confirmed to use Google's Gemini API for autonomous device navigation, biometric capture, and on-device user-interface automation. UNC2814, a People's Republic of China-nexus cluster, runs Gemini as a 'senior security auditor' persona for embedded-device code review. APT45, also PRC-nexus, sends thousands of recursive prompts per session to validate proof-of-concept exploits against known CVEs. Russia-nexus malware families CANFAIL and LONGSTREAM wrap their payloads in 32 or more LLM-generated benign queries to obscure malicious logic from static analysis.

The defensive track ran on the same date. Google's autonomous vulnerability-discovery agent Big Sleep found its first real-world unknown bug, and CodeMender began auto-patching critical code paths. The AI-augmented threat picture now sits alongside the multi-vector supply-chain pressure documented across the SAP, OpenVSX and PyPI compromises and the UNC1069 Axios npm intrusion. For regulators drafting AI-misuse provisions, the analytic shape changes. GTIG's intercept gives them a named Python artefact, a named target tool, and a named LLM-generation event to anchor policy text on.

Deep Analysis

In plain English

For the first time, security researchers at Google confirmed that a criminal group used an AI chatbot to write a working piece of malware from scratch, a computer program designed to bypass two-step login verification. Previous cases of AI being used in hacking had been assistive; this is the first confirmed case of the AI producing the working attack itself.

Deep Analysis

Root Causes

The convergence of three structural conditions enabled this threshold crossing: freely available frontier LLM access at zero marginal cost per query; open-source model fine-tuning that removes safety mitigations without requiring significant compute budget; and the absence of any vendor liability framework that would penalise an LLM provider for outputs used in downstream criminal activity.

The same GTIG report documenting offensive AI use also documents Google's defensive AI tools finding their first real-world vulnerability. Both tracks share the same underlying model capability. The structural asymmetry is that defenders operate within institutional constraints, responsible disclosure, patch timelines, and legal review, that attackers do not.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Stuxnet in 2010, attributed to the US and Israel and publicly disclosed that year, crossed the threshold of the first confirmed state-authored cyber-physical weapon: code designed to cause real-world physical destruction.

The 2010 disclosure changed the international security conversation permanently, shifting cyber from espionage to warfare. GTIG's 2026 report may represent an analogous threshold: the first confirmed criminal-authored AI-generated weapon, changing the attacker-capability baseline permanently.

Counter-parallel: The 2017 EternalBlue leak from the NSA Equation Group, and its subsequent deployment in WannaCry and NotPetya, showed that the most devastating cyber events of that era required no novel AI authorship. They required a leaked capability applied at scale. LLM-written exploits, even if individually well-crafted, still require delivery infrastructure, targeting intelligence, and operational security that LLMs do not supply.

The Google-Wiz close at $32 billion in March 2026 priced the LLM-security category on the assumption that AI-defence tooling would be the structural winner of the next enterprise security cycle. GTIG's report complicates that thesis: if the defender (Cisco AI Defense) has had its source code stolen (event-00) and the LLM proxy (LiteLLM, event-03) has been breached, the AI-security supply chain itself has become the attack surface.

For procurement Teams, the immediate cost implication is a new diligence layer: the AI-defence vendor's own security posture is now a material input to the purchase decision, adding friction to a market the Wiz acquisition assumed would scale rapidly.

Consensus view: GTIG's report marks the crossing of a capability threshold that the security research community had forecast in principle since at least 2023: a working, intercepted exploit produced by an LLM, not merely assisted by one. Oxford Internet Institute researchers note the distinction between AI-assisted code generation, already widespread, and autonomous zero-day synthesis, previously theoretical at criminal-actor level.

Counter-view: The Citizen Lab at the University of Toronto argues the intercepted Python 2FA bypass represents a single incident at one target, not evidence that criminal AI-exploit synthesis has achieved scale. Capability is not the same as operational tempo; state actors (UNC2814, APT45) are using Gemini as an auditing layer, not a generative exploit factory, which implies the bottleneck remains human targeting judgment.

Key tension: Google's own autonomous defence tools, Big Sleep and CodeMender, found a real-world bug on the same day GTIG reported the first LLM-written criminal exploit, placing Google in the position of both the discoverer of the threat category and the primary commercial beneficiary of the market for AI-defence tooling.

First Reported In

Update #4 · AI joins the breach column on both sides

Google Threat Intelligence Group· 20 May 2026

Read original →

Causes and effects

This Event

GTIG names the first LLM-written working zero-day

The named-incident threshold for AI-assisted exploit development has been crossed. Regulators and procurement teams now have a worked artefact, not a theoretical capability claim, to anchor policy on.

Led to

Five Eyes warn AI threat is months away

GTIG's confirmation of the first LLM-written zero-day directly contextualises the Five Eyes months-not-years AI threat assessment.

Occurred 22 Jun 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.