Written by Martin Young, Staff Writer. Reviewed by Jesse Coghlan, Staff Editor. Written by Martin Young, Staff Writer. Reviewed by Jesse Coghlan, Staff Editor. Hackers used AI to craft zero-day attack to bypass 2FA: Google
Latest NewsPublishedMay 12, 2026Google’s Threat Intelligence Group says it has “high confidence” a threat actor used an AI model to help discover and weaponize a vulnerability in a popular system admin tool.
Google’s Threat Intelligence Group says it identified what it believes is the first-ever case of hackers using artificial intelligence to develop a zero-day exploit.
The group said in a Tuesday blog post that it had “observed prominent cyber crime threat actors partnering to plan a mass vulnerability exploitation operation,” using a zero-day vulnerability allowing them to bypass the two-factor authentication of an unnamed “popular open-source, web-based system administration tool.”
The exploit required valid user credentials first, but bypassed the second authentication factor, which is often also used to secure crypto accounts and wallets.
AI has been increasingly used in both cybersecurity and by crypto hackers seeking to carry out exploits or scams. AI company Anthropic claimed last month that its recent AI model, Claude Mythos, found thousands of software vulnerabilities across major systems.
Google said it had “high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability,” as the script for the exploit included a hallucination and a format “highly characteristic” of an AI model’s training data.
The report did not specify the threat actor, but Google said that China and North Korea have “demonstrated significant interest in capitalizing on AI for vulnerability discovery.”
LLMs excel at high-level flaw identification
Google said the vulnerability did not stem from “common implementation errors” like memory corruption, but a “high-level semantic logic flaw” where the developer hardcoded a trust assumption.
This implies the attackers used a frontier large language model (LLM), as the models excel at identifying high-level flaws and “hardcoded static anomalies,” Google added.
Related: AI agents like OpenClaw could drain crypto wallets via ‘malicious skills’: CertiK
Several malware families, such as PROMPTFLUX, HONESTCUE and CANFAIL also use LLMs for defense evasion, generating decoy or filler code to camouflage malicious logic, Google said.
Industrialized LLM abuse is increasing
LLM access abuse is becoming industrialized as threat actors have built automated pipelines to cycle through premium AI accounts, pool API keys, and bypass safety guardrails at scale — effectively running adversarial operations subsidized by trial account abuse.
“By leveraging anti-detect browsers and account-pooling services, actors are attempting to maintain high-volume, anonymized access to premium LLM tiers, effectively industrializing their adversarial workflows.”
Google concluded that as organizations continue integrating LLMs into production environments, the AI software ecosystem has emerged as a primary target for exploitation.
It observed adversaries increasingly targeting the integrated components that grant AI systems their utility, such as autonomous skills and “third-party data connectors,” but threat actors have yet to achieve breakthrough capabilities to bypass the core security logic of frontier models, it stated.
Magazine: How AI just dramatically sped up the quantum risk for Bitcoin
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.More on the subject
‘I failed them’: Goliath Ventures CEO charged with crypto Ponzi apologizes15 minutes agoBrayden Lindrea
Why a 2017 Linux bug is now a major concern for the crypto industry May 9, 2026Dilip Kumar Patairya
Europe sees ‘hyperconcentration’ of crypto wrench attacks as losses hit $101MMay 8, 2026Stephen Katte‘I failed them’: Goliath Ventures CEO charged with crypto Ponzi apologizes15 minutes agoBrayden LindreaWhy a 2017 Linux bug is now a major concern for the crypto industry May 9, 2026Dilip Kumar PatairyaEurope sees ‘hyperconcentration’ of crypto wrench attacks as losses hit $101MMay 8, 2026Stephen Katte
