5-Min Brief: Hackers Just Used AI to Build a Cyberattack. Google Caught It — Barely.

\What you need to know — in 30 seconds

• Google's Threat Intelligence Group published a report yesterday confirming they caught hackers using AI to develop a zero-day exploit — a first
• The group planned to use it in a "mass exploitation event" targeting a widely-used IT administration tool
• Google alerted the software vendor and disrupted the attack before it was deployed
• China and North Korea-linked groups are also actively experimenting with AI for cyberattacks, according to the same report
• This is exactly the scenario Anthropic was warning about when it delayed the release of its Mythos model in April

Back in our first week, we covered a story about Anthropic's Project Glasswing — their AI system that found thousands of security holes in major software that humans had missed for decades. The concern at the time was that AI could find vulnerabilities faster than humans could patch them. We noted that Anthropic was sitting on its most powerful model, Mythos, partly because it was too capable at finding and exploiting software vulnerabilities to release safely.

Yesterday, that concern stopped being theoretical.

What Google found

Google's Threat Intelligence Group — a team of researchers that tracks hackers and cyberattacks globally — published its quarterly report on AI-enabled threats yesterday. Buried in the technical detail was a historic first: researchers said they have high confidence that a criminal group used AI to develop a zero-day exploit.

A zero-day is a software vulnerability that the developer doesn't know about yet — meaning there's been zero days to patch it. By definition, there's no defense ready when someone finds and uses one. They're the most valuable and dangerous tools in a hacker's arsenal, typically requiring teams of skilled researchers working for weeks or months to develop.

This one was built with AI.

The exploit targeted a widely-used web-based IT administration tool and was designed to bypass two-factor authentication — the extra verification step most people use to protect their accounts. The criminal group, which Google identified internally but did not name publicly, was planning to deploy it in a mass exploitation event before Google's team discovered it, alerted the software vendor, and helped patch the vulnerability.

"The criminal threat actor planned to use it in a mass exploitation event," Google wrote, "but our proactive counter discovery may have prevented its use."

What else the report found

The zero-day finding was the headline, but the broader report paints an equally concerning picture.

Hacker groups linked to China and North Korea have demonstrated significant interest in using AI for vulnerability discovery, according to the report. These aren't amateur cybercriminals — these are state-linked actors with substantial resources and clear strategic goals. Both nations have established track records of large-scale cyber operations against governments, infrastructure, and private companies.

The report also documented hackers using an AI agent tool called OpenClaw to find vulnerabilities, launch cyberattacks, and develop malware at scale. OpenClaw is essentially an AI assistant for hacking — it helps automate the process of finding weaknesses in software systems that would previously have required significant human expertise and time.

What the report describes is a transition from individual hackers using AI as a productivity tool to something more industrial — AI being embedded directly into the workflows of professional criminal and state-sponsored hacking operations.

Why this connects to the Mythos story

In April, Anthropic delayed the rollout of Mythos — its most powerful model — citing worries that criminals and adversaries could use it to identify and exploit decades-old software vulnerabilities. At the time, the concern was forward-looking. The worry was about what could happen.

Yesterday's Google report is evidence of what is already happening — with models that are less capable than Mythos.

The timeline here matters. Anthropic built Glasswing, found thousands of vulnerabilities, showed the potential, and pulled back on its most powerful model out of caution. Meanwhile, criminal groups — working with less sophisticated but still capable AI tools — figured out the same thing independently and started doing it.

This is the dual-use problem with AI in its sharpest form. The same capabilities that let AI find security holes so defenders can patch them also let bad actors find security holes to exploit them. The technology doesn't distinguish between the two uses. The outcome depends entirely on who's using it and why.

What this means for you

For most people, yesterday's news doesn't change your immediate risk level dramatically. The attack was caught before deployment. The vulnerability has been patched. You're not less safe today than you were last week.

But the broader trend is worth understanding. AI is actively lowering the barrier to sophisticated cyberattacks. Things that previously required a team of expert hackers working for months can now be accelerated — or in some cases, partially automated — with AI tools. That doesn't mean every hacker suddenly becomes more dangerous. But it does mean the most capable and motivated attackers are becoming significantly more capable.

The defenses are also improving — Google's team caught this one, and AI is increasingly being used on the defensive side too. But the cat-and-mouse game between attackers and defenders is moving faster than before, and the stakes of falling behind are higher.

HumanReadable-AI covers AI news in plain English every weekday. Subscribe below — free, no jargon, always under five minutes.