駭客利用 AI 構建了繞過雙重身份驗證的 Zero-Day Exploit：Google

📄完整原文· 由 trafilatura 自動擷取5434 字

In brief - Google's Threat Intelligence Group confirmed that cybercriminals used AI to develop a zero-day exploit targeting a popular open-source web administration tool. - Google said this is the first time the company has identified AI-assisted zero-day development in the wild. - Google worked with the affected vendor to patch the vulnerability before the campaign scaled, but said threat actors linked to China and North Korea are also actively using AI for vulnerability research and exploit development. Cybercriminals used an AI model to discover and weaponize a zero-day vulnerability in a popular open-source web administration tool, according to Google’s Threat Intelligence Group. In a report published Monday, Google said the flaw let attackers bypass two-factor authentication, and warned that the attackers were preparing a mass exploitation campaign before the company intervened. It is the first time Google has confirmed AI-assisted zero-day development in the wild. “As the coding capabilities of AI models advance, we continue to observe adversaries increasingly leverage these tools as expert-level force multipliers for vulnerability research and exploit development, including for zero-day vulnerabilities,” Google wrote. “While these tools empower defensive research, they also lower the barrier for adversaries to reverse-engineer applications and develop sophisticated, AI-generated exploits. The report comes as researchers and governments warn that AI models are accelerating cyberattacks by helping hackers find vulnerabilities, generate malware, and automate exploit development. “Though frontier LLMs struggle to navigate complex enterprise authorization logic, they have an increasing ability to perform contextual reasoning, effectively reading the developer's intent to correlate the 2FA enforcement logic with the contradictions of its hardcoded exceptions,” the report said. “This capability can allow models to surface dormant logic errors that appear functionally correct to traditional scanners but are strategically broken from a security perspective.” According to Google, the unnamed attackers used AI to identify a logic flaw where the software trusted a condition that bypassed its two-factor authentication protections. Unlike traditional scanners that search for broken code or crashes, the AI analyzed how the software was intended to work and detected the contradiction, allowing attackers to bypass the security check without breaking the encryption itself. “AI-driven coding has accelerated the development of infrastructure suites and polymorphic malware by adversaries,” Google wrote. “These AI-enabled development cycles facilitate defense evasion by enabling the creation of obfuscation networks and the integration of AI-generated decoy logic in malware that we have linked to suspected Russia-nexus threat actors.” The report says that threat actors from China and North Korea are using AI to find software weaknesses, while Russian groups are using it to hide their malware. “These actors have leveraged sophisticated approaches toward AI-augmented vulnerability discovery and exploitation, beginning with persona-driven jailbreaking attempts and the integration of specialized, high-fidelity security datasets to augment their vulnerability discovery and exploitation workflows,” Google wrote. While Google’s report aimed to warn about the growing risk of AI-powered cyberattacks, some researchers argue that the fear is overblown. A separate study led by Cambridge University of over 90,000 cybercrime forum threads found that most criminals were using AI for spam and phishing rather than vibe coding sophisticated cyberattacks. “The role of jailbroken LLMs (Dark AI) as instructors is also overstated, given the prominence of subculture and social learning in initiation - new users value the social connections and community identity involved in learning hacking and cybercrime skills as much as the knowledge itself,” the study said. “Our initial results, therefore, suggest that even bemoaning the rise of the Vibercriminal may be overstating the level of disruption to date.” Despite Cambridge’s findings, however, the Threat Intelligence Group’s report also comes as Google has faced security concerns tied to AI-powered tools. In April, the company patched a prompt injection flaw in its Antigravity AI coding platform that researchers said could let attackers execute commands on a developer’s machine through manipulated prompts. “Although we do not believe Gemini was used, based on the structure and content of these exploits, we have high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability,” Google researchers wrote. Earlier this year, Anthropic restricted access to its Claude Mythos model after tests showed it could identify thousands of previously unknown software flaws. The findings also add to growing concerns that AI models are reshaping cybersecurity by helping both defenders and attackers find vulnerabilities faster. “As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus,” Mozilla wrote in a blog post in April. “For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up.”

資料狀態✓ 已擷取全文閱讀原文（Decrypt）

🔍歷史類似事件· 關鍵字 + 標的比對6 則

2026-04-28

Google DeepMind 前員工籌集 11 億美元，旨在打造無需人類數據訓練的 AI

相似度 100%關鍵字 build/google

2026-04-26

Litecoin 發布攻擊後更新，但其他開發者質疑 zero-day 理論

相似度 100%關鍵字 zero/day

2026-04-26

Litecoin 表示其 13 個區塊的 reorg 並非「zero-day」，但 GitHub commit 歷史記錄顯示事實並非如此

相似度 100%關鍵字 day/zero

2026-04-26

Litecoin 表示 13 個區塊的重組並非「zero-day」攻擊，但 GitHub 提交歷史顯示情況並非如此

相似度 100%關鍵字 day/zero

2026-04-25

Litecoin 確認 Zero-Day Bug 導致 13 個區塊的 Reorg，網路已修復並恢復穩定

相似度 100%關鍵字 day/zero

2026-04-20

Chainalysis 指出 DeFi 安全性存在重大盲點，2.92 億美元遭駭事件繞過 Burn Verification

相似度 100%關鍵字 exploit/bypasses

💡 目前用關鍵字 + 標的比對（MVP）· 之後會升級為 embedding 語意搜尋

原始資訊

ID：2564e9accd

來源：Decrypt

發佈：2026-05-11 18:49:10

分類：一般 · 導出分類 neutral

標的：未指定

社群投票：+0 / −0 · ⭐ 0 重要 · 💬 0 留言