Editorial illustration for Google stops attack after AI finds zero‑day; China, North Korea also using AI
Google stops attack after AI finds zero‑day; China,...
Google's threat hunters intercepted a mass cyberattack this month. Their key tool? Artificial intelligence.
The tech giant's Threat Intelligence Group used it to unearth a critical zero-day flaw before hackers could strike, according to a new report released Tuesday. That same report delivers a stark, named finding: state-backed operatives from China and North Korea are now actively deploying similar AI tools for their own attacks.
A new report from Google's Threat Intelligence Group (GTIG) details how attackers are using AI at scale for cyberattacks. For the first time, GTIG identified a threat actor who reportedly used AI to discover and weaponize a zero-day vulnerability.
This is operational. Groups linked to Beijing and Pyongyang have moved beyond testing, Google's findings show. They're using AI to pinpoint software vulnerabilities and craft convincingly malicious phishing campaigns.
That parallel development creates a dangerous symmetry—putting offensive and defensive tools on the same brutal technological footing. The result is a collapsing timeline: the window between discovering a flaw and weaponizing it is slamming shut.
Related Reading
Browse all Google news →
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Open Source OpenAI's GPT Transcribe Cuts Error Rate to 3.31%, Improving on GPT-4o
Open Source Study: 6.7% of Deepfake Requests on Hugging Face Targeted Children
Related Topic NVIDIA and Google Cloud let developers scale AI from prototype to production
Market Trends
Related Topic Google tests visual 'magazine-style' UI for Gemini 3 Pro users
LLMs & Generative AI
From Archives GM lays off IT staff, hires AI talent with Aurora co‑founder Sterling Anderson
From Archives Anthropic links 'evil' AI portrayals to Claude's blackmail, cites misalignment
From Archives Google's Chrome 4GB on-device AI model unchanged, but explanation lacking
LLMs & Generative AI
From Archives Google's Gemini Nano auto-uninstalls on low-resource Chrome devices
LLMs & Generative AI
Common Questions Answered
How did Google's Threat Intelligence Group use AI to stop the cyberattack?
Google's Threat Intelligence Group deployed artificial intelligence tools to unearth a critical zero-day flaw before hackers could exploit it during a mass cyberattack. By using AI to identify the vulnerability proactively, Google was able to intercept and stop the attack before it could cause damage.
What AI capabilities are state-backed operatives from China and North Korea using for attacks?
According to Google's report, operatives linked to Beijing and Pyongyang are actively using AI tools to pinpoint software vulnerabilities and craft convincingly malicious phishing campaigns. These groups have moved beyond testing phases and are now operationally deploying AI for offensive cybersecurity purposes.
What does the 'collapsing timeline' mean in the context of zero-day vulnerabilities?
The collapsing timeline refers to the rapidly shrinking window between when a software flaw is discovered and when it can be weaponized by attackers. As both defensive and offensive AI tools become equally sophisticated, the time available for security teams to patch vulnerabilities before they're exploited is dramatically decreasing.
Why does the parallel development of AI tools by both Google and state-backed groups create a dangerous symmetry?
The dangerous symmetry occurs because both defensive and offensive actors now have access to similarly advanced AI capabilities for cybersecurity purposes. This technological parity eliminates the traditional advantage defenders had, putting offensive and defensive tools on the same brutal technological footing and intensifying the cyber threat landscape.
