Hackers linked to a major cybercrime group reportedly used artificial intelligence to identify a previously unknown software vulnerability and develop an exploit for it, Alphabet’s Google said on Monday.
According to a report from Google’s Threat Intelligence Group, the planned attack targeted a widely used open-source system administration tool but was detected and stopped before it could be deployed in what could have become a “mass exploitation event.”
The incident is the first time Google has observed attackers using artificial intelligence to uncover a new software vulnerability and attempt to exploit it at scale.
The chief analyst at Google’s Threat Intelligence Group, John Hultquist, said the discovery may only be “the tip of the iceberg,” warning that both criminal networks and state-sponsored hackers are rapidly advancing their use of AI in cyber operations.
The report also noted a growing trend in which hackers are delegating parts of their operations to AI systems, including using them to autonomously search for software vulnerabilities and assist in the development of malware.
The development signals an early shift toward more autonomous cyber operations, with attackers increasingly using artificial intelligence not just as a research aid but as an active tool capable of analysing targets, generating code, and making decisions with limited human oversight, researchers said.
The findings also come as governments worldwide struggle to regulate advanced AI systems amid concerns that such models could lower the barrier for cybercriminals, making it easier to identify potential targets and launch attacks using both known and newly discovered software vulnerabilities.
The findings align with recent warnings from European financial regulators, who say rapidly advancing AI models are amplifying the speed and scale of cyber risks at a time of heightened geopolitical tension.
According to the report, both cybercriminal groups and state-linked hackers associated with China, Russia, and North Korea are already experimenting with embedding AI into their attack workflows.
While these techniques are still in their early stages, Google cautioned that they could significantly accelerate cyber campaigns by reducing the time, effort, and technical expertise required to execute complex attacks.
