AML.T0102 Generate Malicious Commands: Detecting Malware and Agents That Ask an LLM What to Run

Malware and rogue agents no longer need to carry their commands with them: they can ask a large language model to write them at run time, so the signature defenders look for changes with every request. MITRE ATLAS tracks this as AML.T0102 Generate Malicious Commands, in the AI Attack Adaptation tactic (AML.TA0001). ATLAS describes adversaries using LLMs, either in the victim's environment or hosted externally, to turn natural language into malicious commands that adapt to the environment and are harder to detect, with prompts that can blend in with normal traffic. This page covers how the technique shows up, the ATLAS cases, and how to detect, prevent and respond. It is for detection engineers, endpoint and network security teams, AI platform owners and model providers. It contains no prompts or commands. The broader malware picture is in the LLM-Powered Malware Guide; this page goes deeper on the technique itself.

Key takeaways

• The model call is the new indicator. Generated commands vary, but the malware still has to reach a model. An LLM API connection from a process or host with no business reason to make one is a strong triage signal.
• Behaviour detection still works. Whatever text the model returns, the host still runs discovery tools, searches documents, compiles code in memory and sends data out. Those behaviours are what ATT&CK analytics already catch.
• Three sources of the model. ATLAS cases show public model APIs (LAMEHUG via Hugging Face, HONESTCUE via the Gemini API), attacker-run agents, and models already in your environment. Each needs a different control.
• ATLAS maps two mitigations. AML.M0020 Generative AI Guardrails (inspect requests and generated commands, block them, and validate commands before execution) and AML.M0022 Generative AI Model Alignment.
• Your own agents can do it too. In two 2026 evaluation incidents, AI agents generated shell commands and payload code outside their scope. Command validation and sandboxing apply to sanctioned agents as much as to malware.

Where it sits

ATLAS created AML.T0102 on 25 November 2025, last modified it on 27 May 2026, rates it Realized and lists the Enterprise platform. Its placement in AI Attack Adaptation reflects what the model does: it converts a general goal into commands fitted to the host in front of it. The commands are then run through other techniques.

Cases in ATLAS

LAMEHUG

CERT-UA reported the campaign in July 2025 and attributed it to APT28. A phishing email from a compromised official account, posing as a ministry representative, delivered a ZIP archive with a PyInstaller-packed executable. The Python malware sent natural-language instructions to a model through the Hugging Face API and ran the returned commands: reconnaissance of hardware, processes, services, network and domain context, then recursive searches of user document folders, with data sent out over SFTP or HTTP POST. Guardsix (formerly Logpoint) notes this may be the first publicly documented malware to use an LLM this way.

HONESTCUE and Xanthorox

Google Threat Intelligence Group reported in February 2026 that HONESTCUE, first seen in September 2025, sends prompts to the Gemini API and receives C# code for its second stage, which it compiles with the .NET CSharpCodeProvider and runs in memory; GTIG assesses the aim is to undermine network detection and static analysis, since the hard-coded prompts are not malicious on their own. GTIG found Xanthorox, sold as a self-hosted offensive AI, was in fact built on commercial models including Gemini, and that services like it depend on API keys often harvested from vulnerable self-hosted AI gateways. Google disabled the accounts and AI Studio projects linked to Xanthorox and used the findings to strengthen classifiers and the model.

Agents

Unit 42 recovered a session from 7 May 2026 in which a DeepSeek-powered Hermes agent, tasked through Telegram, searched for exposed Langflow and n8n systems, obtained public exploits and generated scans and probes. No exploitation succeeded, because the targets required authentication or lacked the needed configuration. In the OpenAI and Hugging Face Breach 2026, evaluation agents generated C code, shell-injection strings and follow-on commands, revising them as results came back.

Detection

Do not try to signature the generated text: it changes by design. Detect the model access, the execution pattern and the outcome.

For the ATT&CK side of these analytics, see the T1059 Command and Scripting Interpreter Defensive Guide.

Prevention controls

Against malware that calls out to a model

1. Route all LLM traffic through an AI gateway or egress proxy. Allow model API access only from approved applications, service identities and hosts; block it from servers and user endpoints that have no approved use. Guardsix recommends blocking LLM services that are not needed. See the AI Gateway and LLM Gateway Guide.
2. Keep the execution controls you already have. Application control, script restrictions and attack surface reduction rules stop the commands whatever model wrote them (ATT&CK M1038 Execution Prevention, M1040 Behavior Prevention on Endpoint).
3. Close the delivery route. LAMEHUG arrived by phishing as a packed executable in an archive; block executable and .pif content in email and train staff to verify unusual requests from official accounts by a second channel.
4. Protect your API keys. GTIG notes offensive AI services run on harvested keys. Keep keys in a secrets manager, scope and rate-limit them, and alert on usage anomalies. See AI API key abuse.

For models and agents you operate (AML.M0020, AML.M0022)

1. Guardrails on input and output. ATLAS recommends inspecting requests and generated commands against the task context and service policy, and blocking malicious command generation or release. See the AI Guardrails and AI Firewalls Guide.
2. Validate commands independently before execution. Where an agent has a shell or code tool, check each command against an allowlist or policy in a component the model cannot alter, and require human approval for high-impact actions.
3. Sandbox execution. Run agent-generated code in an isolated environment without internet access, credentials or metadata service access by default. See the AI Agent Sandboxing and Code Execution Guide.
4. Prefer aligned models with safety controls enabled. Both 2026 evaluation incidents ran with cyber refusals or classifiers reduced or switched off. If a use case needs that, it needs compensating isolation.

If you provide a model API

Monitor for accounts whose usage pattern is command or malware generation, act on abuse reports, and share findings, as Google describes doing with Xanthorox. Classifier and model improvements from observed misuse are part of AML.M0022 in practice.

Response

1. Isolate the host and block the model endpoint at the proxy for that host, keeping the logs that show the API calls and responses where captured.
2. Recover the prompts. Hard-coded prompts in the binary or script reveal intent and scope, even though the generated commands vary.
3. Scope by behaviour, not hashes. Hunt for the same sequence (LLM API call, discovery burst, document staging) across the estate, since generated commands differ per host.
4. Revoke credentials and API keys found on or used by the host, including any AI service keys the malware carried.
5. Report abuse to the model provider with timestamps and account or key details so the access can be disabled.

Measuring it

Decision guidance

• Small organisations: block AI API domains at the DNS or proxy layer except for approved tools, and rely on existing EDR behaviour rules. That covers the LAMEHUG pattern without new tooling.
• Organisations building AI applications: an AI gateway gives both the allowlist and the logging needed to tell your traffic from malware traffic; deploy it before agents get shell tools.
• Blocking versus monitoring: block model APIs on servers and privileged hosts; on developer endpoints, monitor and alert on non-approved processes instead, where blocking would break legitimate tools.
• Local models: if models run on endpoints or servers, inventory them and restrict which processes can call them, since local inference generates no external traffic to detect.

Common failure patterns

• Allowing all AI APIs everywhere. When every host can reach every model API, the malware's model call looks like normal traffic.
• Hunting only on hashes and fixed command lines. Generated commands vary by host and by run.
• Giving agents raw shell tools without a validator. The model's output becomes code execution with the agent's permissions.
• Turning off safety controls for testing without extra isolation. The 2026 evaluation incidents show what happens when both are relaxed at once.
• Leaving AI keys and self-hosted gateways exposed. GTIG ties underground AI services to harvested keys.

Framework mapping

Practitioner checklist

• Inventory which applications, identities and hosts legitimately call LLM APIs.
• Route approved LLM traffic through a gateway; block model APIs elsewhere by default.
• Build a detection for an LLM API call followed by shell or interpreter spawn.
• Alert on discovery bursts, document staging and in-memory compilation.
• Add independent command validation and sandboxing to every agent with a shell or code tool.
• Keep model safety controls on in production; isolate any test that relaxes them.
• Store AI API keys in a secrets manager with scope, quotas and anomaly alerts.
• Include model provider abuse reporting in the incident response plan.

Standards and references

• MITRE ATLAS: Generate Malicious Commands (AML.T0102)
• MITRE ATLAS: LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands (AML.CS0044)
• MITRE ATLAS: Generative AI Guardrails (AML.M0020)
• Guardsix: APT28's new arsenal, LAMEHUG
• Google Threat Intelligence Group: AI Threat Tracker, distillation, experimentation and integration
• Unit 42: Autonomous AI cyber attack campaign
• MITRE ATT&CK: Command and Scripting Interpreter (T1059)

Related NHI Mgmt Group resources: LLM-Powered Malware Guide, APT28 (Fancy Bear) Threat Actor Profile, AML.T0050 Command and Scripting Interpreter, AML.T0053 AI Agent Tool Invocation, MITRE ATLAS Mitigations Guide.