Coder Builds Malware in Week With AI Help

A single developer built a Linux malware framework in less than a week using artificial intelligence, said security researchers. Check Point researchers say this is the first documented case of AI-generated malware reaching operational maturity at a pace that challenges assumptions about development timelines and resource requirements.

See Also: Agentic AI and the Future of Automated Threats

The researchers said they identified VoidLink, a cloud-focused malware framework, in December after discovering Linux malware samples that appeared to originate from a Chinese-speaking development environment. The framework includes custom loaders, implants, rootkit modules for evasion and more than 30 plugins. When researchers first encountered it, the malware’s maturity, efficient architecture and flexible operating model suggested a substantial development effort by a threat actor with multiple coordinated teams.

Operational security failures by the developer exposed development artifacts. The materials provided evidence that the malware was produced predominantly through AI-driven development and reached its first functional implant in less than a week. An exposed open directory on the developer’s server stored various files from the development process, including source code, documentation, sprint plans and internal project structure.

The directory contained planning artifacts describing sprints, design concepts and timelines for three distinct internal teams spanning more than 30 weeks of planned development. But the sprint timeline did not align with the researchers’ observations, with the malware’s capabilities expanding far faster than the documentation implied. One recovered test artifact timestamped Dec. 4, a mere week after the project began, indicates that by that date, VoidLink was already functional and had grown to more than 88,000 lines of code.

The developer’s approach can be described as Spec Driven Development, whose workflow includes a developer specifying what they are building, creating a plan, breaking that plan into tasks and only then allowing an agent to implement it. Artifacts from VoidLink’s development environment suggest the developer followed this pattern: first defining the project based on general guidelines and an existing codebase, then having the AI translate those guidelines into an architecture and build a plan across three separate teams paired with strict coding guidelines and constraints.

VoidLink’s development likely began in late November, when its developer turned to Trae Solo, an AI assistant embedded in an AI-centric integrated development environment called Trae. The researchers lack access to the full conversation history, but Trae automatically produces helper files that preserve key portions of the original guidance provided to the model. Those files appear to have been copied alongside the source code to the threat actor’s server and later surfaced due to the exposed directory.

Trae generated a Chinese-language instruction document structured as a series of key points covering objectives, material acquisition, architecture breakdown, risk and compliance assessment, code repository mapping, deliverables and next steps. The summary suggests the opening directive was not to build VoidLink directly but to design it around a thin skeleton and produce a concrete execution plan to turn it into a working platform.

Researchers also uncovered internal planning material describing a comprehensive work plan spanning three development teams. Written in Chinese and saved as Markdown files, the documentation shows characteristics typical of large language models including structured formatting and detail. The earliest documents, timestamped Nov. 27, describe a 20-week sprint plan across three teams designated as a core team working in Zig programming language, an Arsenal team working in C and a backend team working in Go.

A review of the code standardization instructions against the recovered VoidLink source code shows what researchers described as striking alignment. Conventions, structure and implementation patterns match closely enough that researchers concluded the codebase was written to those exact instructions.

With access to the documentation and specifications of VoidLink and its various sprints, researchers replicated the workflow using the same Trae integrated development environment the developer used. When given the task of implementing the framework described according to the specification in the markdown documentation files, sprint by sprint, the model began to generate code that resembled the actual source code of VoidLink in structure and content. By implementing each sprint according to the specified code guidelines, feature lists and acceptance criteria, and writing tests to validate those, the model spat out the requested code.

The usage of sprints is a helpful pattern for AI code engineering because at the end of each sprint, the developer has a point where code is working and can be committed to a version control repository, which can then act as the restore point if the AI makes errors in a later sprint. While testing, integration and specification refinements are left to the developer, this workflow can offload almost all coding tasks to the model.

VoidLink is not the first malware to incorporate AI elements. Google’s Threat Intelligence Group said in November that it had identified malware families, including PromptFlux and PromptSteal, that use large language models during execution to dynamically generate malicious scripts and obfuscate code. Google characterized this as “a new operational phase of AI abuse, involving tools that dynamically alter behavior mid-execution.” Russian military hackers used PromptSteal in cyberattacks on Ukrainian entities, while PromptFlux appeared to be under development by financially motivated actors (see: Malware Developers Test AI for Adaptive Code Generation).

Earlier documented examples of AI-assisted malware were typically low quality, linked to inexperienced actors, or closely resembled open-source tools. Security researchers had anticipated that AI would amplify malicious capabilities, but evidence until VoidLink pointed primarily to rudimentary tools or variants of existing malware, the researchers said.

Check Point characterizes VoidLink as shifting the baseline for AI-driven malicious activity. Eli Smadja, Check Point Research Group Manager, said the case demonstrates how dangerous AI can become in the hands of more experienced threat actors. The framework shows a high level of maturity, advanced functionality, an efficient architecture, and a dynamic, flexible operational structure. According to Check Point, VoidLink was identified at an early stage of development and was not deployed against victims or used in active attacks.

The broader cybersecurity industry has watched AI’s role in malicious activity evolve. Industry reports show that polymorphic malware tactics are present in an estimated 76% of all phishing campaigns, and over 70% of major breaches involve some form of polymorphic malware. A Cisco survey found that 86% of business leaders with cyber responsibilities reported at least one AI-related incident over the past year, while 87% of organizations report having experienced an AI-driven cyberattack in the past year.

The development represents what security experts have described as a shift from AI being used primarily for technical support and productivity gains to becoming integrated throughout the full attack lifecycle. State-sponsored actors, including those from North Korea, Iran and China, continue to use AI tools to enhance all stages of their operations, from reconnaissance and phishing lure creation to command and control development and data exfiltration, according to Google’s analysis.