A Hacking Tool Built With A.I. Can Breach Phones Without a Click | Enterprise software

Author: Gammatek ISPL | Published: 9th sep 2026 Google's threat intelligence team just confirmed something security researchers have warned about for years but hadn't yet caught in the wild: a hacking tool built using artificial intelligence that can breach a phone without the owner clicking anything, opening anything, or making any mistake at all. If your company's mobile security policy is still built around training employees to spot suspicious links, this development matters to you directly, because the entire premise of that training, that a human has to slip up for an attack to succeed, no longer holds for this class of exploit. https://link.amazon/B06ydtMB7

In this article

• What Google actually found

• Why "zero-click" changes the security conversation entirely

• Zero-click exploits, then and now: a comparison

• What AI specifically changes about the threat

• Implementation considerations for a zero-click threat model

• FAQ

The entire premise of phishing training, that a person has to make a mistake for an attack to work, doesn't apply to the zero-click exploit Google just confirmed was built with AI.

What Google actually found

In May 2026, Google's Threat Intelligence Group disclosed that it had identified a zero-day exploit, a hacking tool targeting a previously unknown, unpatched vulnerability, that showed clear evidence of having been built with the help of an AI model rather than written entirely by human hackers. John Hultquist, chief analyst at Google's threat intelligence unit, told the New York Times the disclosure likely represents only a small fraction of what's actually happening, calling it "the tip of the iceberg" and adding that the visible evidence is probably a small sample of a much bigger problem. Rob Joyce, the former NSA cybersecurity director who reviewed Google's research ahead of publication, described the evidence tying the exploit's code to an AI model as "the closest thing yet to a fingerprint at the crime scene."

This wasn't an isolated incident either. Separately, Dragos, a security firm that protects critical infrastructure, reported that hackers used Anthropic's Claude earlier in 2026 in an attempt to target municipal water and drainage utility systems in Monterrey, Mexico. Security researcher Eyal Sela, who documented that campaign, told Forbes the most concerning part isn't that skilled hackers have a new tool, it's that AI now lets low-skilled attackers carry out techniques they don't actually understand themselves. The report has already reached policy circles: the New York Times reported that one option under consideration within the Trump administration is a structured federal review mechanism for newly released AI models, specifically because of their growing offensive cybersecurity capability. https://link.amazon/B06oBi1SZ

Why "zero-click" changes the security conversation entirely

Most enterprise security training exists to close one gap: the moment a human decides whether to click a link, open an attachment, or enter a password on a page that looks legitimate but isn't. Zero-click exploits remove that moment entirely. The vulnerability lives in how a device processes something it receives automatically, a message, an image, a call, with no action required from the person holding the phone.

This isn't new in concept. Zero-click spyware has a documented history: Pegasus spyware infected roughly 1,400 WhatsApp users in 2019 through a zero-click vulnerability, the BLASTPASS exploit chain compromised iOS 16.6 devices in 2023 with no user interaction, and Paragon's spyware was found behind a 2025 zero-click WhatsApp campaign that targeted around 90 journalists. What's different now is who can build one. Historically, zero-click exploits were the domain of well-funded nation-state programs and commercial spyware vendors charging governments millions of dollars per license. An AI model that can meaningfully assist in writing this class of exploit changes the economics of who can afford to develop one, which is precisely the shift Google's disclosure and the Monterrey incident both point toward.

Zero-click exploits, then and now: a comparison

Comparing the pre-AI zero-click landscape to what Google just confirmed makes the shift concrete rather than abstract.

Dimension	Pre-AI zero-click exploits (2016–2024)	AI-assisted zero-click tools (2025–2026)
Who could build one	Nation-states, commercial spyware vendors (NSO Group, Paragon) with large R&D budgets	Documented cases now include lower-resourced groups using AI as a "cybercriminal copilot"
Development cost and time	Months of specialized reverse-engineering work by expert teams	Compressed significantly; AI assists with vulnerability discovery and exploit code generation
Skill required to deploy	High; required deep technical expertise in the target platform	Lower; researchers specifically flag that AI lets attackers use techniques they don't fully understand
Typical targets	High-value individuals: journalists, activists, government officials	Broader in principle, since lower cost and skill requirements widen the pool of viable targets
Detection difficulty	Already very hard, since there's no user action or error to flag	Comparable or harder, since AI-generated code can vary in structure between campaigns

The throughline in that table isn't that AI invented a new category of attack. It's that AI collapsed the cost and skill floor for a category of attack that used to be reserved for the best-funded, most patient adversaries. https://link.amazon/B08THOpN4

What AI specifically changes about the threat

Beyond the exploit-writing capability Google documented, a broader pattern is showing up across 2026 threat reporting: AI is increasingly involved not just in writing malicious code, but in running attacks with minimal human involvement at all. Security researchers tracking this trend describe autonomous AI agents conducting reconnaissance across large numbers of exposed endpoints, harvesting credentials, and adapting their approach across multiple targets without a person actively directing each step. Separately, prompt injection, tricking an AI system into following an attacker's hidden instructions instead of its intended task, has been flagged by OWASP as a top vulnerability category for AI-integrated applications, and industry security audits have found it present across a large share of production AI deployments reviewed.

None of this means every phone in your organization is at immediate risk of a nation-state-grade zero-click exploit. It does mean the assumption underlying a lot of mobile security budgets, that the main risk is a phishing click, misses an entire category of threat that doesn't require anyone downstream to make a mistake. Patch management, not user training, is the control that actually addresses zero-click risk, and that's a very different operational muscle for most IT teams than security-awareness training.

There's a budget-allocation problem hiding inside this shift, too. Security-awareness training is cheap, easy to measure, and produces a clean completion metric for a compliance report. Aggressive patch enforcement and mobile threat defense tooling are more expensive, harder to fully automate across a mixed fleet of personal and company-owned devices, and don't produce the same satisfying "100% of employees completed training" number. That's part of why zero-click risk tends to be underfunded relative to phishing risk in a lot of mobile security budgets: the cheaper control is also the more visible one to report up the chain, even when it's not the control that actually matters for this specific threat.

Implementation considerations for a zero-click threat model

If your organization manages a phone fleet, whether company-owned devices or a BYOD policy on personal phones, a few concrete changes are worth making in light of this specific development.

1. Separate your patch-compliance metrics from your phishing-training metrics. They protect against different threat models, and a fleet that scores well on simulated phishing tests can still be fully exposed to a zero-click exploit if OS and app updates lag behind.

2. Reduce your unpatched-device window aggressively. Since zero-click exploits target unknown or unpatched vulnerabilities, the single highest-leverage control is minimizing how long any device runs an outdated OS or messaging app version. Enforce automatic updates through MDM rather than relying on individual users to install them.

3. Assume your highest-value targets need extra scrutiny regardless of their own habits. Executives, legal counsel, and anyone handling sensitive negotiations or credentials are the highest-value zero-click targets precisely because no amount of personal caution protects them from this attack class.

4. Deploy mobile threat defense tooling that monitors device behavior, not just message content. Since there's no malicious link or attachment to scan, detection increasingly depends on spotting anomalous device behavior after a compromise rather than blocking the delivery mechanism beforehand.

5. Build an incident response plan that assumes "no one clicked anything" as a valid attack narrative. Security teams that only investigate breaches following a reported phishing click will miss zero-click compromises unless the response plan explicitly accounts for this attack path.

This connects directly to the accountability principle we covered in our piece on OpenAI's warning about AI and concentrated power: the same traceability discipline that matters for AI-assisted business decisions matters here too, knowing which device, which patch level, and which specific vulnerability was involved is what turns a vague "we think we were breached" into an actual, actionable incident report.

Frequently asked questions

What does "zero-click" actually mean? A zero-click exploit compromises a device without requiring the user to click a link, open a file, or take any action at all. The vulnerability is triggered by something the device processes automatically, such as a received message or call, which is what makes it undetectable through normal user-caution training.

Is this the first time AI has been used to build a hacking tool? It's the first time Google's threat intelligence team has publicly confirmed and documented a zero-day exploit with clear evidence of AI involvement in its creation. Separately, other 2026 incidents, including an attempt to use Anthropic's Claude against water utility systems in Mexico, show AI being used operationally in cyberattacks more broadly.

Does regular phishing-awareness training protect against this? No. Zero-click exploits are specifically designed to require no user action, which means training focused on spotting suspicious links or attachments doesn't address this attack path at all. Patch management and device-behavior monitoring are the relevant controls.

Should businesses be worried about every employee's phone, or just executives? Historically, zero-click exploits targeted high-value individuals because they were expensive to develop and deploy. AI lowering that cost and skill barrier is exactly what security researchers are warning could widen the pool of viable targets, so it's reasonable to extend zero-click-aware patch policies fleet-wide rather than limiting them to a small executive group.

What's the single most effective defense against a zero-click exploit? Minimizing the

window during which any device runs unpatched software. Since these exploits target unknown or unpatched vulnerabilities specifically, aggressive, enforced update policies close the gap faster than any detection tool can catch an exploit already in progress.

Not sure how exposed your current device fleet is to an unpatched zero-click vulnerability, or whether your MDM policy actually enforces the update cadence you think it does?

Our device security assessment audits your fleet's patch compliance, mobile threat defense coverage, and incident response readiness against exactly this kind of zero-click attack scenario.

Book a device security assessment : https://www.gammateksolutions.com/post/the-best-worst-and-strangest-ways-ai-is-really-being-used-at-work https://www.gammateksolutions.com/post/amazon-prime-members-just-got-a-huge-new-perk-here-s-how-to-use-it https://www.gammateksolutions.com/post/inside-eaton-s-9-5-billion-bet-to-dominate-the-ai-infrastructure-boom https://www.gammateksolutions.com/post/fortinet-cyber-security-pricing-2026-firewall-cost-guide