In May 2026, Google Threat Intelligence Group announced an unprecedented result: it blocked the first zero-day exploit developed with the help of artificial intelligence. The attack was meant to target an open-source web administration tool, with the goal of bypassing two-factor authentication at scale.
This episode marks a structural shift in the digital threat landscape. Cybercriminals are adopting language models to speed up the writing of malicious code. But the same AI tools are already being used for defense. Google's researchers identified the AI's fingerprint in the exploit by analyzing typical LLM anomalies: a hallucinated CVSS score and overly structured formatting.
In short, Italian SMEs can no longer treat cybersecurity as a topic reserved for large enterprises. At SHM Studio, we constantly monitor how digital risk evolves so we can help our clients build a secure, resilient online presence. Understanding this turning point is the first step toward adopting the right countermeasures.
What has changed: AI enters the offensive arsenal
Until a few months ago, the use of artificial intelligence in cybersecurity was mainly associated with defense. But a report published by The Verge in May 2026 flipped that perspective. Google Threat Intelligence Group (GTIG) said it had detected and neutralized the first zero-day exploit developed with the help of a large language model.
The exploit targeted an open-source web administration tool that has not yet been publicly identified. The goal was to bypass two-factor authentication in a mass exploitation event. In other words, it was an attack designed to hit a large number of vulnerable instances at the same time.
This episode is not an isolated case to be quickly filed away. On the contrary, it's a sign of a break from the past that deserves close analysis, especially for Italian SMEs that manage exposed web infrastructure.
How researchers spotted the AI's signature
The GTIG team identified the fingerprint of artificial intelligence by analyzing the Python script used for the exploit. Two elements caught the analysts' attention.
- A hallucinated CVSS score: the vulnerability's severity score was generated incorrectly, with apparent precision but essentially made up. This behavior is typical of LLMs when they work with unverified technical data.
- Textbook formatting: the structure of the code and comments was overly tidy, consistent with the output patterns of language models trained on standardized technical documentation.
So AI did not write the exploit on its own. Rather, it sped up and structured the work of already skilled criminal actors. This distinction matters: it lowers the barrier to entry for anyone who wants to carry out sophisticated attacks.
Also, as MIT Technology Review points out, the democratization of AI tools is narrowing the technical gap between expert cybercriminals and less qualified actors.
The immediate impact on the digital threat landscape
This episode has direct implications on three levels. First, it changes the speed at which exploits are produced. A malicious actor can now delegate the code prototyping phase to AI, cutting development time.
Second, it changes the risk profile of open-source technologies. Web administration tools, CMSs, frameworks and plugins are prime targets precisely because they're so widely used. As a result, a vulnerability exploited with AI can quickly scale across thousands of installations.
Finally, it changes the defensive model we need. Traditional solutions based on signatures and periodic updates are no longer enough. According to Gartner, global spending on cybersecurity keeps growing, but the speed at which defenses adapt struggles to keep pace with the speed of attacks.
What to do now: the risk perimeter for Italian SMEs
Italian SMEs often operate with limited IT resources. That doesn't make them a secondary target. On the contrary, their lower ability to respond makes them attractive targets for automated, scalable attacks.
In particular, companies that use open-source tools to manage their website, CRM or e-commerce should consider a few priority actions.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
