Google Just Caught Hackers Using AI To Break Two-Factor Login

The same AI writing your work emails is now being used to break into your accounts.

Google said it caught a hacker group using an AI tool to find a zero-day flaw. That's a software bug nobody knows about yet.

This one broke past two-factor login. The plan was a "mass exploitation event" before anyone caught on.

How They Pulled It Off

Google's Threat Intelligence Group, known as GTIG, said in a Monday report it had "high confidence" the hackers used an AI tool to spot the bug. The group then used the AI to write code to exploit it.

The result was a way around two-factor login. That's the second step that's supposed to keep accounts safe even if a password gets stolen.

Google didn't name the group. But it did say Gemini, its own AI model, was not used.

The hackers leaned on a third-party tool called OpenClaw. It's the kind of AI now widely available to anyone with a credit card.

We track the moves in cyber and AI that actually matter for investors in Market Briefs, every weekday morning. New subscribers also get a free investing masterclass.

The Bigger Pattern

This is the part the cyber industry has been bracing for.

In April, Anthropic delayed the rollout of its Mythos model. The firm warned that bad actors could use it to dig up old, unpatched software bugs at scale.

That move set off White House meetings with tech and business leaders.

Anthropic has since opened Mythos up to a small group of testers. The list includes Apple, CrowdStrike, Microsoft, and Palo Alto Networks - all names investors track in the cyber space.

Last week, OpenAI rolled out GPT-5.5-Cyber to a small group of vetted cyber teams. It's a hint at where defenders are headed too.

Google also flagged something worth watching. Hacker groups tied to China and North Korea are showing "significant interest" in using AI to find software flaws.

Why Investors Should Care

The cyber industry is already pouring billions into AI-powered defense. The story Google just told is the reason.

Every new AI-driven attack makes it easier for cyber firms to sell more software. CrowdStrike, Palo Alto Networks, and Microsoft sit at the front of that trade.

They're the firms building the AI tools defenders will use to fight back. They also sell to the same big names that would be hit hardest in a "mass exploitation event."

The big risk for investors isn't a single breach. It's the chance that a name they own gets caught flat-footed.

Some firms will spend big to keep up. Others will fall behind.

The gap between the two is the trade.

Worth Noting

For years, the arms race was one team finding bugs while the other patched them. AI just sped both sides up at once.

Google said it's seeing more of these cases, not fewer. The Monday report from GTIG was the first time it confirmed an AI tool was used to plan an attack at scale.

It probably won't be the last. Cyber teams across the world are still figuring out how to spot AI-driven attacks before they go wide.

The next "mass exploitation event" might not get caught in time.

If you want a daily read on stories like this delivered every morning, join 350,000+ investors reading Market Briefs. A 45-minute investing course comes with it as a bonus.