Cybersecurity
Google: suspected AI-assisted zero-day exploit targeted two-factor authentication
Researchers identified exploit code for a previously unknown logic flaw. They strongly suspect AI assisted its development, but the model involved has not been established.
Kuva: Google Threat Intelligence Group. Alkuperäisen tutkimusartikkelin nollapäivähaavoittuvuutta käsittelevä kuvitus.
A LOGIC FLAW THREATENED AN IMPORTANT SAFEGUARD
Google Threat Intelligence Group reported in May 2026 on an attack being prepared against an open-source web administration tool. The exploit targeted a previously unknown logic flaw that could bypass two-factor authentication when an attacker already possessed valid account credentials.
Two-factor authentication remains valuable protection against stolen passwords. In this case, however, the weakness was not the second factor itself but the web application's handling of trusted and untrusted states. Such logic flaws can be difficult to detect with ordinary automated code scanners.
WHAT DID ARTIFICIAL INTELLIGENCE DO?
Investigators found unusually elaborate documentation and highly structured Python exploit code, including a dubious vulnerability severity score. These and other indicators led Google to assess with high confidence that AI was used to help identify or exploit the bug. The evidence does not identify a specific model, and Google said it did not believe the model was Gemini.
The distinction matters: the researchers documented an attack preparation and a strong AI-related assessment, not an independently confirmed fully autonomous compromise.
DEFENDERS HAVE THE SAME OPPORTUNITY
Google worked with the software vendor to disclose and address the issue and disrupt the wider attack preparation. There is no confirmation that the planned mass exploitation reached its intended scale.
THE PROMPT ANALYSIS
AI may be especially useful at comparing what software is meant to allow with what its code actually permits. That makes business-logic testing more important for defenders as well. Organizations should patch quickly, monitor privileged access and test authentication pathways, rather than assuming the presence of two-factor authentication eliminates every risk.
Original source: Google Threat Intelligence Group, 11 May 2026. https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access