Google’s Threat Intelligence Group has confirmed the first documented case of a criminal threat actor using AI to independently generate a working zero-day exploit, bypassing two-factor authentication on a widely used open-source web administration tool. Separately, state-linked actors (PRC, DPRK, Russia) are documented operationalizing AI across vulnerability discovery, polymorphic malware generation, and supply chain compromise targeting development environments and network devices. This item clusters four related threat activities under a common theme of industrialized adversarial AI operations. Organizations using open-source administration tools, Gemini CLI in development pipelines, TP-Link devices, OFTP implementations, and unvetted AI/ML software dependencies face elevated, active risk.