The Future of Malware is LLM-powered

Netskope Threat Labs evaluated whether LLMs can be weaponized for malware by prompting GPT-3.5, GPT-4, and preliminarily GPT-5 to produce Python code for defense-evasion (process injection, terminating AV/EDR processes, and VM detection). The research found LLMs can be coerced to generate malicious code (including via role-based prompt injection to bypass GPT-4 guardrails), but GPT-3.5/GPT-4 produced unreliable anti-VM scripts while GPT-5 improved code reliability at the cost of stronger guardrails; overall the work confirms architectural feasibility but highlights operational limitations and evolving trade-offs between capability and safety.