The AI models finding 10,000 vulnerabilities are the same ones China is trying to copy. That is the problem.

What happened

Google’s Threat Intelligence Group exposed a criminal actor using an advanced AI model to discover and exploit a zero-day vulnerability. The AI found a way to bypass two-factor authentication, built a working exploit automatically, and deployed it before defenders were even aware of the flaw. This is the first confirmed case where an AI-assisted zero-day was weaponized in real attacks. Alarmingly, the same class of frontier AI models capable of these feats is reportedly under active replication efforts by China.

The risk

This development shifts the cybersecurity battlefield. AI models that find tens of thousands of vulnerabilities can speed up exploit creation exponentially. The fact that nation-states are copying these capabilities means zero-day proliferation could rise, multiplying real security risks for businesses, users, and infrastructure. Defenders will struggle to keep pace as sophisticated attackers mix AI-powered vulnerability research with operational use. This pressure pulls budgets toward faster patching, heightened monitoring, and more aggressive threat hunting.

Why it matters

Attackers using AI to discover and weaponize exploits faster than defenders forces a rethink of security assumptions and investments. Automated vulnerability discovery means there is less time to respond before attacks hit. China’s efforts to copy these models adds a strategic dimension, increasing geopolitical tensions around AI and cybersecurity. Companies building or buying AI tools must consider the dual-use nature of these technologies. Security teams face rising costs and complexity in protecting assets against AI-accelerated threats alongside traditional cyber risks.

Who should pay attention

Security operations, incident response teams, and threat intelligence providers need to reassess their detection and response frameworks with AI-enabled attacks in mind. DevOps and application teams must accelerate vulnerability management and rethink multi-factor authentication and access controls. Investors in AI and cybersecurity infrastructure should monitor how the growing divide forms between attackers with AI capabilities and defenders scrambling to adapt. Regulators might also need to consider policies concerning AI misuse in cyber offense.

What to watch next

Watch for new AI-driven exploit campaigns surfacing in the wild, especially those that bypass common security measures like two-factor authentication. Developments in defensive AI tools that can predict or detect AI-crafted exploits will be critical to follow. Also track government and industry responses to China’s AI replication efforts and any escalations in cyber conflict influenced by these emerging AI attack vectors. Updates from Google’s Threat Intelligence Group and similar units will provide early warnings on new AI-powered threats.

AI Quick Briefs Editorial Desk