GTIG AI Threat Tracker (May 2026) — first AI-generated zero-day exploit ITW

GTIG's May 2026 AI Threat Tracker (covered as daily 2026-05-12 deep dive) documents the first confirmed AI-generated zero-day exploit observed in-the-wild and presents the behavioural class of AI-augmented malware. The synthesis worth elevating for the weekly: the "AI-augmented" malware category is no longer hypothetical for SOC defenders — the behavioural-class taxonomy GTIG provides (LLM-assisted code generation in payload, AI-driven C2 dialogue, model-mediated lateral movement decisions) is the right detection-engineering reference for SOCs building hunt content for the next 12 months. The relevant SOC capability investment: behavioural baselines for "what does AI-mediated execution look like in our telemetry" — not new IOC ingestion (GTIG AI Threat Tracker May 2026; daily 2026-05-12 deep dive).