Case gtig-ai-built-2fa-zero-dayAI-assisted malwareWorldwide
GTIG intercepts first AI-developed zero-day: 2FA bypass in popular open-source admin tool
Criminal actors planned mass exploitation with a Python exploit bypassing two-factor authentication via a hardcoded trust assumption; a hallucinated CVSS score and textbook structure led GTIG to assess it was AI-written.
MediumAttack using AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- May 11, 2026
- Location
- Worldwide
- Target
- Users of an unnamed open-source web admin tool
- Severity
- Medium
- Triggered by
- Unnamed prominent cybercrime actors
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Criminal actors planned mass exploitation with a Python exploit bypassing two-factor authentication via a hardcoded trust assumption; a hallucinated CVSS score and textbook structure led GTIG to assess it was AI-written.
Impact: No victims reported; mass exploitation prevented.
Who triggered it
Actor: Unnamed prominent cybercrime actors
Attribution: GTIG high confidence an AI model authored the exploit; does not believe Gemini was used; actors not named.
Motive: Mass exploitation for financial gain
How it happened
Attack vector: LLM-discovered logic flaw turned into a credentialed 2FA-bypass exploit
Root cause: Developer hardcoded a trust assumption that LLM reasoning about intent could spot where fuzzers could not
Timeline
- GTIG counter-discovers the exploit before deployment
- GTIG publishes the case after responsible disclosure to the vendor
Response
Responsible disclosure to the vendor and disruption of the planned campaign.
Current status: Patched
Sources (open in a new tab)
- GTIG AI Threat Tracker May 2026 cloud.google.com
- Secure Blink coverage secureblink.com
Cite this case
GTIG intercepts first AI-developed zero-day: 2FA bypass in popular open-source admin tool. AI Threat Watch, case gtig-ai-built-2fa-zero-day, May 11, 2026. https://aithreat.io/cases/gtig-ai-built-2fa-zero-day/
Permanent link: https://aithreat.io/cases/gtig-ai-built-2fa-zero-day/