AI-generated malware

AI-generated malware is malicious code written, adapted, or rewritten during execution by a large language model. The significance is not that the code is better, but that producing and varying it stops requiring skill, which changes the economics of who can run a campaign.

This library records 3 cases, all disclosed within roughly a year of each other.

How the attack runs

1. Generation. Code is produced or modified by a model rather than written by hand.
2. Runtime variation in the most advanced cases, where the sample rewrites itself mid-execution so no two instances match.
3. Signature evasion follows from that variation, because there is no stable pattern to detect.
4. Model access is required at run time, which is itself the most reliable detection opportunity.
5. Operation with reduced human involvement, in the agentic cases end to end.

Documented cases

• PROMPTSTEAL / LAMEHUG (2025): documented by Google’s threat intelligence group and Ukraine’s CERT-UA, attributed to APT28, and described as the first LLM-powered malware used by a state actor.
• PROMPTFLUX (2025): a VBScript dropper that calls a model API mid-execution to have itself rewritten, producing just-in-time self-obfuscation.
• JADEPUFFER (2026): the first documented fully agentic ransomware operation.

How it differs from related techniques

Prompt injection manipulates a model the defender is running; this uses a model the attacker is running. Agentic AI attacks is the parent category. Conventional malware is written once and detected by its consistency.

The control that would have stopped it

• Behavioural detection rather than signatures. Self-rewriting code defeats pattern matching by design, but its actions remain observable.
• Monitor outbound traffic to model APIs from servers and endpoints that have no business reason to call them. PROMPTFLUX needs that connection to function.
• Restrict scripting engines where they are not required.
• Assume volume increases. Lower skill requirements mean more campaigns, which makes the human entry point more important, not less.
• Note that delivery is unchanged. All three still begin with a person being deceived, so existing awareness controls remain the first line.