Question 1

What zero-day exploit did Google detect?

Accepted Answer

Google identified a Python-based exploit designed to bypass two-factor authentication on an unnamed open-source web administration tool. The company worked with the vendor to prevent mass exploitation before attacks occurred. The exploit was built by a criminal hacking group and planned for use in a mass exploitation campaign.

Question 2

Which hacking groups are using AI for cyberattacks?

Accepted Answer

Google's report identified activity from Chinese groups including UNC2814, North Korean group APT45, suspected Russia-linked actors building polymorphic malware, and a supply-chain-focused group called TeamPCP (also known as UNC6780), along with an unnamed criminal group behind the zero-day exploit. UNC2814 used persona-driven jailbreaking to analyze firmware, while APT45 sent thousands of prompts to validate proof-of-concept exploits.

Question 3

How did Google determine the exploit was AI-generated?

Accepted Answer

Google analysts found structural indicators in the code, including detailed educational docstrings, a hallucinated CVSS score, and formatting patterns characteristic of large language model training data. The script had textbook-style Python conventions and structured help menus that are typical of AI output. Google has high confidence the actor used an AI model to support both discovery and weaponization of the vulnerability.

UNC6780

Google catches first zero-day exploit built with AI assistance

One sharp brief.
Every day.

UNC6780

Google catches first zero-day exploit built with AI assistance

One sharp brief.Every day.

One sharp brief.
Every day.