Google caught an AI writing zero-day exploits — and 90 were weaponized in 2025

Google’s Threat Intelligence Group dropped a genuinely unsettling milestone in May 2026: the first documented case of a threat actor using AI to help build a zero-day exploit. The weaponized Python script bypassed two-factor authentication on a widely used open-source system administration tool, and researchers say they have “high confidence” an AI model assisted with both discovery and weaponization.

What gave it away wasn’t subtle. The script contained unusually detailed instructional comments, a fabricated vulnerability score, and a hyper-structured coding style that screams generated output. Google didn’t claim the operation was autonomous or pin it on a specific model like Gemini or GPT, but the fingerprints are hard to ignore.

The really interesting part is what the AI actually found. This wasn’t a crash, a memory corruption, or some unsafe input a fuzzer would catch. It was a logical flaw — a hard-coded trust assumption buried in how permissions and expected behaviors interact across the codebase. That’s precisely the kind of invisible contradiction that language models are uniquely suited to spot, and it represents a new attack surface that conventional static-analysis tools are poorly equipped to defend against.

This isn’t happening in a vacuum. Google tracked 90 zero-days exploited in the wild during 2025, up from 78 the year before. Enterprise software and appliances accounted for nearly half of those — 43 cases, both records in Google’s dataset. The message is clear: attackers are accelerating, and the flaws they’re exploiting are getting weirder and harder to find with traditional tools.

But finding the flaw is only act one. Once a vulnerability like this goes public, security teams face the nightmarish task of figuring out where the vulnerable code actually lives. In container environments, a compromised library can sit several layers deep — inherited from a base image, never directly added by the organization, yet present across hundreds of running instances. Log4Shell taught this lesson brutally in 2021, when patching was the easy part and locating every affected server was the real slog.

AI is being roped into the fix-it side too. Google DeepMind’s CodeMender contributed 72 security patches to open-source projects in its first six months, combining model reasoning with fuzz testing and static analysis. But those patches still required human review, and none of it matters if you can’t map the flaw back to the images and workloads that need rebuilding. Accurate software bills of materials and deliberately minimal container images aren’t glamorous work, but they’re the difference between a fast patch and a lingering exposure. The AI can write the fix — it just can’t tell you where to apply it.