# Hackers Are Now Using AI to Find Software Flaws — and Google Just Confirmed It
For the first time, Google has officially documented what many cybersecurity experts have long suspected: criminal hackers are actively using artificial intelligence to discover and weaponise previously unknown software vulnerabilities. The disclosure, made in a security report published Monday, marks a significant turning point in the ongoing battle between defenders and attackers in the digital world.
## A New Era of Cyber Threats
According to Google’s report, a criminal hacking group recently leveraged AI models to identify and exploit a previously undisclosed bug — a so-called “zero-day” vulnerability — in an attempt to launch a widespread cyberattack. Google said it has “high confidence” that the attackers used an AI system to support both the discovery and weaponisation phases of the exploit.
“We have high confidence that the actor likely leveraged an A.I. model to support the discovery and weaponization of this vulnerability,” Google said in its published findings. The admission represents an official confirmation that AI has crossed the threshold from a theoretical threat to an operational tool in the criminal hacking ecosystem.
The revelation arrives as the cybersecurity industry grapples with a rapidly expanding attack surface. AI systems are now embedded in everything from enterprise software to consumer gadgets, and the same technology that helps companies automate defences is now being turned against them by adversaries with fewer ethical constraints.
## How AI-Powered Hacking Works
Traditionally, discovering a zero-day vulnerability required significant expertise, time, and resources. Hackers would spend weeks or months poring over code, running automated scanning tools, and manually testing systems for weaknesses. The process was labour-intensive and required a relatively high level of technical skill.
AI changes that calculus dramatically. Large language models and specialised AI systems can now scan enormous codebases in minutes, identifying patterns and potential weaknesses that would take human researchers days or weeks to uncover. More troublingly, AI can generate exploit code — the actual programming needed to turn a vulnerability into an attack — at speeds that make traditional patch-and-response timelines dangerously inadequate.
Security researchers note that this capability is particularly concerning because it lowers the barrier to entry for sophisticated cyberattacks. Groups that previously lacked the resources to develop zero-day exploits can now rent AI capabilities or use freely available models to achieve similar results.
## The Race Between Attack and Defence
The Google disclosure has intensified debate within the cybersecurity community about how to respond to AI-augmented attacks. Current defences — even those enhanced by AI — are largely reactive. Security teams discover a vulnerability, develop a patch, and distribute it to affected systems. That process, which can take days or even weeks in complex enterprise environments, creates a window of opportunity that AI-powered attackers can exploit with increasing efficiency.
Some experts argue that the solution lies in shifting to proactive, AI-driven defensive systems that can identify and neutralise vulnerabilities before they are weaponised. Others point to the fundamental challenge: defenders must protect everything, while attackers only need to find one weakness.
The implications extend beyond corporate cybersecurity. Critical infrastructure — power grids, water treatment facilities, hospital networks — represents particularly attractive targets for both state-sponsored and criminal hackers using AI tools. A successful attack on any of these systems could have consequences far beyond financial loss, raising the stakes considerably for everyone involved.
## Industry Response and What Comes Next
Google’s findings have prompted renewed calls for faster coordination between technology companies, government agencies, and security researchers. The company has shared details of the vulnerability with relevant industry partners and is working to develop mitigations. However, the broader question of how to prevent AI from accelerating the discovery and exploitation of software flaws remains largely unanswered.
Several cybersecurity firms have accelerated their own AI-powered defence research in recent months, developing systems designed to predict and prevent AI-assisted attacks before they occur. Yet the asymmetry between offence and defence in the AI era remains a fundamental challenge that no single company or government agency appears close to solving.
For now, the message from Google is unambiguous: AI is no longer a theoretical tool in the hacker toolkit. It is operational, actively deployed, and producing results. The race to secure the digital ecosystem has entered a new and more dangerous phase — and the outcome is far from certain.
