Google was hit by a cyberattack that used AI to detect a major flaw in its software that its own developers had no knowledge of.
attack, which new York Times reports Researchers at the tech giant revealed on Monday that it was ultimately foiled. their report It was not specified who might be behind it or when it happened, but it was clear what cutting-edge technology was at the core of it.
“We have high confidence that the actor would have leveraged AI models to support the discovery and weaponization of this vulnerability,” the report said.
Google said the hackers used AI to identify a flaw in a piece of software, known as a zero-day vulnerability, that was not previously known to its developers. When exploited, they leave developers on the backfoot, as hackers are free to wreak havoc until white hats figure out how to close the hole.
In this case, the zero-day bug would have allowed hackers to bypass two-factor authentication on an unspecified “popular open-source, web-based system administration tool”, but only if the attackers knew an individual’s username and password. Given that two-factor authentication is the last meaningful line of defense for most users, and their passwords are likely weak if they haven’t already been leaked online, the ability to circumvent it could have been devastating, even if hackers weren’t armed with that information.
“The criminal threat actor planned to use it in a large-scale exploitation event, but our proactive countermeasures would have prevented its use,” the report said.
Researchers said this is the first example of hackers exploiting a zero-day vulnerability that was developed with AI.
“This is a taste of what’s to come,” said John Hultquist, principal analyst at Google Threat Intelligence Group, which published the report. NYT. “We believe this is the tip of the iceberg. The problem is probably much bigger; this is the first solid evidence we can see.”
The attack will add to the growing sense of unease over the implications of AI for cybersecurity, especially with the release of Anthropic’s Cloud Mythos model last month. Anthropic claimed that the AI system could “detect zero-day vulnerabilities in every major operating system and every major web browser when directed by the user to do so,” a capability so potentially devastating that the company pretended to only share the model with a select group of companies and government agencies. Its rollout has raised alarm bells from government leaders And security experts alike.
The cybersecurity threat of AI arises from its much-vaunted and ever-growing ability to write and parse code, which is being increasingly adopted by businesses in the technology and financial sectors. Like AI prose, AI code has its own identity, albeit a more subtle one. Google researchers found that the hacker’s malware contained abundant annotations explaining its code called docstrings, some hallucinatory text, and “a structured, textbook Pythonic format that is highly characteristic of LLM training data.”
More on AI: Vibe coded apps are delivering users’ personal information straight to greedy hackers
