The first AI-built zero-day exploit was caught in the wild

Google's Threat Intelligence Group disclosed on May 11 that an unknown threat actor used an AI model to both identify and weaponise a 2FA-bypass vulnerability in an open-source admin tool — planned for a mass exploitation event, quietly patched before deployment. John Hultquist's framing: *"There's a misconception that the AI vulnerability race is imminent. The reality is that it's already begun."* Hacker News is processing this as a fait accompli — the discussion is not "will this happen" but " ...

The most important event in technology since GPT-4 is being metabolised on a sub-Reddit. There is no congressional hearing scheduled. There is no presidential address. The capability has crossed the threshold and the processing apparatus has not noticed.