A New Era of Threats: Lessons from Agentic AI Malware

The talk takes aim at media claims that AI is now driving malware development, separating hype from what has actually been observed. The speaker, a long-time antivirus analyst, explains that generating basic malware with a language model is easy, but the output is often broken, limited by model safeguards, and still caught by behavior-based products. Several publicly reported cases are examined, including an information stealer that queried a hosted model for commands and a ransomware prototype that turned out to be a student project.

The middle section walks through a proof of concept in which a loader repeatedly asks a model for PowerShell, runs the result, and feeds the output back into the next request, with a separate planning agent coordinating subtasks. Tested against Microsoft Defender, CrowdStrike and SentinelOne, the obfuscated outputs bypassed some products but were flagged by others. The speaker notes frequent errors, the need to review about one in five outputs, difficulty knowing when to stop, and noisy outbound traffic that exposes the activity. Other routes covered include poisoning agent skill files and indirect prompt injection against enterprise assistants.

The closing takeaway is that AI-driven malware is possible but not groundbreaking, and is unreliable, resource-heavy and dependent on external services. Attackers will likely keep favoring valid credentials and living off the land. For defenders, behavior-based detection and faster patching remain the priority, as AI accelerates vulnerability discovery. Attribution also becomes harder, because generated code no longer points to a specific group.