google ’s Threat Intelligence Group says it has identified what may be the first known case of attackers using artificial intelligence to help develop a zero-day exploit. In a recent blog post, the team said it observed cybercriminals coordinating a mass exploitation effort built around a flaw in a popular open-source, web-based system administration tool.
According to the report, the vulnerability allowed attackers to bypass two-factor authentication after obtaining valid user credentials. That made the weakness particularly concerning, since two-factor authentication is commonly used to protect sensitive accounts, including crypto wallets and exchange logins. google said the exploit did not appear to rely on traditional coding mistakes, but rather on a higher-level logic flaw tied to a developer’s incorrect trust assumption.
google said it had high confidence that an AI model likely assisted in both the discovery and weaponization of the vulnerability. The company pointed to indicators in the exploit script, including a hallucination and formatting patterns that closely resembled material commonly associated with AI training data. While the report did not name the threat actor, google said China and North Korea have shown strong interest in using AI for vulnerability discovery.
The findings come as AI tools become more deeply embedded in offensive cyber operations. google noted that large language models are especially effective at spotting broad semantic flaws and other unusual design choices that may be missed by conventional scanners. That makes them useful for identifying vulnerabilities that do not involve memory corruption or other common implementation errors.
google also said threat actors are increasingly using large language models to support malware development and evade detection. Some malware families generate filler or decoy code to obscure malicious logic, while others use automated systems to rotate premium AI accounts, pool API keys, and bypass safety controls at scale.
The company concluded that as organizations continue deploying AI systems, the surrounding software ecosystem has become a growing target. Attackers are focusing on components that expand an AI system’s capabilities, including autonomous tools and third-party data connectors, even though they have not yet shown the ability to defeat the core security logic of frontier models.Tom Lee has reiterated his view that a new crypto uptrend is underway, arguing that Ether’s recent move has tracked software stocks and reinforced the case for stronger digital-asset markets ahead.
The remarks came as Bitmine Immersion Technologies, the largest Ether treasury company, said it had reduced the pace of its weekly purchases after a rapid accumulation phase. Over the past week, the company bought 26,659 ETH, a sharp slowdown from the more than 100,000 tokens it had been purchasing weekly in recent weeks. Even so, Bitmine said it remains committed to its long-term target of acquiring 5% of Ether’s circulating supply, which currently stands at about 120.7 million tokens.
Lee said the slower buying rate reflects a change in timing rather than a change in strategy. At its earlier pace, Bitmine would have reached the 5% threshold by mid-July. The company now expects to achieve that goal by the end of 2026. Bitmine has adopted a treasury model similar to Strategy’s Bitcoin -focused approach, positioning Ether as a long-term reserve asset rather than a short-term trading position.
Bitmine also said it plans to stake its entire Ether holdings over time. The company said more than 4.7 million ETH is already staked, and it expects annual staking rewards to total roughly $352 million once the full position is committed. The firm added that its holdings have reduced the amount of Ether in active circulation, arguing that this helps make supply more disinflationary.
Ether reached an all-time high of $4,946 in August 2025 before declining with the broader crypto market later in the year. The token is still about 52% below that peak and has recently traded between $2,274 and $2,411 over the past week.
Lee said the current environment supports what he describes as the start of a crypto spring. He pointed to the relationship between Ether and software equities and argued that a monthly close above $2,100 at the end of May 2026 would strengthen that view. According to Lee, such a result would mark a third straight monthly gain, something he says has not occurred in a crypto bear market.
