AI-Generated Malware Is Boring, Fast, and That Is the Problem
The novelty is not sophisticated new capability. It is thousands of unremarkable variants produced faster than signature and reputation systems can absorb them.
The alarming headline is AI writing novel malware. The operational reality is duller and worse: the same commodity payloads, regenerated continuously, each build structurally different enough to miss static signatures and fresh enough to have no reputation history.
What the generation actually changes
- Uniqueness by default. Hash-based and structural signatures match one build. There is no second build.
- Reputation starvation. Cloud reputation systems lean on prevalence. A sample seen once, anywhere, has no prevalence to lean on.
- Cheap localisation. Lures in fluent local languages, matched to the target's sector, at no marginal cost — the single biggest change to phishing effectiveness this decade.
- Faster iteration on failure. A blocked variant is regenerated in minutes, not rebuilt in days.
What does not change
The behaviour. To be useful, the payload still has to establish persistence, touch credential stores, enumerate the network, reach a command channel and stage data. Those actions are finite in number and hard to vary. Behavioural detection ages far better than anything content-based, which is precisely why the attacker economics push toward regenerating the artefact and leaving the behaviour intact.
Where to put the effort
1. Detection engineering over feed subscriptions
Indicator feeds have declining value against one-time-use samples. Behavioural rules mapped to technique coverage keep working.
2. Default-deny execution
Application control is the control that does not care how novel the sample is. It is also still the control most organisations defer because it is unpopular.
3. Identity and egress as the chokepoints
Payload delivery is cheap and will succeed sometimes. Phishing-resistant authentication and constrained egress limit what follows.
4. Measure time-to-contain, not block rate
Block rate against an infinite variant supply is a vanity metric. Containment time is the number that reflects reality.
When every sample is unique, the artefact stops being the signal. Behaviour is all you have left, and it is enough.
