The Day the Clock Broke

Google caught a criminal crew using an AI to find a 2FA bypass and write the exploit. The bugs gave it away. The timeline didn't.

May 12, 2026

A hallucinated CVSS score, an abundance of "educational docstrings," and a Python exploit too clean to be human. Google's GTIG report is a timestamp, not an incident.

It’s May 2026. A criminal crew that calls itself TeamPCP (Google tracks them as UNC6780) has been having a busy spring. Back in March, they poisoned PyPI packages and slipped malicious pull requests into the GitHub repos behind LiteLLM, Trivy, Checkmarx, and BerriAI. They dropped a credential stealer called SANDCLOCK into the build environments and walked off with AWS keys and GitHub tokens, which they monetized through the usual ransomware partnerships. Standard supply chain ugliness. Loud, but not new.

That’s not the story.

The story is what Google’s Threat Intelligence Group put in their May 11 report: a separate criminal crew (Google won’t name them, won’t name the target either) used an AI model to find a zero-day in a popular open-source web admin tool, then used that same model to write a working Python exploit that bypassed two-factor authentication. They were lining up a mass exploitation campaign. Google caught it, worked the disclosure quietly with the vendor, and the campaign never launched.

GTIG isn’t claiming this with a shrug. They say they have “high confidence” the exploit was machine-written. And here’s the part I love: the AI gave itself away.

How the AI got caught

The exploit script had a hallucinated CVSS score. Made one up. Confidently. Wrong number, wrong format, attached to a real bug. Anyone who has spent five minutes with an LLM knows that move.

It also had what GTIG charitably called “an abundance of educational docstrings” — every function lovingly explained like the reader had wandered in from a bootcamp. Detailed help menus. Textbook-clean Python formatting. The kind of code that looks like it was written for a tutorial, not for a heist.

If you’ve ever read a real exploit, you know they look feral. Cryptic variable names, no comments, occasional swearing. This one read like a Medium post. That’s the tell.

For the record: GTIG says it was not Gemini, and not Anthropic’s Mythos. Some other model, somebody else’s guardrails, somebody got around them. The takeaway isn’t “which model.” The takeaway is that the bar has moved.

The flaw the AI found is the interesting part

The vulnerability itself was a semantic logic flaw — a developer hardcoded a trust assumption that quietly contradicted the auth enforcement around it. The kind of bug fuzzers don’t find because nothing crashes. Static analyzers don’t catch it because the syntax is fine. Memory’s fine. Inputs are sanitized. Everything looks correct.

It just doesn’t behave correctly, and you only see that if you reason about what the developer was trying to do versus what they actually wrote.

That’s a human-style bug. And until now, finding it was a human-style job.

GTIG’s own framing on this is sharper than mine: “While fuzzers and static analysis tools are optimized to detect sinks and crashes, frontier LLMs excel at identifying these types of high-level flaws and hardcoded static anomalies.”

Translation: the things AppSec teams pay six figures to find, models can now do at coffee-break speed. Not perfectly. Not always. But enough.

What John Hultquist said, and why it matters

John Hultquist, GTIG’s chief analyst, gave the quote of the year:

“There’s a misconception that the AI vulnerability race is imminent. The reality is that it’s already begun. For every zero-day we can trace back to AI, there are probably many more out there.”

Read that twice. He’s not saying it’s coming. He’s saying he can see one footprint and assumes there’s a herd. That’s how threat intel people talk when they’re trying very hard not to scream.

The clumsy phase doesn’t last

Here’s the Register’s read, which I think is the right one: “this still appears to be the clumsy early phase.” The exploit had bugs. Implementation mistakes likely interfered with the criminals’ plans even before Google stepped in.

So the script got caught because it was sloppy. Cool. Now imagine the same script in six months when somebody fine-tunes a model that doesn’t hallucinate CVSS scores, doesn’t pad with docstrings, and writes in the dialect of someone who has actually shipped malware.

The “clumsy early phase” of a thing is the part you remember fondly later, when you wish it had stayed that way.

What actually compressed

The point of this story isn’t “AI is the attacker.” The humans at TeamPCP and the unnamed crew are still the attackers. The model is the apprentice that doesn’t sleep, doesn’t get bored, doesn’t take a sabbatical, and reads every CVE ever published while you’re eating lunch.

What compressed is the discovery-to-weaponization window.

In the old model, finding a semantic logic bug in a niche admin tool meant a skilled researcher with a hunch and a free weekend. In the new model, it means a prompt. The vulnerability existed the whole time. The economics of finding it just changed.

That’s the part that should keep you up. The bugs are already in your code. They’ve always been there. The only thing protecting you was that nobody had bothered to look hard enough.

Now something is looking very hard, for free, at scale, and it doesn’t need a free weekend.

What I’d actually do Monday morning

Not a bullet list of platitudes. One thing.

Stop measuring patch speed in days. Start measuring it in dependencies.

The LiteLLM mess from March is the cleaner lesson here, even though it’s the less sexy story. TeamPCP didn’t break in through some genius exploit. They poisoned a package. People pip install‘d it. Done. CVE-2026-42208 (the LiteLLM SQLi from last month) saw its first exploitation attempt 26 hours and 7 minutes after the GitHub advisory was indexed. CISA added it to KEV on May 8, gave federal agencies three days to patch.

Three days. That’s the new clock.

If you can’t tell me, right now, which of your services depends on which open-source packages, which of those packages had advisories published this week, and how long it would take you to ship a patched version end-to-end — your problem isn’t AI. Your problem is that the human-scale clock you’ve been running on doesn’t exist anymore, and an AI didn’t have to do anything fancy to make that true. It just had to lower the cost of looking.

The timestamp

I’ll close on the thing I keep coming back to.

Every report like this one becomes “another incident” in someone’s feed. This one isn’t. It’s a timestamp. May 11, 2026, is the date the conversation stopped being theoretical.

Everything before this report is “we were worried about it.” Everything after is “we knew, and here’s what we did about it.”

I know which side of that line I want my org on. You should know which side yours is on too.

Morphic

Discussion about this post

Ready for more?