Google says it blocked a zero-day exploit that marks a new line in the cyberwar: attackers may have used AI to help build a tool designed to crack past two-factor authentication.

According to Google Threat Intelligence Group, the exploit targeted an unnamed platform and appeared headed for a “mass exploitation event.” Reports indicate prominent cybercrime actors planned to weaponize the vulnerability at scale, a move that could have opened a path around one of the internet’s most common security backstops. Google frames the case as the first time it has seen and stopped a zero-day developed with AI.

Google’s claim matters because it shifts the AI debate from theory to operations: this was not hype about future risk, but a live exploit the company says it disrupted before broad deployment.

Key Facts

  • Google says it identified and stopped a zero-day exploit developed with AI.
  • The company says attackers intended a mass exploitation campaign.
  • Reports indicate the exploit could bypass two-factor authentication.
  • The targeted platform has not been publicly named.

The details remain limited, and Google has not publicly identified the affected service or the threat actors. That restraint suggests an active security response or a broader effort to avoid handing copycat attackers a roadmap. Even so, the core allegation stands out: AI may now play a direct role in building attack tools that move faster than traditional detection and patch cycles.

This episode lands at a tense moment for the tech industry, which already faces pressure to prove that AI systems will not supercharge fraud, intrusion, and surveillance. Security teams have long worried that machine learning could help attackers automate research, generate code, and refine exploits. Google’s account suggests that concern has moved from warning slides and conference panels into frontline defense.

What happens next will matter well beyond one blocked campaign. Researchers, platform operators, and regulators will watch for technical evidence, follow-on disclosures, and signs that similar AI-assisted exploits are circulating elsewhere. If Google’s assessment holds, the lesson is stark: the race between defenders and attackers just sped up, and basic protections like two-factor authentication may no longer stand on their own.