The Smartest Part of Tomorrow’s Malware Is Already on Your Laptop
Traditional malware carries its own expertise: routines to enumerate files, recognise formats, sift browsers, identify credentials, and decide what to steal. Generative AI suggests a different and more troubling architecture – one in which the malicious program gets smaller because the intelligence it needs is already on the victim’s machine, waiting for a prompt. For security leaders that inverts a long-standing assumption: the sophistication of an attack no longer has to travel inside the payload.
This is no longer speculative. In July 2026 Trend Micro published an analysis of more than two hundred session logs from a Russian-speaking actor known as “bandcampro”, who jailbroke Google’s Gemini CLI simply by telling it, in a persistent memory file, that he was an authorised penetration tester. The AI then became the primary hacking agent: it migrated command-and-control infrastructure and ran a botnet of eight machines inside a dental clinic, troubleshooting at least fifty-nine times. The asymmetry of effort is the point – the entire toolkit was roughly five kilobytes of plain text, and in one six-minute migration the human contributed about 11 per cent of the work. The infrastructure was trivial; the intelligence lived in the agent.
Academic research shows how much further this logic runs. In a June 2026 paper, researchers associated with the Vector Institute and the University of Cambridge built a worm that parasitically runs open-weight language models on the machines it compromises, using their stolen compute to reason about each new target and synthesise a tailored attack. On an isolated 33-host network it compromised nearly three-quarters of machines within seven autonomous days. Two consequences matter. Because the worm carries no predetermined exploit, patching one vulnerability no longer halts it. And because it needs no commercial AI service, the industry’s favourite safeguards – refusals, rate limits, content filters – are, in the authors’ word, structurally irrelevant.
This creates an uncomfortable problem precisely where enterprises are investing. Developers are installing command-line agents with filesystem, terminal, and repository access because those permissions make them productive; the same permissions make the tools valuable to attackers. That value is already being harvested indirectly: since March 2026, EclecticIQ and others have tracked SEO-poisoning campaigns that impersonate Gemini CLI and Claude Code, serving cloned install pages whose PowerShell one-liner quietly runs a fileless infostealer – harvesting OAuth tokens, CI/CD credentials, and VPN keys – while the genuine tool installs in the foreground. The vendors’ own install paths are not compromised; the brands are simply being weaponised as bait.
The defensive implication is bracing: a compromised machine cannot rely on the model being morally persuasive. Vendor refusal policies are close to worthless once an attacker controls the local execution environment, as both the memory-file jailbreak and the guardrail-indifferent worm show. Security leaders should treat agentic AI tools as privileged software and act on three priorities. First, apply least privilege deliberately – scope each agent’s filesystem, credential, and network access to its task, and sandbox it rather than granting standing access to everything a developer can reach. Second, log agent actions as you would production commands, with deterministic gates on genuinely dangerous operations, so runtime reasoning cannot silently execute destructive steps. Third, defend the installation path itself – pin official sources, block copy-paste installers from unverified domains, and monitor for the impersonation lures already circulating. The great irony of agentic computing is that the industry is spending billions teaching machines to understand computers as humans do. Attackers get that abstraction free. Tomorrow’s malware may contain less code, not more – because the intelligence is already on the laptop.
Sources
Personal analysis. Views are mine, not my employer's.