The Debate Has Shifted From Possibility to Present Tense
Google says the cybersecurity conversation around artificial intelligence has moved into a new phase. According to reporting from The Guardian, the company’s threat intelligence group concluded that AI-powered hacking has gone from a nascent issue to an industrial-scale threat in just three months.
The warning is significant because it reframes a debate that has often focused on what advanced models might enable in the future. Google’s analysts argue that the future tense is already outdated. In their view, threat actors are using commercial AI tools now to improve speed, scale and sophistication across real campaigns.
That distinction matters for defenders. If AI were only a looming capability, organizations could treat it as a planning problem. If it is already embedded in active operations, it becomes an immediate operational problem, one that affects vulnerability management, detection, incident response and the pace of defensive patching.
Commercial Models Are Part of the Threat Picture
The Guardian reported that Google’s assessment found criminal groups and state-linked actors from China, North Korea and Russia appear to be using commercial models, including Gemini, Claude and tools from OpenAI, to refine and scale attacks. The report does not say those companies are intentionally enabling malicious use. The more important point is that broadly available, high-capability systems are now part of the offensive toolkit.
Google threat analyst John Hultquist said there is a misconception that an AI vulnerability race is imminent when in reality it has already begun. He said threat actors are using AI to improve persistence against targets, test operations, build better malware and make other incremental gains.
Those incremental gains can matter as much as headline-grabbing breakthroughs. Attack campaigns often succeed because they become cheaper, faster and easier to repeat, not because every operation is radically novel. If AI reduces friction across reconnaissance, malware refinement, phishing variation or exploit testing, then the cumulative effect can be substantial even without fully autonomous cyber offense.
The Zero-Day Risk Is Part of a Larger Escalation
The Guardian placed Google’s report in a broader context that includes unusually strong warnings from AI companies themselves. Last month, Anthropic declined to release one of its newest models, Mythos, after asserting that it posed serious risks if misused. Anthropic said the model had identified zero-day vulnerabilities across major operating systems and web browsers and that coordinated defensive action would be needed across the industry.
Google’s findings suggest defenders may not have the luxury of waiting for extraordinary frontier-model scenarios before adapting. The report said a criminal group recently appeared close to using a zero-day vulnerability in a mass exploitation campaign and seemed to be relying on an AI model to assist the effort.
That does not mean AI has replaced skilled operators. It does mean it can amplify them. In cyber operations, amplification is strategically important because it changes the economics of attack. More campaigns can be run in parallel, tooling can be improved faster and lower-skill participants may be able to execute more capable operations than before.
What Organizations Should Take From the Warning
The core message from Google’s report is not that AI creates an entirely separate cybersecurity universe. It is that familiar threats may now iterate faster. Malware development, exploit research, phishing adaptation and intrusion persistence all become more dangerous when assistance is cheap and widely available.
For organizations, that implies less tolerance for slow patch cycles and weaker visibility. Security teams may need to assume that attackers can test more variants, tailor lures more quickly and recover from failed attempts with less effort than in the recent past. The practical burden falls on resilience: shortening time to detect, reducing exposed attack surface and hardening known weak points before adversaries can industrialize them further.
Google’s framing also adds pressure to the AI industry itself. Model makers, cloud platforms and security vendors are increasingly part of the same ecosystem, and the line between capability progress and downstream risk is narrowing. The latest warning does not settle how that balance should be managed. It does make one thing harder to deny: AI-assisted hacking is no longer a speculative side discussion. According to one of the world’s biggest security players, it is already a live threat environment.
This article is based on reporting by The Guardian. Read the original article.
Originally published on theguardian.com
