New report by Google Threat Intelligence Group (GTIG):

• For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.

• AI-driven coding has accelerated the development of infrastructure suites and polymorphic malware by adversaries.

• AI-enabled malware signal a shift toward autonomous attack orchestration, where models interpret system states to dynamically generate commands and manipulate victim environments.

• Adversaries continue to leverage AI as a high speed research assistant for attack lifecycle support

• Adversaries have begun targeting AI environments and software dependencies as an initial access vector.