AI Malware Is Real. It Is Also Mostly Hype.
Palo Alto Networks studied 405 malware samples linked to AI tools. Only 12 ever reached a real computer, and existing defences caught every single one.
Key points
- Of 405 malware samples linked to AI tools, only 12 reached a live endpoint, according to Palo Alto Networks' Unit 42 research team.
- All 12 samples that reached real computers were detected and blocked by standard security methods that also catch ordinary malware.
- The most widely spread sample, a fake recipe app called Recipe Lister, hit more than 50 organisations and generated roughly 9,600 alerts before being stopped.
- FunkSec ransomware, a strain that locks files and demands payment, was the most common family among the 12 real-world samples.
- Unit 42 concluded that AI is helping criminals build malware faster, not build malware that is harder to catch.
Palo Alto Networks' threat-research team, Unit 42, spent months cataloguing 405 malware samples that were linked to AI in some way. Some were built with the help of large language models (AI tools that generate text or code on request, like ChatGPT). Others simply borrowed the name of a popular AI product to fool users into installing them. The findings, first reported by SecurityWeek, are more reassuring than the headlines that prompted the research.
How much of this AI malware actually hit anyone?
Almost none of it. Roughly 97 percent of the 405 samples never left a testing sandbox, a research repository, or a university lab. Only 12 file samples turned up on real, working computers belonging to real organisations.
Unit 42 cross-checked every sample's unique digital fingerprint (called a file hash) against records from live endpoints (ordinary computers and servers on real networks), network traffic logs, and internal security alerts. Twelve hashes appeared on live endpoints. A slightly larger group of 15 to 20 appeared in network traffic sent to sandboxes for inspection. Every one of the 12 live detections triggered a security alert.
The bulk of samples that never went anywhere fell into three categories. The biggest group was proof-of-concept code: demonstrations built by researchers to show a technique is possible, filled with diagnostic notes no real criminal would leave in and uploaded once from a university or lab. A second group came from companies testing their own defences against known AI-linked malware, identifiable because the same file was uploaded repeatedly from the same address in a short time. The fourth category (the AI-branded bait) dressed up ordinary malicious software as installers for well-known AI products, with no actual AI inside.
What did the 12 real samples do?
They spanned five malware families across three countries, with no pattern in industry or geography.
| Malware | Type | Notable detail |
|---|---|---|
| FunkSec | Ransomware (locks files for payment) | Most common family; project files suggest AI-assisted coding |
| Recipe Lister | Backdoor installer | Posed as a recipe app; hit 50-plus organisations, 9,600 alerts |
| Oyster | Backdoor | Disguised as a Dropbox installer, forged publisher signature |
| Rhadamanthys | Information stealer | Secretly harvests passwords and personal data; had live command server |
| 360 Total Security impersonator | Persistence tool | Used COM hijacking (a technique that hides malware inside Windows settings) |
The Recipe Lister installer was the single most widespread sample. It carried a digital signature, a seal that is supposed to confirm a file comes from a trusted source, which initially lowered suspicion. Security tools eventually flagged it because the company name on the signature was unusual and the file's contents were heavily compressed in a way that is a common sign of something to hide.
The Oyster backdoor listed Dropbox as its publisher. Unit 42 said criminals are increasingly using AI to write this kind of delivery code quickly and cheaply, cutting the time needed to get an initial foothold on a victim's machine.
Should organisations change how they defend against AI malware?
Not yet. Standard defences caught everything. Sandboxes (isolated virtual computers where suspicious files are opened safely), behaviour-based detection (watching what a file actually does rather than what it claims to be), checks on digital signatures, and measurements of how tightly a file is compressed all did their jobs without modification. No new detection method was needed for any of the 12 samples.
The honest takeaway is that AI is a productivity tool for criminals. It helps them write code faster and try more variations in less time. It does not, at least for now, help them write code that slips past defences that are already in place.
What should employees and organisations watch for?
The Recipe Lister and Oyster cases both started with someone installing what looked like a legitimate app. Before installing any software, check that the download comes from an official source. A digital signature is not a guarantee of safety; look at the publisher name and question anything unfamiliar. Security teams should ensure sandboxing and behaviour-based tools are active and up to date, because those two methods did the heaviest lifting here.
