Google Warns Hackers Are Using AI to Create Working Zero-Day Exploits

Google’s May 2026 report warns that criminal and state-linked actors are weaponizing generative AI to discover zero-day vulnerabilities and produce functional exploits at scale — including an AI-generated zero-day that bypassed two-factor authentication — while also operating AI-driven malware (e.g., PROMPTSPY) that harvests biometric data and evades removal; attackers are using agentic frameworks, large vulnerability databases, and automated prompt chains for reconnaissance, exploit validation, and social engineering, prompting defenders to deploy AI agents for autonomous hunting and patching.