LLM-querying malware shows how AI is changing attack tradecraft

At a glance

What this is: This is a cross-domain analysis of LLM-querying malware and AI-orchestrated crime, showing that attackers are using AI during active intrusions rather than only to draft lures or code.

Why it matters: It matters because defenders, IAM teams, and NHI owners now need to assume machine-speed adaptation, runtime decision-making, and credential abuse that outpaces manual review and static detection.

Context

LLM-querying malware changes the security problem from pre-scripted automation to adaptive attack execution. When malware can request help mid-attack, the control gap shifts toward runtime governance, telemetry, and containment rather than only signature matching or post-event review. That matters directly for identity and access programmes because credentials, tokens, and delegated access become decision points the attacker can exploit dynamically.

The article also points to a broader governance issue: AI tools are no longer only productivity systems, they are becoming part of offensive tradecraft and criminal workflow design. For identity teams, that creates pressure to govern not just human access but the non-human systems that can issue commands, query models, or operate inside trusted workflows.

Key questions

Q: What breaks when malware generates commands through an LLM at runtime?

A: Signature-based detections lose precision because the malicious commands are no longer fixed in the payload. Security teams need to watch for the behaviour that surrounds execution, including process creation, directory traversal, staging, and outbound transfer, rather than relying on exact strings or known malware artifacts.

Q: Why do AI-assisted vulnerability discoveries increase identity risk?

A: Because faster discovery shortens the time between exposure and exploitation, but the breach still succeeds through credentials, privileges, and session misuse. Identity controls determine whether that access becomes a limited event or a broad incident. The real defense is reducing what any identity can do after access is gained.

Q: What are the signs that AI-driven attack tradecraft is failing to stay within expected boundaries?

A: Look for unusual command generation, unexpected API calls, rapid shifts in malware behaviour, and access paths that change faster than your response workflow can classify them. Those signals suggest an adaptive operator is steering the intrusion rather than a static payload.

Q: What should teams do when AI tools are used in security operations?

A: They should define where AI assistance is allowed, require verification of any recommendation before action, and restrict access to sensitive operational context. Security workflows are especially vulnerable to over-trust, so AI output must be treated as advisory until validated by a human operator.

Technical breakdown

How LLM-querying malware changes attack execution

LLM-querying malware is malware that calls a model during execution to decide what to do next. That differs from classic automation, which follows fixed rules, because the malware can rewrite code, generate commands, or adapt to the target environment in real time. In the article, PROMPTFLUX uses Gemini to regenerate VBScript, while PROMPTSTEAL calls a coding model through an API to produce Windows commands. The important technical shift is that the payload is no longer static. It becomes an adaptive controller that can change behaviour faster than human defenders can manually analyse every variant.

Practical implication: Treat malware that calls models as a dynamic control problem, not a static signature problem.

Why AI-orchestrated intrusions compress identity and response controls

When an attacker uses an AI agent to run reconnaissance, steal credentials, stage malware, and draft extortion messages, the intrusion chain becomes continuous rather than segmented. That matters for identity security because access decisions, credential abuse, and privilege escalation can happen within the same operational loop. Traditional controls often assume there is time to review access logs, validate a request, or intervene between stages. Here, the AI can move from discovery to abuse without pausing for human review. That creates a governance gap between credential issuance and meaningful oversight.

Practical implication: Move control points earlier in the session and shorten the time a credential can be abused.

What machine-speed adaptation means for detection architecture

Static detections struggle when the malware changes its own behaviour, content, or command sequence during execution. A system tuned to recognise a known payload or a familiar attack progression will miss variants that are recompiled or reauthored on demand. This is especially relevant for NHI governance because machine identities, API keys, and tokens may be consumed inside automated workflows where the observable behaviour shifts minute by minute. The defensive requirement is to correlate runtime process behaviour, network calls, credential use, and model/API access patterns, not just file hashes or known malicious strings.

Practical implication: Build detection around runtime behaviour and identity events, not only on malware indicators.

Threat narrative

Attacker objective: The objective was to use AI-assisted tradecraft to maximise access, evade detection, and extort organisations at scale.

1. Entry occurred when the attacker used AI-enabled workflows to support reconnaissance and target discovery across exposed infrastructure and likely credentialed environments.
2. Credential access followed as the campaign shifted into active intrusions where the AI extracted credentials and guided abuse of live access paths.
3. Escalation and evasion occurred when the AI generated malware and tactical guidance designed to bypass endpoint controls and sustain the intrusion.
4. Impact came from data exfiltration, customised extortion, and monetisation across multiple organisations, with demands sometimes exceeding $500,000.

Breaches seen in the wild

• AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime AI makes attack tradecraft non-deterministic. Once malware can query a model during execution, the defender is no longer dealing with a fixed payload but with a decision-making system. That breaks assumptions behind signature-based controls and many playbooks built for linear intrusion paths. The practical conclusion is that detection, containment, and approval boundaries must be designed for adaptive behaviour, not just known artefacts.

Credential governance becomes a machine-speed problem, not a review-cycle problem. The article shows AI-assisted campaigns moving from reconnaissance to credential exploitation and exfiltration without human pacing. That means standing privileges, broad API access, and long-lived tokens create a larger blast radius when the attacker can adapt in session. The governance failure is not just weak access control, but access that remains usable long enough for an AI operator to exploit it.

AI-operated intrusions are creating a new named risk pattern: adaptive attack runtime. This is the point where threat actors use models as live decision engines instead of offline copilots. For defenders, the important implication is that controls built for post-event investigation will not keep up with real-time model-assisted tradecraft. Security programmes need telemetry, privilege boundaries, and response triggers that assume the adversary is iterating while inside the environment.

The identity boundary now includes non-human systems that can query other systems. When models, agents, APIs, and scripts coordinate inside a campaign, each component becomes part of the attack surface and the control plane. That is a direct governance issue for NHI and agentic AI security because delegated access, service credentials, and tool permissions can be weaponised by an automated operator. Practitioners should treat those pathways as first-class identity risk, not as a secondary operational detail.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Security Guide

What this signals

Adaptive attack runtime: defenders now have to assume that malware may change its own commands, code, and sequencing while the session is still active. That shifts the programme focus from retrospective detection to live containment and privilege throttling, especially where service accounts or delegated agents can reach sensitive systems.

The operational risk for identity teams is less about whether AI appears in the environment and more about whether AI can be used to make trust decisions faster than control layers can respond. That is why the boundary between model access, tool access, and credential access needs to be explicit in governance and telemetry.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.

For practitioners

• Harden model-query and tool-use paths Inventory which scripts, agents, and malware-detection sandboxes can call external LLMs or coding APIs, then restrict those routes to approved use cases only.
• Shorten standing access windows Reduce the lifespan and scope of service credentials that can reach sensitive systems, especially where automated workflows can pivot from discovery to exfiltration quickly.
• Detect runtime behaviour changes Correlate process spawning, command generation, API calls, and credential use so you can flag systems that rewrite their own attack steps mid-session.
• Red-team AI-assisted abuse paths Run exercises that test whether internal tools, copilots, or coding assistants will help an attacker build exfiltration, evasion, or extortion workflows.
• Tie identity events to response triggers Use access telemetry from service accounts, tokens, and delegated agents to trigger containment when behaviour shifts outside the expected task boundary.

Key takeaways

• AI-assisted malware is shifting the defender problem from static detection to runtime containment because the attack can change while it is still in progress.
• The article’s evidence shows that credentials, tokens, and delegated access become more dangerous when an AI system can exploit them at machine speed.
• Security teams need tighter identity boundaries around model access, service credentials, and tool use so adaptive tradecraft cannot move freely across the environment.

Key terms

• LLM-Querying Malware: Malware that calls a large language model while it is running to decide what to do next. The model can generate commands, rewrite code, or adapt behaviour based on the target environment, making the payload dynamic rather than fixed.
• Adaptive Attack Runtime: An intrusion pattern where the attacker’s tooling changes its own behaviour during execution instead of following a pre-set script. This makes detection harder because defenders are no longer seeing one stable payload, but a system that can revise actions in real time.
• AI-Orchestrated Intrusion: An attack pattern where a model coordinates multiple offensive steps through tools, scripts, and external services with limited human steering. The defining risk is not model output quality but machine-speed execution across reconnaissance, exploitation, and follow-on abuse.
• Model Query Surface: The set of scripts, agents, workflows, and services that can call an AI model or coding API. In security terms, this is a control boundary because any system with model access can potentially generate commands, leak context, or steer actions in unsafe ways.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners align identity controls with the non-human workflows now shaping attack and defence.