Google confirms for the first time that hackers used AI to discover major software vulnerabilities

Core conclusion

On May 11, 2026, the Google Threat Analysis Group (TAG) released a report confirming for the first time that a hacker group with a national background used an AI model to discover and weaponize a zero-day vulnerability. This is the first officially confirmed case of “AI-assisted vulnerability discovery and exploitation” in public records. The incident was widely reported by mainstream media such as NYT, AP, and CNBC, and triggered a 99-point hot discussion on Hacker News. The message also mentioned that Anthropic’s Mythos model is outstanding in vulnerability discovery and has been shared with a limited number of institutions in the United States and the United Kingdom.

Key Points

• Event time: 2026-05-11
• Involved organizations: Google TAG, Anthropic
• Core findings: Hackers use AI models to discover and weaponize zero-day vulnerabilities
• Security impact: This is an important sign that AI attack and defense has entered a new stage.

Background and trigger events

The Google Threat Analysis Group stated in a report released on May 11: "We have confirmed with a high degree of confidence that the actor likely used an AI model to help discover and weaponize this vulnerability." The report did not disclose the specific hacker group, but pointed out that the method of discovering the vulnerability is fundamentally different from traditional methods, and the AI model has demonstrated unprecedented capabilities in code analysis and vulnerability pattern identification.

Notably, the Mythos model Anthropic released last month was so good at finding vulnerabilities that Anthropic only shared it with a select group of businesses and government agencies in the United States and the United Kingdom. This shows that the AI ​​security model is becoming a "double-edged sword" - capable of both defense and exploitation by attackers.

Key Impact

Adaptation suggestions

• Immediately assess where AI assistance can be introduced into existing security processes
• Refer to Google TAG's threat analysis report to adjust security priorities
• Add security review for workflows using AI coding tools

Community Perspectives

HN community discussion focus:

• "Security will be a wedge to restrict the sophistication of open-weight and local LLMs" - Security will become an excuse to restrict open-source models
• "Black hat hacking seems to be a well-fit use case for LLMs. Attackers only need to be right once" - Black hat hackers only need to be right once
• Many security practitioners pointed out that this is similar to the emergence of fuzzing technology, and AI will significantly lower the threshold for vulnerability discovery.

Tool entry

The AI/security tools appearing in the text will automatically match the maintained tools library on the platform side: Google, Anthropic, Claude, OpenAI, ChatGPT, DeepSeek, Gemini

Internal link guidance

• Security considerations in AI Agent automated workflows: AI Agent-Driven Content Automation: n8n MCP Building Guide from Scratch
• Real case: Security operation experience of AI automated website — I used n8n + OpenAI to build AI content automation website: a complete review of monthly income $4,500
• Learn how to use AI to assist code security reviews: Claude Code automated writing practice: build an AI content production pipeline in 30 minutes