AI-Generated PowerShell Malware: An Experimental Framework and Dataset

2026-06-29 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

An experimental framework and dataset have been developed to assess AI-generated PowerShell malware, addressing the emerging cybersecurity threat posed by LLMs generating malicious code. The framework incorporates a novel sandbox approach for dynamic analysis of AI-generated malware. Additionally, a new, manually curated dataset of real-world PowerShell malware, annotated in natural language, is presented to aid LLM training and evaluation. Evaluation of permissive, open-weight LLMs adapted for PowerShell malware generation revealed a high similarity to real malware in terms of triggered OS malicious events, with a median Jaccard index of 84.5% and 48.4% of instances achieving complete overlap.

Key takeaway

For cybersecurity analysts investigating the offensive capabilities of AI code generators, this research underscores the urgent need for advanced detection. Your security operations must prioritize integrating dynamic analysis of AI-generated code, given its high similarity to real malware. Leverage the proposed natural language annotated dataset to train defensive LLMs and enhance threat intelligence, preparing for sophisticated AI-driven attacks.

Key insights

LLMs can generate PowerShell malware highly similar to real-world samples, posing a significant cybersecurity threat.

Principles

• LLMs are a significant cybersecurity threat
• AI-generated malware closely mimics real-world malicious OS events

Method

An experimental framework assesses LLM-generated PowerShell malware using a novel sandbox approach for dynamic analysis.

In practice

• Utilize natural language annotated datasets for LLM training
• Evaluate open-weight LLMs for malware generation capabilities

Topics

• Generative AI
• PowerShell Malware
• Cybersecurity Threats
• LLM Security
• Dynamic Analysis
• Malware Datasets

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Scientist, Research Scientist

Related on AIssential

• MLWhiz Weekly Recsys/ML/GenAI Newsletter # 6 — AI capabilities are rapidly outrunning existing institutional frameworks in cybersecurity, coding, and language design.
• Spoon-feeding a Monster — Autonomous security testing requires separating LLM reasoning from deterministic execution to ensure ground truth and prevent hallucinations.
• Vibecoded Malware Is Flooding the Internet — AI-generated malware evades static detection through varied code structures, lowering the barrier for threat actors and demanding a shift to behavioral analysis.
• Can Small GenAI Language Models Rival Large Language Models in Understanding Application Behavior? — Small GenAI models can rival larger LLMs in malware detection, offering efficiency for resource-constrained environments.
• Embedding Forbidden Text in Spyware to Discourage AI Analysis — Malware embeds policy-triggering text in comments to disrupt AI analysis by exploiting LLM input processing.
• AI Worm — The AI worm prototype integrates an LLM for autonomous, decentralized propagation and multi-attack generation, posing a new cyber threat.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.