Unit 42 collected 405 distinct malware samples that use artificial intelligence in some way, from AI-written code to agentic execution loops to files that merely carry a chatbot's name. Then it went looking for them in Palo Alto Networks' own customer telemetry. Twelve turned up. Every one of them was detected and blocked.
That gap, 405 samples against 12 that ever reached a protected endpoint, is the finding in research published on August 25 by Unit 42's Sara McBroom. Roughly 97% of the samples, in the team's own words, exist only in sandboxes and on VirusTotal.
What the other 97% actually is
The samples that never appeared in production telemetry sort into three piles, and none of them is an attack. The largest is proof of concept and research code: LLM-powered ransomware frameworks whose ransom addresses point at the Bitcoin Genesis Block, which cannot receive a recoverable payment; reconnaissance scripts written for conference demonstrations; frameworks that target localhost or private address ranges and ship with verbose debug logging no real operator would leave switched on. Many were uploaded once, by a security research organization or a university, from a directory path with research or analysis in the name.
The second pile is security teams and breach simulation platforms testing their own detection against publicly reported AI malware, which shows up as the same hash uploaded repeatedly by one organization during one time zone's working hours. The third is straightforward brand abuse: conventional malware wrapped in an installer that imitates a popular AI product. Real enough for whoever downloads it, but the AI there is marketing, not capability.
Seven ransomware builds in six days
The twelve samples that did reach endpoints, across organizations in three countries, span five families. The most represented is FunkSec, a Rust ransomware strain that multiple researchers have assessed as partly LLM-generated. Seven distinct variants showed up, all compiled between January 1 and 6, 2025, sharing a codebase and the same tradecraft: disabling Windows Defender through PowerShell and registry changes, deleting volume shadow copies, replacing the desktop wallpaper with the ransom note. The debug paths left in the binaries carry four different project names, Dev, Funksec, Darkzone and Darkfunk, which reads like one developer iterating quickly. Unit 42's point is the pace rather than the sophistication: seven builds in six days looks less like software development and more like regenerating a prompt.
A recipe app that 50 companies downloaded
The single most widely encountered sample was not clever at all. An installer posing as a recipe-finding application called Recipe Lister, code-signed with a certificate issued to Global Tech Allies Ltd that has since been revoked, drops a JavaScript backdoor into a temporary directory. It appeared across more than 50 organizations and generated some 9,600 endpoint alerts, none of them a successful execution. A second sample carries an Authenticode signature whose subject reads Dropbox, Inc and side-loads the Oyster backdoor through an AutoIt loader. To a victim, both look like signed, verified software.
The detection story on the recipe installer is the useful part. The code signature initially suppressed static detection, because a signed file looks legitimate. What caught it was behaviour: the signer was uncommon across the organization's fleet, and the file's entropy sat at 0.999970, effectively maximum, which indicates packed or encrypted content. The cloud sandbox verdict then made the block definitive.
The AI changes the author, not the execution
That is Unit 42's central claim, and it is why the numbers land where they do. Whatever wrote the code, it still has to run, and running is where behavioural analytics and sandboxing have always done their work. The report is also careful about what it is: one vendor's telemetry over a defined window, with a deliberately broad definition of what counts as AI-enabled, so 3% measures what reached these particular customers rather than the threat as a whole. A separate finding this month that most real-world AI-themed cases are fake installers points the same way. The practical read is not that AI-enabled malware is fictional. It is that public sample repositories are a poor proxy for what defenders actually face, and that treating a VirusTotal count as a threat level will mislead you badly.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.