AI-Powered Malware: 97% Never Leaves the Sandbox, Existing Defenses Are Enough

On August 26, 2026, Palo Alto Networks Unit 42 published an analysis of 405 malware samples that in some way reference artificial intelligence. The conclusion is clear: AI accelerates the writing and variation of malicious code, but it does not increase its success rate. Approximately 97% of samples never reached a real endpoint. Only 12 hashes appeared on protected systems, and all generated an alert.

A Heterogeneous Dataset: Ransomware, Disguised Installers, and Proof-of-Concepts

The 405 samples analyzed are not all the same. Unit 42 included ransomware partially written with the help of language models, installers that exploit the name of well-known AI apps, and ordinary payloads disguised as legitimate products. By cross-referencing hashes with endpoint telemetry, network sessions forwarded to the sandbox, and alert records, a surprising picture emerges. The vast majority never left test environments, research repositories, or internal sandboxes.

The Three Fates of Malware That Never Reaches Production

The samples that never reached real targets fall into three distinct groups.

The first is demonstrative code. These are proof-of-concepts configured to target only local or private networks, full of debug output that a real attacker would remove. They are often uploaded once from university or research labs.

The second group comprises defensive tests. Organizations repeatedly upload the same file from the same source within a short time window to verify their defenses against already-known AI malware. These also are not intended to spread.

The third group uses the AI brand as a simple lure. They are entirely ordinary payloads, with no AI functionality inside, disguised as installers of well-known AI products. The goal is only to exploit trust in the name.

The 12 Samples That Reached Endpoints: Five Families, No Concentration

Only 12 hashes were detected on real protected endpoints. They belong to five malware families distributed across three countries, with no sectoral or geographic concentration. All 12 generated a security alert. Existing defenses intercepted them without requiring new detection methods.

The most common family is FunkSec, a ransomware that several researchers link to assistance from language models. Internal project file names show a developer who changed the name of the same ransomware multiple times. Unit 42 considers this pace more consistent with prompt-driven generation than with a traditional development cycle.

The most widespread sample, however, is not ransomware. It is an installer that posed as a recipe search app called Recipe Lister. With a valid digital signature, once installed it silently launched a backdoor. It crossed more than 50 organizations, generating about 6,500 endpoint records and approximately 9,600 alerts. The signature initially avoided suspicion, but an unusual signer paired with heavily packed content led to detection.

Another backdoor, called Oyster, posed as a Dropbox installer. The signature indicated Dropbox as the publisher. Unit 42 states that attackers increasingly rely on AI tools to generate this type of distribution code, making it faster and cheaper to establish initial access.

A separate Windows executable distributed the Rhadamanthys infostealer with active command-and-control communication. Previous reports linked this threat to an AI-assisted infection chain.

The fifth sample impersonated a component of the Chinese security product 360 Total Security. It used a persistence technique known as COM hijacking. It was included in the dataset because it appeared in campaigns distributed alongside AI-themed lures, not because its behavior depended on AI.

Why Defenses Held: Unusual Signatures and Suspicious Packing

The fact that all 12 samples that reached production were detected is not a coincidence. Existing defenses, based on the same methods used for conventional malware, proved sufficient. Sandbox detonation, behavior-based detection, checking for anomalies in digital signatures, and measuring the level of file packing or encryption worked even against AI-related malware.

In the case of Recipe Lister, the checks on the unusual signer and the analysis of heavily packed content were decisive. No need emerged for new detection methods specific to AI-enhanced malware. AI accelerates the creation and variation of malicious tools, but it does not increase their ability to evade controls.

What Changes for Network Defenders

Unit 42's analysis downplays the alarm over the use of AI in malware. Certainly, an attacker can generate variants more quickly and at lower costs. But the success rate does not increase. Most samples remain confined to labs, research repositories, or test environments. Those that actually reach targets are stopped by tools already in use.

For defenders, the lesson is clear: no new products or exotic technologies are needed. What is needed is discipline in existing practices: updating signatures, monitoring certificate anomalies, analyzing the compression level of suspicious files, and maintaining effective sandboxes. AI can change the speed at which malware is produced, but not the way it is stopped.