Palo Alto Networks' Unit 42 analyzed 405 malware samples linked to AI and found that only 12 ever reached a live endpoint. The research suggests AI is making malware development faster, not fundamentally harder to detect.
The dataset included everything from ransomware partially written with large language models to ordinary malware disguised as installers for popular AI apps. Unit 42 cross-referenced file hashes against endpoint telemetry, network sessions, and internal alert records. Roughly 97 percent of the samples never left a sandbox, research repository, or internal testing environment.
Every one of the 12 samples detected on protected endpoints triggered a security alert. Existing defenses caught them all using standard methods: sandbox detonation, behavior-based detection, digital signature anomalies, and analysis of file packing or encryption.
Why most AI-linked malware never ships
The samples that never reached production fall into three groups. The largest is proof-of-concept code built to demonstrate a technique, often configured to target only local or private networks and filled with debug output no real attacker would leave behind.
A second group comes from organizations testing their own defenses against previously reported AI malware. These are identifiable by repeated uploads of the same file from the same source in a short window. A third group uses AI branding purely as bait, dressing up ordinary payloads as installers for well-known AI products with no actual AI functionality behind them.
The five families that made it to real targets
The 12 samples that reached live endpoints spanned five malware families across three countries, with no concentration in any particular industry or region. The most common was FunkSec, a ransomware strain that multiple researchers have linked to LLM assistance. Internal project file names show a developer cycling through several names for the same ransomware, a pace Unit 42 said is more consistent with prompt-driven generation than a traditional development cycle.
The most widely encountered sample was an installer posing as a recipe-finding app called Recipe Lister. It carried a digital signature and quietly launched a backdoor once installed, spreading across more than 50 organizations and generating roughly 6,500 endpoint records and about 9,600 alerts. Its signature initially avoided suspicion, but an unusual signer combined with heavily packed file contents led to its detection.
The Oyster backdoor posed as a Dropbox installer with a signature listing Dropbox as the publisher. A separate Windows executable delivered the Rhadamanthys information stealer with active command-and-control communication, which earlier reporting tied to an AI-assisted infection chain. The fifth sample impersonated a component of 360 Total Security and used a persistence technique known as COM hijacking.
Unit 42 said attackers are increasingly turning to AI tools to generate delivery code, making it faster and cheaper to establish an initial foothold. The findings point to AI's current role in malware as a way to speed up how quickly attackers can build and vary their tools, not a way to make those tools harder to catch.
Why this matters for IT and development teams
For security teams, the practical takeaway is that AI-assisted malware does not require new detection methods yet. The same defenses that catch conventional malware - sandboxing, behavior analysis, signature review, and packing inspection - caught every sample in this dataset. What changes is volume and iteration speed: attackers can now generate variants faster, so automated detection pipelines need to keep pace. Teams that rely on manual analysis or slow signature updates will feel the pressure first, while those with established automated defenses are already equipped to handle what AI-assisted malware is producing today.
Your membership also unlocks:
