AI‑generated zero‑day bypasses 2FA; EU warns of rising cyber threats and corporate passkey gaps

Security researchers have identified the first AI‑generated zero‑day exploit that specifically bypasses two‑factor authentication (2FA), raising concerns about automated attack capabilities. The EU highlighted the threat during its "Cyber Europe 2026" exercise, which simulated coordinated attacks on transport infrastructure such as rail networks and seaports, and is advancing the "Cyber Security Act 2" to reduce reliance on non‑EU security providers.

At the same time, large enterprises that are moving to passwordless authentication with passkeys face a new obstacle: shadow‑IT. Unofficial cloud applications used by individual business units continue to rely on traditional passwords, undermining the security benefits of passkeys. Shared group accounts and the lack of passkey support in many third‑party tools create vulnerable entry points that attackers can exploit.