Google researchers uncover criminal zero-day exploit likely built with AI

Google Threat Intelligence researchers link a zero-day web administration-tool exploit to AI-assisted development and detail multiple AI-influenced threats: LLM-assisted malware families (CANFAIL, LONGSTREAM) that use decoy code for obfuscation, the autonomous Android backdoor PROMPTSPY that leverages LLM APIs to perform UI actions and capture/replay biometric data, and a March 2026 supply-chain compromise of LiteLLM and Trivy that embedded a credential stealer (SANDCLOCK) to exfiltrate cloud and GitHub secrets later used in ransomware partnerships — illustrating growing risks to AI infrastructure and operations.