Google’s Threat Intelligence Group has confirmed that a cybercrime crew used an AI model to write the first known zero-day exploit aimed at bypassing two-factor authentication, with plans for a mass exploitation event. The target was a popular open-source admin tool, and the AI-generated Python script was caught and the vendor patched before it was deployed in the wild. As reported by The Hacker News, the script carried all the hallmarks of LLM-generated code — clean docstrings, structured Python, even a hallucinated CVSS score. Google’s own GTIG report says the bug was a semantic logic flaw that LLMs are unusually good at spotting.

For Australian wealth managers, this is the moment 2FA stops being treated as the safety net. Client portals, SMSF platforms, fund administration systems, advice software — almost every system you log into for client work sits behind a 2FA layer that has, until now, been the assumed answer to credential theft. It still helps, but the cost and skill barrier to find these flaws just collapsed. Attackers can now ask an AI to spot logic bugs in any tool with hard-coded trust assumptions, and the AI is good at it. For an industry built on client trust and regulated by ASIC, AUSTRAC and the Privacy Act, the exposure is direct.

A handful of practical moves this week. Audit every system holding client data and confirm 2FA is enforced, not just available — and check whether your platform vendors disclose security updates in a way you would actually notice. Move away from SMS-based 2FA where the option exists; phishing-resistant methods like passkeys or FIDO2 hardware keys are now the bar. Make sure your detection picks up impossible-travel and anomalous logins even after a “successful” 2FA, because that is exactly what an exploited bypass looks like. And don’t park this with IT — raise it at the next partners’ or board meeting, because the risk register has just shifted.

All IT works with Australian wealth management firms on the systems behind their client portals — MFA rollouts, monitoring, and reviewing third-party platforms before they become a liability. If you’d like a second opinion on where your platform exposure sits, our financial services team is happy to take a look.