Incident·WS-0096·May 11, 2026·in the wild·AI-powered cyberattacks
Criminals deploy AI-built zero-day in planned mass hack
42/100
WS-3 SeriousHarm score 25, signal score 62. Autonomy: acted (the AI took a bounded action). How the scores work.
Harm 1/5
damage actually done
Reach 2/5
who was affected
Autonomy 2/4
how much the AI did on its own
Novelty 4/5
how new the behavior was
Permanence 1/5
how hard it is to undo
Google's threat intelligence group reported a criminal group using a zero-day exploit it assessed was likely developed with AI, aimed at a popular open-source web administration tool as part of a planned mass-exploitation campaign. Google worked with the vendor to disclose the flaw early, which it says may have prevented wider use; its chief analyst warned that many more AI-found zero-days are likely out there.
Damage
Planned mass exploitation largely pre-empted
The capability behind it
- Big Sleep finds a previously unknown SQLite flaw, a first for AI agentsNov 1, 2024 · Google Project Zero / Google DeepMind · reliable for a defined task: partial
Sources
TechWire Asia (Google GTIG), second source.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
