The Rise of Self-Learning Malware: When Threats Rewrite Themselves Faster Than You Can Detect Them 

This report warns of a new class of self-learning malware that uses large language models and on-host AI to rewrite and adapt its code in real time, evading signature- and behavior-based defenses; it cites specific observed families (PROMPTFLUX, PROMPTSTEAL, FRUITSHELL, QUIETVAULT), a 2026 self-replicating AI worm, accelerating metrics on mutation and breakout times, and recommends prevention-first defenses like Automated Moving Target Defense to block execution rather than rely on detection.