Google's threat intelligence group has published findings confirming what the cybersecurity industry has been warning about for two years: a frontier AI model was used not just to assist in a cyberattack but to discover and weaponize a previously unknown vulnerability at a level of sophistication that was previously inaccessible to most threat actors. The group observed prominent cybercrime threat actors partnering to plan a mass vulnerability exploitation operation, using a zero-day flaw that allowed them to bypass two-factor authentication on an unnamed but widely used open-source web-based system administration tool. Google stated it has "high confidence" that the attackers leveraged an AI model to support the discovery and weaponization of the vulnerability, citing two specific indicators in the exploit script: a hallucination — the kind of confident error that is characteristic of large language model output — and a formatting style "highly characteristic" of an AI model's training data. Those forensic signatures in the exploit code itself are what allowed Google's analysts to attribute AI involvement with confidence rather than speculation.The specific nature of the vulnerability discovered is as significant as the method used to find it. The flaw was not a common implementation error like memory corruption, which traditional automated scanning tools are reasonably good at detecting.

It was a high-level semantic logic flaw — a case where a developer had hardcoded a trust assumption that created an exploitable gap in the authentication chain. Google explicitly noted that LLMs excel at identifying exactly this category of flaw because they can reason about the intended behavior of a system and identify discrepancies between that intent and the actual implementation, rather than simply pattern-matching against known vulnerability signatures. This means that the categories of software flaws that have historically been hardest to find programmatically — the ones requiring genuine comprehension of system logic rather than syntax scanning — are now becoming more accessible to attackers who have access to frontier AI models. For crypto users specifically, the relevance is direct: the bypass targeted two-factor authentication, which is one of the primary security mechanisms protecting crypto accounts, wallets, and exchange access.