back
177 comments
> “We have high confidence that the actor likely leveraged an A.I. model to support the discovery and weaponization of this vulnerability,” the report said.

I wonder what gives them that "high confidence", as opposed to this being just a traditional zero-day?

I'm not being snarky or critical, I'm genuinely wondering what about an attack could possibly indicate it was discovered with LLM assistance?

Like, unless the attackers' computers have been seized and they've been able to recover the actual LLM transcript history? But nothing in the article indicates that the hackers have been caught, just that a patch was developed.

From Google's GTIG report: https://cloud.google.com/blog/topics/threat-intelligence/ai-...

"Although we do not believe Gemini was used, based on the structure and content of these exploits, we have high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability. For example, the script contains an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLMs training data (e.g., detailed help menus and the clean _C ANSI color class) "

> I wonder what gives them that "high confidence", as opposed to this being just a traditional zero-day?

Google, Cloudflare, and Microsoft are a trio of companies that get to see most of what's going on the internet. I imagine that if they see you attacking them, they can work back from that and get remarkably far, even against sophisticated actors. If it's their LLM, they presumably keep transcripts. If you searched for the affected API function via a search engine, they almost certainly know. Even if you used a competing search product, you probably went to a site that has Google Analytics. Oh, and one of these companies probably has your DNS lookups. And a good chunk of the world's email traffic. And telemetry from your workstation. And auto-uploaded crash reports... And if it's bad, they can work together behind the scenes to get to the bottom of it.

So, when their threat intel orgs say they have high confidence in something, I'd be inclined to believe it.

Well, it’s great marketing for LLM products at the enterprise level. Even if they weren’t sure, they have every incentive to run with it now, and the issue a “whoopsie daisy” apology later after the tech media stopped paying attention.
The article strongly implies they have the (Python) source code, and that it looks LLM generated. I don't know about you, but I can usually tell LLM code from a mile away.
We are going to be seeing a lot of these moving forward. It's the easy way out. If you've worked with Google, you will know that it's an environment where accountability doesn't thrive. You will find people who know nothing about Google's product portfolio hold advisory roles around the products. They don't care, there's no one to even question them. They just know to make colourful graphs with the most useless metrics to justify they "add value" to the company. Expecting them to take accountability is like trying to mix oil and water.
Maybe after they realized how they were vulnerable they asked an LLM to find the exploit through a similar means to try and replicate it. Still doesn't prove it but maybe gives them confidence this weird thing can only really be found that way etc.
The article says it included excessive explainer text. And I'm almost positive an earlier version of the article referenced hallucinated library references though I don't see it in the present version of the article.
Humans can sometimes find a needle in a haystack, but its impossible for us to find multiple needles in multiple haystacks and chain them together into an attack. AIs can work through a complex search space much more efficiently, that's the tell.
Presumably the attacker used Google's own LLM and they searched the history of all user chats to find the transcript.

I say this only slightly in jest, as that's about the only thing I can think of which would legitimately give them 'high confidence'.

Haven't read the article, but let me guess:

"That's why for your safety we need a scan of your ID and your biometrics to let you use our best models"

It's the narrative "For your own security in the internet (and children's safety), show us your ID now, please".

Tired of this trend.

I wonder what is the goal here? If Google Search was used to find a major software flaw would this be reported in this way? Between Mythos, OpenAI's Mythos equivalent, it's not clear if there is some interest to keep the "AI is powerful" trend going or they are trying to indirectly bring attention to the technical capabilities of LLMs in cybersecurity (as a potentially untapped source of revenue).
Okay, when fuzzing techniques came out there was a big surge in discovered and exploited bugs. AI is more general and I expect there be a similar surge. However fuzzing is cheap but compute and techniques can be "owned." The economics of AI is unless you pay for it, it is difficult to self host (expensive hardware, open source models are catching up).

State actors + hackers will have more resources to make better offense. What worse, in my experience AI produced code is blind to overall system behavior. So I fear the exploits will be either low hanging/trivial to exploit errors or bigger system level bugs.

>But new A.I. models like Anthropic’s Mythos, which was announced last month, appear to be so good at finding such holes that Anthropic shared it only with a limited number of firms and government agencies in the United States and Britain.

Immediate distrust of the article. GPT 5.5 is out with nearly the same capability. The author might be parroting company marketing, unable to discern that a lot of this is much less complex than it seems. For all we know this group could have had a model examine some obscure line of code thousands of times until it found something.

Do they have high confidence the actor used a keyboard? Used the bathroom at some point during the attack? Has a mother?

Idk, this doesn’t strike me as news. Google just missed a vulnerability.

Black hat hacking seems to be a well-fit use case for these LLMs. Attackers only need to be right once, so the sometimes-wrongness of the attacks might be trivial. This probably devalues stashes of zero-day exploits for those that have been witholding them.
Meanwhile, I cannot ask ChatGTP how to pick my own lock. Even though this information is available in a book in the library.
This will only keep happening, I know some people are skeptical as to what level of function the AI was used, whether it was to write code, or to do the hack, it really doesn't matter, the fact that anyone can use AI to do this, hell people nuke their prod systems with AI, should have every company worth its salt investing in security audits, code scanning and anything they can to find exploits before some 14 year old somehow breaks into your system with AI and wreaks chaos over your infrastructure.

Are you one bad headline away from a major hack? Or worse, one hack away from your company going under? It's all a ticking time bomb.

Someone else on HN pointed out that distros like Debian might be too slow as people find live exploits in the kernel, it might not be worth keeping something like that, on the other hand Ubuntu supports live kernel upgrading at the enterprise level, so maybe Ubuntu Server might be Debian's indirect saving grace.

Article says that it was largely a theory until now. That's not entirely true, we know that hackers used Claude to hack the Mexican government, got the PII of every citizen basically. I would not be surprised if there's more hacks that are undetected. The hackers don't need to declare their use of AI, its irrelevant.

Source: https://cloud.google.com/blog/topics/threat-intelligence/ai-... (https://news.ycombinator.com/item?id=48096712)

Why collect all the news dupes but not the source up top OP? Because the source was already submitted?

Can we link to the actual google article, instead of these editorialized articles about the article?

https://cloud.google.com/blog/topics/threat-intelligence/ai-...

@dang would be great if the hn link was the 'unlocked' version i.e. instead of

https://www.nytimes.com/2026/05/11/us/politics/google-hacker...

this instead

https://www.nytimes.com/2026/05/11/us/politics/google-hacker...

(can read the article immediately; slightly less fuss)

> Google said in research published Monday

What research? Where is it published?

So google is accusing an AI company that has a customer who is paying them money to develop software that caused damages. Sounds like the AI company could be liable?

If I am paid by someone to create an exploit that caused damages wouldn't I be liable? Or could I avoid it by making my client sign a terms of service agreement to not use it that way?

Who created the model and who helped with GPU power to run the model to create the export and should they be doing more.

Next headline: Google will not be releasing their next AI model to the public but only "trusted" partners, because it's too dangerous.
To make an omelette, some eggs need to break, right? These companies released AI to the public and thought it will be all sunshine and roses.. there are legit bad actors in the world that hates society and people and they will use AI for expand on that, is that not clear? We need controls on AI similar to any other restricted materials (like nuclear stuff).
I expect that only to escalate with time, especially when there'll be more agent-written code deployed.
There was a discussion a few days ago on White House considers vetting AI models prior to release (https://news.ycombinator.com/item?id=48013608).
Phasing like this immediately makes me wonder what google is lobbying for..
Wild that they think restricting access to models will help much. Access to Chinese models will definitely not be restricted and have enough capability to find exploits as well.
Security will be a wedge to restrict the sophistication of open-weight and local LLMs, just as it's been used to demonize and restrict cypherpunk technologies.
Drives me nuts that the NYT just uncritically cites Anthropic’s unverified claims of “thousands of zero-days” without a hint of skepticism.
People used LLMs to find flaws in Google software.
In past decades the "firewall" of software is that advanced security and coding knowledge is not very easy to access by anyone, only a few smartest people in the big name companies and top orgs. But nowadays, knowledge is accessible to everyone if you use top LLM, which swipe the difference. I would say that future public software is unsafe anymore. maybe the concept of public software (like SaaS or other) will be dead, software is only private instead of public
If "bad guy AI" can find flaws, can "good guy AI" patch them faster when backed by trillion dollar companies?
If this is true, I hope AI exploit-finding will force the industry to harden itself against supply-chain vulnerabilities.
But in exchange we get to also waste vast energy and carbon while depleting job prospects for just about any college grad.
Hackers use AI to find vulnerabilities to exploit. What’s the news here?
Given how everywhere software is now being written by the LLMs, how is that a top headline news that some (albeit malicious) software is being written with LLM?

The robbers used a CAR in the robbery.

The blackmailer used a TYPEWRITER to write blackmailing letter.

This is your reminder that the security model underlying everything these days is crap. Ambient authority was fine for stand alone PCs without persistent internal storage. It's just stupid to use it in the 21st century.
I stopped reading after "Google says". They have destroyed whatever trust I might have had in them years ago.
What a surprise hackers used AI . I mean why wouldnt they? Every programmer uses it..
Wait until the bio version of this shows up.
"And the only prescription..'