As part of Incalmo’s mission to make AI safely ubiquitous, we do safety research on the frontier cyber capabilities of models. Recently, to help anti-virus systems stay ahead of the OSS threat frontier, we created PathoGen, a novel system that turns (open) models1 into evasive but capable malware generation factories. When powered by GLM 5.2 (and other open weight models like Kimi K32), PathoGen generated hundreds of custom malware across ransomware, RATs, credential stealers, cryptominers, wipers, C2 implants, and more. Of the samples we submitted to VirusTotal, ~27% evaded all 75 scanners and ~75% evaded all but one scanner. Alarmingly, even with Windows Defender fully engaged, several detonated samples went undetected while executing the required harmful actions, showing evidence that not only static analysis is defeated, but conventional dynamic engines can fall short. This methodology is scalable, we were able to generate hundreds of samples spanning several malware categories at a total cost of just $2 to $35 per sample, orders of magnitude below the $1,000s to $100,000s that evasive malware typically fetches on underground markets3.
A combination of developments enable these results: (1) our PathoGen system, and (2) recent developments in open weight models, namely GLM 5.2.
PathoGen. Our system combines a series of signals to guide an underlying model to create evasive but feature rich malware at a low budget. We purposefully keep details vague to prevent misuse but the effectiveness of this approach is evident when comparing to a baseline GLM 5.2. While the baseline produces no viable sample that also evades all 75 detectors on VT, PathoGen produces several. The baseline is measured in the same PathoGen harness but without the custom signals.
To highlight how capable the model is, and how difficult this malware is to create, below we show GLM 5.2 coding a snippet of ransomware source code (full trace redacted).
Frontier-ish capabilities, frontier risks. PathoGen benefits from increased capabilities of underlying models. To investigate, we compared GLM 5.2 to GLM 5.0 and GLM 4.7, roughly spanning ~6 months of releases. To run the experiments, we used the same configuration across all models. While GLM 5.0 and GLM 4.7 can generate viable malware, GLM 5.2 outputs are often more capable and more evasive than its predecessors. We speculate that this is due to GLM 5.2’s improved coding ability. Given the right signals, viable malware generation capability has been around for a while, evasiveness is where the real gains appear to happen.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: www.incalmo.ai.
