Boonchai Wedmakawand | Moment | Getty Images
Google’s Threat Intelligence Group said in a report on Monday that it thwarted an effort by hackers to use artificial intelligence models to “plan a mass vulnerability exploitation operation.”
GTIG said it has “high confidence” that it recorded hackers using an AI model to find and exploit a zero-day vulnerability, or a software flaw unknown to developers, creating a way to bypass two-factor authentication.
“The criminal threat actor planned to use it in a mass exploitation event but our proactive counter discovery may have prevented its use,” Google wrote in the post, without disclosing the name of the hacker group. Google said it does not believe that its homegrown Gemini model was used.
The findings underscore how hackers are using available AI tools like OpenClaw to exploit software flaws in ways that can be particularly damaging to companies, government agencies and other organizations even as cybersecurity firms pump billions of dollars into bolstering their defenses.
In April, Anthropic delayed the rollout of its Mythos model, citing worries that criminals and adversaries could use the tool to identify and prey on decades-old software vulnerabilities. The concerns sent shockwaves through the industry and led to White House meetings with technology and business leaders. Anthropic has since released the model to a select group of testers, including Apple, CrowdStrike, Microsoft and Palo Alto Networks.
Last week, OpenAI announced that GPT-5.5-Cyber, a variation of its latest model, is rolling out in a limited preview capacity to vetted cybersecurity teams.
In Monday’s report, Google highlighted several examples of how hackers are already using tools such as OpenClaw to find vulnerabilities, launch cyberattacks and develop malware. Groups linked to China and North Korea “demonstrated significant interest in capitalizing on AI for vulnerability discovery,” the report said.
