Google Reveals New Threat: Hackers Use AI to Find Security Vulnerabilities

Cybercriminals are becoming increasingly sophisticated. Hackers are even using artificial intelligence (AI) to find and attack vulnerabilities in specific software. This conclusion comes from Google’s Threat Intelligence Group (GTIG) research team. The security research team detected a zero-day exploit or infiltration into an unknown security vulnerability, suspected to have been created with the help of generative AI. “For the first time, GTIG has identified cybercriminals using a zero-day exploit that we believe was developed with AI,” Google stated in its official report. GTIG explained that the exploit targeted a popular open-source web-based system administration tool, the name of which was not disclosed. As a result, users’ devices could be taken over by hackers, and data within them could be stolen. Although it could be breached using AI, Google assured that the attack was stopped before reaching the mass exploitation stage. This is because Google claims to have informed the relevant software developers to promptly mitigate and close the security vulnerability. Google is quite confident that this attack, consisting of a series of Python-based exploit codes, was created with the assistance of a large language model (LLM). LLM can be said to be one of the “brains” of an AI product. Indications are seen in the very neat code structure, full of educational docstrings, and the use of a Python format considered typical of AI generation. Researchers also found a fake CVSS (vulnerability) score resulting from AI “hallucination” within the code. In addition to the code writing patterns, the type of vulnerability discovered is also considered to strengthen the suspicion of AI use. This is because the exploited vulnerability is a high-level semantic logic bug, which is deemed easier for AI to recognise compared to traditional methods like fuzzing (testing programmes) or static analysis (checking programme code). So, what AI was used by these cybercriminals? Google did not reveal it definitively. However, it is clear that they are very sure that their own AI model, Gemini, was not used to create AI-based attacks like this.