Unit 42: Real-World Prevalence of 405 AI-Related Malware Samples and Evaluation of Existing Defenses

Unit 42 reports that out of 405 AI-related malware samples checked against their telemetry, only 12 (3.0%) were found on non-test Cortex XDR protected endpoints. These 12 samples all generated alerts in the company's XDR systems. However, the remaining 97% of the samples did not appear in the company's real-world customer telemetry, suggesting they remain contained in research repositories and testing environments.

The 405 samples cover a broad range of AI-related malware, including actual malware with LLM or agent features, code evaluated as created with LLM support, samples using AI for distribution or social engineering, and traditional malware misusing AI product names. This broader definition of "AI malware" means the 405 samples should not be interpreted as 405 malicious AI-driven threats.

Real-world telemetry from December 2024 to June 2025 showed the 12 confirmed samples were detected by Unit 42's multi-layer defenses, including sandbox execution, behavioral analysis, code signing anomalies, and traditional endpoint behaviors. This indicates existing defenses are effective against AI-malware that reaches customers' endpoints, though the study emphasizes the findings are limited to the observed sample set and time period.