https://agentic-cyber-explorer.pages.dev/topics/ai-malware/ New records, findings, and answers on ai malware, from Fide AI's Agentic Cyber Explorer. en Fide AI. Data licensed CC BY 4.0. Sat, 26 Sep 2026 12:00:00 GMT https://agentic-cyber-explorer.pages.dev/questions/how-are-attackers-using-ai-agents/ answer:how-are-attackers-using-ai-agents:2026-09-26 Sat, 26 Sep 2026 12:00:00 GMT Key question Increasingly to run parts of intrusions: providers and vendors report agent-driven espionage, extortion and credential theft, and malware that queries LLMs. (moderate confidence) Correction: the extortion campaign ran under human direction, security vendors are among the sources, and Google has not yet seen fully autonomous pipelines in the wild. Government threat reports are still missing from the corpus. https://agentic-cyber-explorer.pages.dev/questions/how-are-attackers-using-ai-agents/ answer:how-are-attackers-using-ai-agents:2026-09-25 Fri, 25 Sep 2026 12:00:00 GMT Key question Increasingly to run parts of intrusions: providers report agent-driven espionage, extortion and credential theft, and malware that queries LLMs as it runs. (moderate confidence) Revised after twelve threat-intelligence and malware reports from 2024 to September 2026 (Anthropic, ESET, Google, Microsoft with OpenAI, Sysdig and ThreatDown) were added, closing most of the coverage gap the first answer described. https://agentic-cyber-explorer.pages.dev/events/threatdown-carbonato-agent-botnet-2026/ event:threatdown-carbonato-agent-botnet-2026 Tue, 22 Sep 2026 12:00:00 GMT Attacks & incidents ThreatDown reports a botnet that compromises Docker hosts with unauthenticated APIs, installs the open-source Hermes Agent framework with a replaced persona file, and has the agent carry out tasks sent over Telegram, including collecting AI API keys and other credentials. ThreatDown recovered the operation's toolchain from an exposed registry, with images dating from October 2024 to August 2026, and describes the agent reading command output and deciding next steps in an operator-driven loop. It shows an off-the-shelf agent framework used as a botnet implant, with AI API keys treated as a primary theft target. https://agentic-cyber-explorer.pages.dev/events/sysdig-jadepuffer-agentic-ransomware-2026/ event:sysdig-jadepuffer-agentic-ransomware-2026 Wed, 01 Jul 2026 12:00:00 GMT Attacks & incidents Sysdig's threat research team reports an operator it calls JADEPUFFER that gained access through a vulnerability in an internet-facing Langflow server (CVE-2025-3248), harvested credentials on that host, then used root database credentials of unknown origin against a separate production database server and ran a database-extortion playbook. Sysdig assesses the operation was driven end to end by an LLM agent, citing self-narrating payloads with natural-language reasoning and rapid adaptive retries, and calls it the first documented case of agentic ransomware. A security vendor's evidence-based case that an agent, not a human-written script, conducted a full extortion intrusion, though the attribution of autonomy rests on code artifacts. https://agentic-cyber-explorer.pages.dev/events/gtig-ai-developed-zero-day-2026/ event:gtig-ai-developed-zero-day-2026 Mon, 11 May 2026 12:00:00 GMT Attacks & incidents Google Threat Intelligence Group reported that cybercriminals planned a mass-exploitation campaign using a two-factor-authentication bypass in an open-source web administration tool, and assessed with high confidence that an AI model supported discovery and weaponization of the flaw. GTIG worked with the vendor on disclosure and disrupted the activity. The same report describes PRC-nexus actors using agentic frameworks such as Hexstrike and Strix for reconnaissance and vulnerability validation, and Android malware (PROMPTSPY) that calls Gemini to drive the device UI. GTIG calls it the first identified instance of a zero-day exploit it believes was AI-developed by cybercrime actors. https://agentic-cyber-explorer.pages.dev/events/virustotal-malicious-openclaw-skills-2026/ event:virustotal-malicious-openclaw-skills-2026 Mon, 02 Feb 2026 12:00:00 GMT Attacks & incidents VirusTotal analyzed more than 3,016 OpenClaw skill packages and reports hundreds with malicious behavior, including data exfiltration, backdoors, malware droppers such as Atomic Stealer, and persistent instruction files that manipulate the agent. One publisher accounted for 314 malicious skills; VirusTotal added native scanning of skill packages. Agent skill marketplaces became an in-the-wild malware distribution channel within months of launch. https://agentic-cyber-explorer.pages.dev/events/gtig-ai-threat-tracker-llm-querying-malware-2025/ event:gtig-ai-threat-tracker-llm-querying-malware-2025 Wed, 05 Nov 2025 12:00:00 GMT Attacks & incidents Google Threat Intelligence Group's AI Threat Tracker says adversaries moved beyond productivity uses in 2025 and began deploying malware that calls LLMs mid-execution, such as PROMPTFLUX, which asks Gemini to rewrite its own code, and PROMPTSTEAL, which queries a hosted open model for commands. GTIG attributes PROMPTSTEAL to Russia's APT28 in operations against Ukraine, and also reports actors posing as CTF players or researchers to get past safeguards and a maturing underground market for AI tools. It is Google's evidence that malware using models at runtime had reached a state operation, after CERT-UA's earlier report of the same malware, and it replaced Google's own productivity-only picture. https://agentic-cyber-explorer.pages.dev/events/anthropic-threat-report-claude-code-extortion-2025/ event:anthropic-threat-report-claude-code-extortion-2025 Wed, 27 Aug 2025 12:00:00 GMT Attacks & incidents Anthropic's August 2025 threat intelligence report describes a criminal who used Claude Code to automate reconnaissance, credential harvesting and network intrusion against at least 17 organizations, including healthcare, emergency services, government and religious institutions, then threatened to publish the stolen data. The report also describes North Korean operatives using Claude to obtain and keep remote technical jobs, and a low-skill actor selling ransomware developed with Claude. Anthropic presents it as agentic AI carrying out attacks rather than only advising on them, with a human still directing the operation. https://agentic-cyber-explorer.pages.dev/events/nx-s1ngularity-weaponized-ai-clis-2025/ event:nx-s1ngularity-weaponized-ai-clis-2025 Tue, 26 Aug 2025 12:00:00 GMT Attacks & incidents Attackers exploited a GitHub Actions workflow injection to steal Nx's npm token and publish malicious versions whose install script scanned systems for secrets, attempted to use locally installed AI CLIs such as Claude and Gemini to assist, and uploaded results to public GitHub repositories. Nx reports the packages were live about four hours and has since moved to trusted publishing and mandatory 2FA approval. It is an early documented case of malware invoking a victim's own AI coding agents as reconnaissance tools. https://agentic-cyber-explorer.pages.dev/events/eset-promptlock-ai-ransomware-2025/ event:eset-promptlock-ai-ransomware-2025 Tue, 26 Aug 2025 12:00:00 GMT Attacks & incidents ESET Research reported PromptLock, ransomware samples uploaded to VirusTotal that use a locally run open-weight model to generate scripts for file discovery, exfiltration and encryption at runtime, and called it the first known AI-powered ransomware. In a September 3, 2025 update, ESET said the authors of an academic study had contacted it and that their research prototype closely resembles the samples, supporting ESET's view that PromptLock was a proof of concept rather than malware used in attacks. What ESET called the first known AI-powered ransomware closely resembled an academic prototype, a caution about how early AI-malware claims are read.