Google Threat Intelligence Group (GTIG) has identified the first instance of zero-day attack code developed using AI.

Google Threat Intelligence Group (GTIG) recently released the 'AI Threat Tracking Report,' which reflects AI threat trends since its announcement last February, and stated the following. The report contains evidence that a criminal group preparing for a large-scale vulnerability attack developed operational zero-day attack code with the help of AI.

It was determined that the attack was due to an error in the implementation process and did not lead to an actual breach. GTIG explained that it notified the developer of the relevant vulnerability and that the patch has been completed.

According to the report, North Korea and China-based state-backed threat groups are also utilizing AI for vulnerability analysis and attack code development. It was found that the North Korea-linked APT45 used AI to validate numerous attack codes and build attack assets.

Cases of attacks utilizing agent-based tools have also been confirmed. China-linked threat actors used autonomous scanning tools to find vulnerabilities in Japanese tech companies.

Russia-linked forces utilized AI for malware enhancement and intelligence operations. Cases have been reported of improving malware for attacks on Ukraine and synthesizing manipulated audio and video onto actual news footage.

Some threat groups were found to have used account automation and identity concealment tools to access high-performance large-scale language models (LLMs). This was confirmed to be an attempt to bypass usage restrictions and utilize AI services for attack activities.

Google is also strengthening its AI-based defense system. This includes blocking malicious accounts using Gemini, identifying vulnerabilities through Big Slip, and automated fixes via CodeMender.

John Hultquist, Senior Analyst at GTIG, stated, “The AI-driven vulnerability war has already begun,” adding that “threat actors are leveraging AI to increase the speed, scale, and sophistication of their attacks.”