Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
The predicted wave of autonomous, AI-driven cyberattacks has not yet shown up as a clearly measurable surge in cyber losses. But that is not the same as saying attackers are standing still.
In an October 24 search of the ReversingLabs malicious-file corpus, we found a growing number of files containing references to large language model (LLM) APIs. Our estimated high-confidence subset increased from roughly 150 files in 2024 to 620 in 2025 and 1,680 from January 1 through October 24, 2026. These are early signals, not a count of AI-orchestrated intrusions.
The distinction matters: an API address in a file may reflect a bundled software library rather than a live model call. Still, when we combine the corpus findings with published investigations of AI-enabled malware and AI-assisted vulnerability research, a picture emerges. AI is entering individual stages of attack workflows faster than it is transforming the whole cybercrime economy.
We searched malicious files for API endpoints associated with OpenAI, Anthropic, Google Gemini, DeepSeek, OpenRouter, Hugging Face and local Ollama servers. The broader search returned 596 malicious matches in 2024, 3,044 in 2025 and 10,821 through October 24, 2026. A narrower, sample-based estimate of named, higher-confidence malware families produces the figures above.
Figure 1: ReversingLabs Spectra Analyze queries, run October 24, 2026. Higher-confidence figures are estimated from a pooled random sample; they are not independently verified counts of AI-using malware.
The numbers are small relative to the size of the warehouse. More important, an API reference does not prove model execution, attacker intent or successful exploitation. In 2026, for example, the 10,821 files contained 19,601 endpoint references—about 1.8 per file—consistent in part with multi-provider SDKs and libraries embedded in code.
There is another unresolved issue. A noticeable jump in monthly matches from May to June 2026 has not yet been tied to a specific malware family, collection change or detection change. The increasing count merits attention, but we cannot attribute every part of the trend to new attacker behavior.
In an October 22 essay, security researcher Joshua Saxe asked why the expected “agentic attacker hordes” have not translated into a sharp increase in losses. He estimates that AI accounts for a small fraction of cybercrime-related losses and points to constraints such as criminal economics, law enforcement, the time required to industrialize a new business model and limits on access to commercial models. His loss estimate is a model, not an observed AI-loss total.
ReversingLabs does not measure economy-wide cyber losses, so our files cannot validate that estimate. What we can test is narrower and more useful for defenders: whether model-related capabilities are appearing in malicious artifacts, whether publicly reported AI-enabled malware is represented in our collection, and how quickly exploit samples appear around new vulnerabilities.
We found samples of several AI-enabled malware families described by other researchers. Their volumes remain modest, and the functions differ substantially. Together, they show automation of particular tasks, not proof of fully autonomous campaigns.
Malware family | Reported AI-related behavior | ReversingLabs observation |
|---|---|---|
PromptFlux | Uses Gemini to rewrite portions of its code (GTIG). | 11 samples; first seen May 10, 2025. |
LameHug / LameHubloader | Uses Hugging Face router endpoints; attribution to APT28 is from CERT-UA. | 23 samples; first seen July 4, 2025. |
PromptSpy | Uses Gemini to help navigate a device UI (ESET/GTIG). | 3 samples; first seen April 4, 2026. |
Family labels and sample counts are from ReversingLabs. Descriptions and actor attributions are from the cited outside reports; ReversingLabs has not independently attributed these samples to actors.
ReversingLabs first observed PromptFlux in May 2025, roughly six months before GTIG named the family in November. Other vendor reports describe AI tools used for vulnerability research, exploit validation and repeated modifications to evade detection. Anthropic reported one 2025 case in which a model handled an estimated 80–90% of tactical work across roughly 30 targets. These are selected cases—not a measure of adoption across all actors.
PHP2Shell illustrates the urgency without requiring an exaggerated story about autonomous attackers. The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were the subject of AI-assisted discovery and rediscovery reporting. Amazon reported an attempted exploit against its honeypots before public disclosure, while other researchers cautioned that some circulating proof-of-concept code did not achieve full code execution.
ReversingLabs identified 10 PHP2Shell exploit files, first observed on disclosure day or within the next three days, classified under CVE-2026-109618. Just 5%–12% of antivirus engines detected those files in the assessment described in our research. Some may correspond to incomplete proof-of-concept exploits, so this is not evidence of 10 successful compromises.
The point for defenders is straightforward: serious vulnerabilities can move from disclosure to experimentation quickly, sometimes before conventional detection has caught up. That challenge grows when affected components are embedded in third-party software that security teams did not build and cannot easily inspect.
Published exploitation rates require perspective. VulnCheck found 14 confirmed exploited vulnerabilities among 1,061 attributed to AI-assisted discovery in the first half of 2026, or approximately 1.3%. That is not, by itself, proof that AI-discovered vulnerabilities are exploited more often. Other published comparisons use different populations and cannot be treated as like-for-like rates.
The data supports preparation rather than panic. Organizations can take practical steps before AI-enabled methods become more routine:
The strongest conclusion from this research is not that an AI-driven cybercrime explosion is inevitable. Nor is it that AI has had little impact. The available evidence points to something more specific: AI capabilities are surfacing in malicious files and individual attack tasks, while the scale of fully autonomous operations remains uncertain.
That leaves defenders with an opportunity. The organizations best prepared for the next phase will be those that can identify exposed software quickly, inspect the files and components entering their environments, recognize changing malicious behavior and move from discovery to mitigation with less manual delay. The right time to build those capabilities is before the most disruptive use cases are routine.
Updated November 4, 2026: Binance’s disclosed intrusion chain mapped to ATT&CK, the FBI attribution, and what RL data confirms, contradicts or adds.
This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them.
