Google’s Threat Intelligence Group (GTIG) reports the first observed case of a zero-day exploit likely developed with an AI system for real-world vulnerability discovery and exploit generation. An unknown cybercrime actor used a Python-based exploit to bypass two-factor authentication (2FA) on a popular open-source web-based system administration tool, as part of a “mass vulnerability exploitation operation.” The script showed strong hallmarks of LLM-generated code, including verbose educational docstrings, a fabricated CVSS score, and highly structured “textbook” Python formatting. The 2FA bypass required valid credentials and exploited a high-level logic flaw based on a hard coded trust assumption, exactly the kind of semantic bug LLMs are good at spotting. Google worked with the vendor to patch the zero-day and disrupt the campaign. This is an example of how AI is accelerating into the full exploit lifecycle and ultimately compressing timelines for attackers. Beyond this incident, Google notes AI is also being used to build polymorphic and autonomous malware, underscoring that defenders must assume faster, AI-assisted attacks and cannot “opt out” of this new reality. Ankura CTIX Analysts will continue to monitor how AI is being leveraged by Threat Actors and being integrated into their campaigns.