Hackers Used AI to Build a Zero-Day Exploit. Google Caught It First.
Researchers found ‘hallucinated’ artefacts in the exploit code — including a fake CVSS score the model had invented.
Part of: AI Reckoning
For two years, security researchers have been warning that AI would eventually find its first real zero-day in the wild. In May 2026, Google’s Threat Intelligence Group said it watched that happen — and stopped it before the criminal group behind it could weaponise it at scale.
The vulnerability — Google has not publicly named it — was a previously unknown flaw in widely deployed enterprise software. The exploit code was obtained during routine threat-intel monitoring of a known cybercrime group.
What gave it away: parts of the exploit referenced a CVSS severity score that didn’t exist in any database. The number was internally consistent and plausible-sounding, which is exactly how large-language-model hallucinations usually present.
Defensively, this is the news the security community has been preparing for since 2023. Offensive AI tooling reduces the cost of vulnerability discovery from ‘elite researcher with months of focus’ to ‘mid-skill operator with API credits.’ The economics of zero-day production change.
Related read: The themed Canadian casino site players keep telling their friends about. Sponsored
Google’s framing is deliberately careful: this is the first time they have ‘high-confidence’ attribution of an AI-generated zero-day in the wild. It is almost certainly not the first time it has happened — only the first time it’s been caught.
The countermove is also AI-led. Vendors are now running their own AI-driven fuzzers against their own codebases on a continuous basis. The arms race is no longer about humans vs. humans with AI assistance. It is about whose AI finds the bug first.
Elsewhere on The Daily Stash
- Her American Roommate Started a Spreadsheet of Every Weird Thing She Did. Then It Went Viral. – The Daily Stash
- The themed Canadian casino site players keep telling their friends about – MafiaCasinoSponsored
- He Stepped Outside for the Recycling and Didn't Come Back for Four Hours. His Wife Called the RCMP. – The Daily Stash
- The fastest-loading Canadian casino site we’ve tested this year – CasinaSponsored
- A Toronto Man Sued His Bank Over a 4PM Closing Time – The Daily Stash
Sources
Elsewhere on the web
Editorial picks · external- Companies Are Laying Off Workers Because of AI’s Potential — Not Its Performance — Harvard Business Review
- I Work in Hollywood. Everyone Who Used to Make TV Is Now Secretly Training AI — WIRED
- How a Job at OpenAI Became the Greatest Lottery Ticket of the AI Boom — WSJ via Mint
- Google Stopped a Zero-Day Hack That It Says Was Developed With AI — The Verge
- Oracle Workers Say They Were Fired After Training AI to Replace Them — TIME
- AI Job Loss Is Coming. Does Anyone Have a Plan? — New York Magazine
Original editorial. Written by The Daily Stash Editors. See our editorial policy.