Google Reports North Korean Hackers Using AI to Target Cybersecurity Blind Spots
A landmark Google security report reveals that North Korea's elite APT45 hacking group is deploying artificial intelligence at industrial scale — sending thousands of automated prompts to probe cybersecurity blind spots and validate exploits. The same report documents the first-ever AI-built zero-day exploit discovered in the wild.
Introduction: A New Era of AI-Powered Cyber Threats
The line between human hackers and machine-assisted attackers has officially blurred. On May 12, 2026, Google's Threat Intelligence Group (GTIG) released a landmark report confirming what cybersecurity professionals have long feared: state-sponsored hackers — most notably from North Korea — are now using artificial intelligence not just as a research tool, but as a fully integrated weapon in their offensive operations.
The report, titled "Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access," marks a critical evolution from GTIG's February 2026 findings. Where earlier research showed nation-state actors "experimenting" with AI, the May 2026 update describes a maturing shift toward the industrial-scale application of generative AI within adversarial workflows.
Most alarming: for the first time, Google has confirmed the existence of an AI-developed zero-day exploit — a vulnerability unknown to defenders — that a criminal group planned to use in a mass exploitation campaign.
North Korea's APT45: Weaponizing AI at Scale
Thousands of Automated Prompts Targeting Known Vulnerabilities
At the center of the report is APT45, a North Korean state-linked hacking group with a well-documented history of targeting defense contractors, financial institutions, and critical infrastructure. According to GTIG, APT45 has taken AI adoption to an unprecedented level.
Rather than using AI for simple research tasks, APT45 has been observed sending thousands of repetitive prompts that recursively analyze different cybersecurity blind spots — known as CVEs (Common Vulnerabilities and Exposures) — and validate proof-of-concept (PoC) exploits at machine speed. The result is what GTIG describes as "a more robust arsenal of exploit capabilities that would be impractical to manage without AI assistance."
In plain terms: North Korean hackers have figured out how to use AI to automate the most tedious — and most valuable — parts of offensive hacking. What once required teams of skilled researchers working for weeks can now be done in hours.
Agentic Tools and Controlled Testing Environments
GTIG also flagged that APT45 is experimenting with agentic tools — AI systems capable of taking autonomous sequences of actions — including platforms called OpenClaw and OneClaw, used alongside intentionally vulnerable testing environments. This suggests the group isn't just passively querying AI models; they are building structured workflows to refine AI-generated payloads and increase exploit reliability before deployment in the real world.
Targeting Google Services and Defense Contractors
Earlier GTIG findings, which fed into this report, showed North Korean actors using Google's Gemini AI to research how to compromise Gmail accounts and Google services. They also conducted reconnaissance on U.S. and South Korean defense contractors, profiling technical roles, mapping organizational structures, and identifying personnel with access to sensitive systems.
The First AI-Generated Zero-Day Exploit
A Historic — and Alarming — Milestone
Perhaps the most significant finding in the May 2026 GTIG report is the discovery of a zero-day exploit that was developed with the assistance of AI — the first time GTIG has confirmed such an event.
A criminal threat actor group planned to deploy the exploit in a mass exploitation campaign targeting a widely used open-source, web-based system administration tool. The exploit, implemented as a Python script, enabled attackers to bypass two-factor authentication (2FA) on the platform.
Google discovered the operation proactively and worked with the affected vendor to responsibly disclose the vulnerability and issue a patch before the mass exploitation could begin.
"Frankly, the details of this event are not as important as the evidence that the era of adversary use is here. We believe this is the tip of the iceberg. Other AI-developed zero-days are probably out there." — John Hultquist, Chief Analyst, Google Threat Intelligence Group
Read More
Top comments (0)