In May 2026, Google’s Threat Intelligence Group identified what it believes was an AI-assisted zero-day exploit in the hands of a cybercrime group, before a planned mass-exploitation campaign.
The vulnerability was implemented in a Python script designed to bypass two-factor authentication on a popular open-source web administration tool.
Google identified the AI hallmarks in the code itself: unusual annotation patterns, auto-generated documentation strings, textbook Pythonic structure, and a hallucinated CVSS score absent from any vulnerability database.
The group had built it with AI assistance and were preparing to weaponise it at scale.
This is not a theoretical capability anymore.
This lands on a problem that was already getting worse before AI entered the picture.
Here is the arithmetic that should be in front of every financial services leader this quarter:
- 20% of breaches in Verizon’s 2025 DBIR involved vulnerability exploitation as the initial access vector, up 34% year on year.
- The median time for organisations to remediate edge device vulnerabilities is 32 days.
- The median time from disclosure to mass exploitation for those same vulnerabilities is zero days.
The race to patch is being lost before it begins.
Not because security teams are slow, but because the unit of measurement is wrong. Threats now operate in hours. Assurance still operates in months.
Annual pen testing still matters. It is just no longer enough on its own. A point-in-time test against last quarter’s threat landscape cannot cover an exposure window that could reopen with every commit and every new CVE.
Google’s John Hultquist called this “probably the tip of the iceberg,” with the capability trajectory “pretty sharp.”
The watershed has passed.
We published the full analysis in our latest white paper. Get in touch and I’ll send you a copy.
