Arad Donenfeld

Abstract

With the use of AI agents catching wind across the offensive security space, we decided to focus specifically on malware. While most discussions focus on targeting AI, using it to generate malicious payloads at runtime, or “vibe coding” it, we went a step further: we built a system where AI is the sole participant in the malware creation process itself. To understand what works best, we evaluated multiple large language models and prompting techniques, comparing their ability to generate functional code, evade detection, and operate effectively. We then designed a workflow that maximizes generation quality, scalability, and randomization while addressing the practical challenges of autonomous malware development. The resulting framework is capable of producing large numbers of unique samples while reducing reliance on static signatures. Finally, we compare our findings with emerging examples of AI-assisted malware observed in the wild and discuss what these developments mean for both offensive security and defensive research. Our goal is to better understand the capabilities and limitations of AI-driven malware generation and to explore how defenders can prepare for these threats.