The danger frontier: low-cost, evasive, abundant malware
As part of Incalmo’s mission to make AI safely ubiquitous, we do safety research on the frontier cyber capabilities of models. Recently, to help anti-virus systems stay ahead of the OSS threat frontier, we created PathoGen, a novel system that turns (open) models1 into evasive but capable malware generation factories. When powered by GLM 5.2 (and other open weight models like Kimi K32), PathoGen generated hundreds of custom malware across ransomware, RATs, credential stealers, cryptominers, wipers, C2 implants, and more. Of the samples we submitted to VirusTotal, ~27% evaded all 75 scanners and ~75% evaded all but one scanner. Alarmingly, even with Windows Defender fully engaged, several detonated samples went undetected while executing the required harmful actions, showing evidence that not only static analysis is defeated, but conventional dynamic engines can fall short. This methodology is scalable, we were able to generate hundreds of samples spanning several malware categories at a total cost of just $2 to $35 per sample, orders of magnitude below the $1,000s to $100,000s that evasive malware typically fetches on underground markets3.
In our experiments, with PathoGen, 27% are fully evasive.
A combination of developments enable these results: (1) our PathoGen system, and (2) recent developments in open weight models, namely GLM 5.2.
PathoGen. Our system combines a series of signals to guide an underlying model to create evasive but feature rich malware at a low budget. We purposefully keep details vague to prevent misuse but the effectiveness of this approach is evident when comparing to a baseline GLM 5.2. While the baseline produces no viable sample that also evades all 75 detectors on VT, PathoGen produces several. The baseline is measured in the same PathoGen harness but without the custom signals.
To highlight how capable the model is, and how difficult this malware is to create, below we show GLM 5.2 coding a snippet of ransomware source code (full trace redacted).
Frontier-ish capabilities, frontier risks. PathoGen benefits from increased capabilities of underlying models. To investigate, we compared GLM 5.2 to GLM 5.0 and GLM 4.7, roughly spanning ~6 months of releases. To run the experiments, we used the same configuration across all models. While GLM 5.0 and GLM 4.7 can generate viable malware, GLM 5.2 outputs are often more capable and more evasive than its predecessors. We speculate that this is due to GLM 5.2’s improved coding ability. Given the right signals, viable malware generation capability has been around for a while, evasiveness is where the real gains appear to happen.
Destructive uplift. Malware that’s reliably evasive and destructively functional isn’t a new paradigm. Someone with the right underground reputation, the right BTC amount, the right connections, and the patience to find a vendor who won’t rip you off can eventually buy such custom malware online3. In contrast, our results are previewing a world where almost anyone can create such malware for a few bucks and a single prompt.
The promise inside the peril. Despite immediate safety concerns, we see a promising path toward improving endpoint detection systems. Today, endpoint detection is inherently reactive: vendors continually collect the latest malware samples that evade their systems, then update to fill the gaps. We see a future that flips this paradigm to being proactive where frontier models proactively generate malware to identify gaps in defenses before bad actors ever find them.
1. Incalmo supports open weight models. Open weight models are key to security research. Similar to other dual-use security tools, open weight models benefit defenders more than attackers. We are publishing this work to identify safety risks early so we can prepare before these capabilities are widely deployed. ↩
2. This work was initially done before Kimi K3 was released. After the release, we replicated most of the results with Kimi K3, and it performs comparably to GLM 5.2. ↩
3. In practice, measuring the cost of high-quality evasive malware is extremely difficult because samples are bought through brokers rather than directly off dark-web marketplaces. One Positive Technologies report puts the median RAT price at ~$1,500, with the cheapest ones starting at $80 (these likely cannot evade anti-virus) and the most expensive samples exceeding $320,000. For historical context on underground marketplace pricing, see also Christin, “Traveling the Silk Road: A Measurement Analysis of a Large Anonymous Online Marketplace” (WWW 2013). ↩
Citation
@misc{akgul2026dangerfrontier,
title = {The danger frontier: low-cost, evasive, abundant malware},
author = {Akgul, Omer and Dong, Jin-Dong and Singer, Brian},
year = {2026},
month = {6},
howpublished = {\url{https://www.incalmo.ai/blog/2026/06/26/glm-malware/}},
note = {Incalmo}
}