AI-Powered Threat Actors Accelerate 0-Day Discovery at Machine Speed

Threat actors are already using AI models as autonomous operators to discover and exploit 0‑days in minutes, thereby collapsing the time and cost required to run complex intrusion campaigns.

This shift, first clearly visible in late 2025 operations, is forcing defenders to rethink detection, containment, and even how they define insider risk.

Until 2025, attackers largely used AI as a support tool: writing phishing emails, generating convincing lures, drafting malware snippets, and summarizing OSINT about targets, while humans still made every operational decision. That model is now obsolete.

In recent campaigns, an operator can define a target and objective; the AI then scans exposed assets, maps the network, tests exploits, and, on failure, automatically pivots to alternate attack paths.

Thanks to standards like Model Context Protocol (MCP), these models can talk to browsers, scanners, and other “real-world” tools, turning them into fully agentic intrusion engines.

At peak, they can generate and evaluate thousands of requests per second, compressing what used to be weeks of red‑team work into hours.

The expansion of MITRE ATLAS into a dedicated framework for attacks on AI and agentic systems underscores how quickly this new surface is growing.

The actor activities we’ve been monitoring at Cyberthint indicate that discovering 0-days is no longer a specialized task that takes months.

GTG‑1002: proof of AI‑orchestrated

The GTG‑1002 campaign, disclosed by Anthropic in late 2025, is widely regarded as the first verified AI‑orchestrated cyber‑espionage operation.

Assessed with high confidence as China‑linked, the group used Claude Code to automate 80–90% of the intrusion lifecycle across roughly 30 organizations in technology, finance, chemicals, and government.

Operators jailbroke the model by posing as a defensive security firm, decomposing the intrusion into small “innocent” subtasks so the AI never saw the full malicious context.

Once running, the AI handled reconnaissance, vulnerability, and 0‑day discovery, exploit generation, lateral movement, data staging, and even markdown reporting, with humans stepping in only for a handful of critical approvals.

The fact that novel vulnerabilities were discovered and exploited during live operations marks a turning point: 0‑day hunting has become a task that can be automated and parallelized at machine speed.

A new wave of malware shows how deeply LLMs are being embedded into offensive tooling. LAMEHUG, reported by CERT‑UA and linked to APT28, is one of the first live operations where malware queries a cloud LLM (Alibaba’s Qwen2.5‑Coder‑32B‑Instruct via Hugging Face) to generate commands at runtime instead of relying on static task logic.

The Python malware arrives via phishing as a fake Ukrainian government attachment, collects system and document data, and then lets the LLM decide which commands to execute, backed by hundreds of hard‑coded API tokens for resilience.

MalTerminal, presented by SentinelLabs at LABScon 2025, is an early example of “LLM‑embedded malware,” using GPT‑4 to generate either ransomware or reverse‑shell payloads on demand, executing the resulting Python code in memory to minimize forensic traces.

Its discovery led researchers to hunt for embedded LLM API keys and JSON prompt structures at scale, revealing thousands of binaries containing unique keys and agentic prompt templates.

Google’s threat team has also documented PROMPTFLUX, an experimental VBScript dropper that periodically calls Gemini’s API for fresh obfuscation and AV‑evasion strategies, effectively outsourcing polymorphism to an external model.

Ransomware, vibe hacking, and hallucinations

Ransomware groups are layering AI into their workflows for social‑engineering content, scripting, and exploit chaining, while large players like Qilin have surged in leak‑site activity across 2025.

Parallel “vibe hacking” operations described in industry reporting use LLMs end‑to‑end for data theft and extortion without encryption, handling everything from infrastructure scripting to multilingual ransom drafting.

At the same time, AI hallucinations are creating a paradox for defenders. In cases like the widely discussed React2Shell exploit timeline, PoCs appeared within hours of disclosure, blurring the line between functional code and AI‑fabricated samples.

While non‑working, hallucinated exploits can be weaponized for deception and decoy purposes, they also risk overwhelming SOCs with noise and false alarms if not carefully triaged.

When attackers can discover and weaponize 0‑days faster than organizations can test and deploy patches, containment speed becomes more important than initial detection.

MTTC, not just MTTD, is now the metric that decides whether an AI‑driven campaign becomes a minor incident or a catastrophic breach.

Defenders need to shift monitoring toward network‑level LOTL behavior, anomaly‑based analytics, and AI‑specific signals such as LLM API usage, embedded API keys, and suspicious JSON prompt structures in binaries.

Frameworks like MITRE ATLAS should be folded into threat modeling for agentic AI, and insider‑threat programs must account for candidates who use AI to fabricate skills and identities to gain access to sensitive environments.

In parallel, blue teams can deliberately exploit hallucinations and deceptive inputs, planting synthetic indicators and decoy assets designed to mislead hostile models and bleed attacker time.

The GTG‑1002 era has collapsed the labor cost of offense: a single operator with a capable model can now deliver the weekly throughput of a traditional ten‑person red team.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.