AI Is Now Writing Exploits — Inside the First AI-Powered Zero-Day Attack

AI Zero-Day Attack Timeline 2026

On May 11, 2026, Google’s Threat Intelligence Group confirmed what cybersecurity experts had been warning about for years: a criminal group used AI to build a working zero-day exploit targeting a widely-used web administration tool. Google intercepted it before deployment in what they described as a planned “mass exploitation event.” Three days later, Pwn2Own Berlin 2026 opened — and promptly broke records. Researchers uncovered 39+ zero-days in just two days, earning over $908,000 in bounties. For the first time in its 19-year history, the contest hit full capacity, with 150+ researchers turned away. Some released their exploits publicly in retaliation. AI is no longer just defending networks. It’s now attacking them.

What Happened — Google’s AI Zero-Day Discovery

On May 11, Google’s Threat Intelligence Group published a landmark finding: a cybercrime group had used an AI system to generate a working zero-day exploit. The target was a widely-used open-source web-based system administration tool. The exploit leveraged a semantic logic error — a type of vulnerability where individual code components work correctly, but their combined behavior creates an exploitable flaw.

What makes this different from previous AI-assisted hacking attempts is that the AI didn’t just help find the vulnerability — it helped construct the exploit chain itself, connecting application behaviors that could be abused together. Google blocked the exploit before it could be deployed.

Why this is a turning point

Previous AI involvement in cybersecurity was mostly defensive — scanning code, detecting anomalies, prioritizing patches. This is the first confirmed case where AI was used offensively by criminals to build a zero-day from scratch. The barrier to creating sophisticated exploits has dropped dramatically. You no longer need a team of elite hackers — you need an AI model and the right prompts.

Pwn2Own Berlin 2026 — The Numbers

Just days after Google’s announcement, Pwn2Own Berlin 2026 proved the point at scale. The world’s most prestigious hacking competition, run by Trend Micro’s Zero Day Initiative (ZDI), saw an unprecedented flood of submissions.

1

Day One — 24 Zero-Days, $523K

Windows 11, Microsoft Edge, and LiteLLM all fell

DEVCORE’s Orange Tsai chained 4 logic vulnerabilities to execute a full sandbox escape on Microsoft Edge, earning $175,000. Windows 11 was compromised through heap-based buffer overflows and use-after-free bugs. LiteLLM, an AI framework, fell to a 3-bug chain including SSRF and code injection.

Edge sandbox escapeWindows 11 hackedAI platforms targeted
2

Day Two — 15 More Zero-Days, $385K

Cursor, LM Studio, OpenAI Codex exploited

AI coding tools became prime targets. Researchers exploited Cursor (the AI code editor), LM Studio (local inference platform), and OpenAI Codex. Combined totals: $908,750 paid, 39 unique zero-days confirmed, and DEVCORE leading with 40.5 Master of Pwn points.

39+ zero-days total$908K+ bountiesAI track new for 2026

The Overflow Crisis — 150+ Researchers Rejected

For the first time in 19 years, Pwn2Own ran out of slots. ZDI closed registration on May 7 because they simply couldn’t process more submissions within the 3-day contest window. Over 150 researchers were turned away.

The result? A wave of “revenge disclosures.” One group alone — xchglabs — had 86 vulnerabilities ready for NVIDIA, Docker, Linux KVM, and PyTorch. Unable to compete for the million-dollar prize pool, they began releasing findings publicly and directly to vendors.

Why this matters for everyone: These aren’t theoretical risks. The vulnerabilities disclosed outside Pwn2Own target infrastructure that powers AI training, container orchestration, and enterprise GPU computing. Until vendors patch them, they represent live attack surfaces. AI-assisted vulnerability research is now generating exploits faster than any institution can triage them.

AI Targets at Pwn2Own 2026

This year’s competition introduced 4 dedicated AI categories for the first time — a recognition that AI platforms are now critical attack surfaces:

Pwn2Own Berlin 2026 — AI Categories

AI Coding Agents: Claude Code, GitHub Copilot, Cursor
Local Inference: Ollama, LM Studio
AI Databases: Vector stores
NVIDIA Infrastructure: CUDA Toolkit, NV Container Toolkit, Megatron Bridge

These tools are now running inside enterprise environments worldwide. A vulnerability in Cursor or Copilot could compromise every developer using them.

What This Means for You

The New Threat Landscape

• AI lowers the skill barrier for building exploits
• Zero-days are being found faster than they can be patched
• AI tools themselves are becoming attack targets
• “Revenge disclosures” create unpatched public vulnerabilities

How to Protect Yourself

• Update all software immediately when patches drop
• Enable automatic updates on OS, browsers, and AI tools
• Use a password manager + hardware security keys
• Monitor AI tool changelogs — they’re now attack vectors
• For enterprises: audit AI tool permissions and network access

Key Takeaways

1

AI built a zero-day. Google confirmed the first known case of criminals using AI to create a working exploit. It was intercepted before deployment.

2

39+ zero-days at Pwn2Own Berlin. $908K+ in bounties across 2 days. Windows 11, Edge, Cursor, LM Studio, and OpenAI Codex all compromised.

3

First-ever Pwn2Own capacity crisis. 150+ researchers rejected. Some released 86+ vulns publicly in retaliation — a “revenge disclosure” wave.

4

AI platforms are now attack surfaces. Pwn2Own 2026 added 4 AI categories: coding agents, local inference, vector databases, and NVIDIA infrastructure.

5

Update everything, now. AI is finding vulnerabilities faster than humans can patch them. Automatic updates and proactive security hygiene are non-negotiable.

For full Pwn2Own Berlin 2026 results, visit the Zero Day Initiative Blog.

Frequently Asked Questions

What is a zero-day exploit?
A zero-day is a software vulnerability unknown to the vendor — meaning there are “zero days” of available patches when it’s discovered. Zero-days are the most dangerous type of security flaw because there’s no fix available when attackers use them. They’re the digital equivalent of breaking into a house through a door the homeowner didn’t know existed.
How did AI build an exploit?
The AI system analyzed the target software’s behavior patterns and identified a semantic logic error — where individual code components work correctly but their combined behavior creates a vulnerability. The AI then constructed an exploit chain that abused this logic gap. It essentially automated what would typically take a skilled hacker days or weeks of manual reverse-engineering.
Should I stop using AI coding tools like Cursor or Copilot?
No — but you should treat them as security-sensitive software. Keep them updated, review their network permissions, and be aware that they now process code in ways that could be exploitable. The Pwn2Own results showed that these tools can be compromised through code injection and other attacks. Use them, but update them immediately when patches are released.
What are “revenge disclosures” and why should I care?
When researchers couldn’t compete at Pwn2Own due to capacity limits, some chose to release their working exploits publicly rather than sit on them without compensation. This means zero-day vulnerabilities in NVIDIA, Docker, Linux KVM, and AI frameworks are now publicly known — potentially before vendors have patches ready. It increases risk for anyone running these systems.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top