A previously unknown threat actor has been identified utilizing a zero-day exploit, likely developed with artificial intelligence, to bypass two-factor authentication in a large-scale attack. This marks the first documented instance of AI being used for malicious vulnerability discovery and exploit generation. The exploit was detected by Google, which has not disclosed the specific vulnerability or affected systems. The threat actor, believed to be a cybercrime group, has been exploiting this zero-day vulnerability, highlighting the rapidly closing window for patching and mitigation. The use of AI in developing this exploit suggests a potentially significant shift in the capabilities of malicious actors, enabling them to develop sophisticated attacks more quickly. This development matters to security practitioners because it underscores the need for immediate assessment of exposure to such threats, as the window for patching is already narrowing1.