Google's threat intelligence group has reported that AI-powered hacking has escalated from a nascent issue to an industrial-scale threat within three months. The report highlights that criminal groups and state-linked actors from China, North Korea, and Russia are using commercial AI models, including Gemini, Claude, and OpenAI tools, to refine and scale up attacks.
John Hultquist, chief analyst at Google's threat intelligence group, stated: 'There's a misconception that the AI vulnerability race is imminent. The reality is that it's already begun.' He noted that threat actors are using AI to boost speed, scale, and sophistication, enabling them to test operations, persist against targets, and build better malware.
The report follows Anthropic's decision not to release its Mythos model, citing its ability to find zero-day vulnerabilities in major operating systems and web browsers. However, Google's report found a criminal group on the verge of leveraging a zero-day vulnerability for mass exploitation, using an AI large language model that was not Mythos. The group was also experimenting with OpenClaw, an AI tool known for its lack of guardrails.
Steven Murdoch, professor of security engineering at University College London, suggested that AI could also aid cybersecurity defences, stating: 'That's why I'm not panicking. In general we have reached a stage where the old way of discovering bugs is gone, and it will now all be LLM-assisted.'
Meanwhile, the Ada Lovelace Institute (ALI) has cautioned against assumptions of significant public sector productivity gains from AI. A report published on Monday noted that most studies focus on time savings or cost reductions, not outcomes like better services or worker wellbeing. The ALI recommended that government departments measure AI impact from the start and support longer-term studies.
