The exploit wrote itselfThe exploit wrote itselfThe exploit wrote itselfThe exploit wrote itselfThe exploit wrote itselfThe exploit wrote itselfThe exploit wrote itself

On 11 May 2026 Google’s Threat Intelligence Group published what it assesses with high confidence to be the first public case of an AI-developed zero-day exploit deployed in a real-world attack. The target was an open-source web-based sysadmin tool; the bug was a semantic logic error that let the attacker bypass two-factor enforcement entirely.

Note what kind of flaw that is. Not a buffer overflow a fuzzer stumbles into — a reasoning bug, the kind you find by understanding what the code is supposed to mean and noticing where the meaning and the control flow disagree. That is the category everyone assumed would stay human longest.

The defensive side got there first

This did not arrive without warning. Google DeepMind’s Big Sleep found a real exploitable memory-safety bug in SQLite back in 2024, in code that had survived years of human review. In April 2026, Anthropic previewed a model that finds and exploits zero-days across every major OS and browser, including a 27-year-old denial-of-service issue in OpenBSD’s TCP SACK handling.

The reported figures on that work are the part worth sitting with: findings of that class, at a total compute cost in the thousands of dollars. Not thousands of hours of a specialist’s attention. Thousands of dollars.

What actually changed

Nothing about what is possible. Everything about the ratio.

• Discovery used to be scarce because the people who could do it were scarce. That constraint is loosening on both sides simultaneously.
• Old code got less safe overnight. Not because it changed, but because systematic review of a large codebase stopped being expensive. Every decades-old daemon is now in scope for anyone with an API key.
• Patch windows compress. If discovery-to-exploit collapses from months to days, a quarterly patch cycle is a fiction with a calendar invite.

The asymmetry, honestly

Defenders get more from this than attackers, on paper: you can audit your own code before anyone else does, and you know where it lives. But defenders have to fix everything and attackers need one. Cheap discovery multiplies both sides, and the side that only needs one gets more out of a multiplier.

The tooling is symmetric. The job never was.