For the first time, hackers have used artificial intelligence to find and exploit a security flaw that no automated scanner would have caught – and Google says only its own active monitoring stopped a mass attack.