AI Finds Zero-Day Exploit: A New Cyber Threat

Google has identified hackers using an AI program to discover a zero-day exploit, a previously unknown software vulnerability. This marks the first time such an attack, leveraging AI for exploitation, has been detected. The exploit threatened to allow mass exploitation and bypass two-factor authentication in a popular system administration tool, meaning accounts could be accessed with only a password.

Investigators suspect an AI program aided the discovery due to specific code elements and a structured Pythonic format characteristic of large language models. Google thwarted the planned mass exploitation by uncovering the flaw and is collaborating with the affected vendor to disclose and patch the vulnerability. This incident is considered the 'tip of the iceberg,' with warnings that other AI-developed exploits are likely in existence and could be used by state actors.

While AI is also being developed to help vendors find and patch vulnerabilities, there is an escalating arms race as cybercriminals and state-sponsored hackers gain access to powerful AI models. Previously, suspected Chinese state-sponsored hackers were found using an AI coding tool for cyber intrusions.