The hack gave itself away by being too polite. Too many notes in the code. A textbook layout. A fake risk score it made up on its own.
Google's threat team spotted the patterns. They tied the code back to a Python tool built to break the login check on a popular web admin system.
Google's threat team, known as GTIG, said the code has "an abundance of educational docstrings, including a hallucinated CVSS score." That means too many notes and a fake risk score.
The format was textbook neat - the kind only large language models write at scale.
In plain English: the code looks like an honors student wrote it. Real hackers do not write code that clean.
The bug itself is another tell. It is a logic flaw, the kind AI is good at finding. Bugs found by tools that test a system at random tend to come from humans.
GTIG also ruled out Gemini as the model used. The real model is still unknown.
But the structure left enough clues for Google to spot the tool before it could spread. Google then tipped off the maker of the admin tool so the bug could be fixed.
For investors, the message is clear. AI now shows up on both sides of the cyber fight - in the tools that catch threats, and in the tools that build them.
If you want a daily read on how AI is reshaping cyber and the markets, Market Briefs has you covered - five minutes a day, plus a free investing masterclass when you join.
GTIG called this the first case where it caught a hacker using an AI-built zero-day. A zero-day is a flaw no one has seen before.
But this is not a one-off. China and North Korea have groups doing the same thing - APT27, APT45, UNC2814, UNC5673, and UNC6201. They all use AI to find bugs and build hack tools.
Russia-linked groups use AI to draft fake code that hides their malware, with two named CANFAIL and LONGSTREAM. There is also "Overload," a Russian plot that uses AI voice clones to fake real news anchors in videos that push anti-Ukraine claims.
The worst part is not a single hack. It is the scale.
Google says hackers are now ramping up access to top AI models. They use bots to make accounts, route through proxies, and pool logins to hide who is using them.
For investors in cyber stocks, this is the bull case. The same firms that defend against AI tools also use AI to detect them.
The hack on the admin tool was stopped before it spread. The next one likely will not give itself away with sloppy notes.
For a daily morning read on the moves shaping cyber, AI, and your investing radar, sign up for Market Briefs and get a free 45-minute investing course thrown in.
