With the use of AI agents catching wind across the offensive security space, from social engineering to vulnerability research, it was inevitable that malware would follow suit. While most discussions focus on targeting AI, using it to generate malicious payloads at a malware’s runtime, or “vibe coding” it, we went a step further: we built a system where AI is the sole participant in the malware creation process itself.
We will begin by talking about how we got to this point, what sparked the idea, and jump into comparing different models – showing which gave the best code, which was most evasive, which prompts worked the best, and what we used in the agent.
We will then dig into the generation process itself – we will show the challenges with earlier approaches, how we solved them, how to build the workflow to maximize the malware’s capability and randomization, how it managed to break signatures, and how to generate millions of samples.
We will finish by showing how attackers are using similar methods, look at real examples in the wild, and discuss how to use these techniques for ourselves, both as attackers and defenders.