Cybercrime tooling is evolving, and AI is now playing a growing role inside malicious code itself. Threat intelligence findings show a shift from AI as a research assistant to AI as an embedded operational component. Google Threat Intelligence Group has released its latest report on the threats imposed by AI, with some of the findings listed below.
AI-Integrated Malware Enters the Wild
New malware families are beginning to incorporate AI directly into their execution paths. Rather than relying solely on static logic, these threats use AI to:
-
Dynamically generate or modify code at runtime
-
Adjust behaviour to evade signature-based detection
-
Decide when to execute actions based on environmental cues
This approach complicates traditional malware analysis and reduces the effectiveness of rule-based detection systems.
Distillation Attacks Fuel the Malware Ecosystem
Model extraction attacks play a critical role in this evolution. By distilling commercial AI models, threat actors can deploy locally hosted or modified models that avoid monitoring and usage restrictions. These cloned models are then integrated into malware frameworks, allowing adversaries to benefit from AI capabilities without relying on external APIs.
This convergence of model theft and malware development represents a new phase of weaponised AI — one that prioritises persistence and stealth over novelty.
Agentic Capabilities and Automation at Scale
Although still largely experimental, agentic AI concepts are beginning to influence malware design. Future AI-enabled malware may autonomously:
-
Identify valuable systems
-
Modify lateral movement strategies
-
Adapt to defensive controls in real time
Even partial automation in these areas could significantly increase attacker efficiency while overwhelming security teams.
For defenders, the implication is stark: malware analysis and detection must evolve to account for adaptive, AI-driven behaviour, not just known indicators.
