Generative AI can help malware developers research evasion techniques, write and debug code, and build components such as loaders or obfuscation. Reports from OpenAI and Anthropic describe individual cases in which human operators used AI as part of malware development. They do not show that AI makes malware undetectable, that it routinely creates malware on its own, or how common AI-assisted evasion is.
What “AI-assisted evasion” means
In this context, evasion means behaviors intended to make malicious software harder for security tools to detect or for analysts to understand. It is not a special property that a model can simply add to a program. A human operator may use an AI assistant to research techniques, troubleshoot code, or iteratively build components, then decide how to use or combine them.
As an Amazon Associate I earn from qualifying purchases.
OpenAI’s reports describe tasks including research into evasion, debugging, translation, coding, and iterative work on malware components. Reported techniques include obfuscation, packing, and DLL side-loading. These are examples from particular cases, not a complete inventory of AI-generated techniques or proof that any one technique consistently defeats security controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
What providers have reported
| Reported case | How AI was used | What was reported about evasion and impact |
|---|---|---|
| Crimson Sandstorm, described by OpenAI in 2024 | OpenAI said the actor used its services to research common ways malware could evade detection, alongside research, translation, debugging, and basic coding. | The report documents the research activity; it does not establish that the AI produced malware that successfully evaded detection. |
| ScopeCreep, described by OpenAI in 2024 | OpenAI reported iterative assistance with Windows malware development, including requests for code improvements across accounts. | The report described signature-focused payload handling, DLL side-loading, packing, and attempts to alter Defender settings. OpenAI characterized the capabilities as not particularly novel and said it saw no evidence of widespread interest or distribution. |
| A component-building case, described by OpenAI in October 2025 | OpenAI said direct malicious requests were refused, but the user elicited building-block code and apparently assembled components into malware workflows. | The report mentions obfuscation and loader patterns. OpenAI could not independently verify the user’s off-platform activity, so the reported assembly and use should not be treated as independently confirmed deployment. |
| Ransomware development, described by Anthropic in 2025 | Anthropic reported a cybercriminal using Claude to develop and sell several ransomware variants. | The variants were described as including evasion capabilities, encryption, and anti-recovery measures. Anthropic reported forum offers in the range of $400 to $1,200 USD; that is the reported asking range, not evidence of sales, effectiveness, or typical ransomware pricing. |
These are provider case reports, not controlled tests of malware or security products. The reports provide examples of attempted or reported activity, but they do not establish how often the techniques worked against real-world defenses.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can generative AI write malware that avoids antivirus?
AI can assist with code and development tasks that may contribute to evasion, but the available reports do not support a general claim that it can reliably produce malware that avoids antivirus. In the reported cases, people prompted models, iterated on outputs, debugged code, and assembled components. OpenAI described ScopeCreep’s techniques as not particularly novel; in the October 2025 case, it could not independently verify activity outside its service.
“Avoids antivirus” is also too broad to treat as a single outcome. Detection depends on the software, its configuration, updates, and the behavior being examined. The cited reports do not compare endpoint products or publish detection rates, so they cannot support claims that a particular antivirus will or will not catch AI-assisted malware.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Does AI make malware more dangerous?
It can make some development tasks easier or faster for an operator, but the cases do not establish that generative AI has created a new class of malware capability. OpenAI’s October 2025 report summarized its view this way: “We continue to see threat actors bolt AI onto old playbooks to move faster, not gain novel offensive capability from our models.” That is OpenAI’s institutional assessment, not an independently measured finding about all models or attackers.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOpenAI also said it had disrupted and reported activity across more than 40 networks since it began public threat reporting in February 2024. That figure covers multiple categories of policy-violating activity, not malware cases alone, and should not be read as a count or prevalence measure of AI-assisted malware.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What the reports do—and do not—show
- Supported: Providers have reported individual actors using generative AI for malware-related research, coding, debugging, and development of components or ransomware variants.
- Not established: The share of malware that uses generative AI, how often AI-assisted evasion succeeds, or whether AI makes malware broadly undetectable.
- Not established: That the models autonomously created or deployed the reported campaigns. The accounts describe human-directed use; some off-platform activity could not be independently verified.
- Not measured: Comparative detection performance among antivirus or endpoint-security products.
Provider reports also describe defensive action. OpenAI said it detected and disrupted ScopeCreep activity and coordinated removal of its repository. That demonstrates a response to a reported case, not a guarantee that platform monitoring or any single security control will catch every threat.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practical steps for readers
The case reports do not identify a product that reliably detects AI-assisted malware. Sensible protections remain layered rather than dependent on a label such as “AI malware.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Keep your operating system, applications, and supported security controls updated.
- Be cautious with downloads from repositories or pages that impersonate legitimate projects, especially when the source or publisher is unfamiliar.
- Do not assume a file is safe because it was created with AI, or dangerous solely because it was. Assess its source and behavior using your normal security practices.
Generative AI can contribute to malware development, including work aimed at evasion. The public cases show assistance within human-directed workflows, not proof of universal success, autonomous campaigns, or widespread prevalence.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
