AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back)

We thought polymorphic malware was bad. Now, we’re seeing something new: “Generative Malware” that leverages LLMs.

Google recently detailed an experimental threat called PROMPTFLUX. As developers, the technical details are both terrifying and fascinat…


This content originally appeared on DEV Community and was authored by freerave

We thought polymorphic malware was bad. Now, we're seeing something new: "Generative Malware" that leverages LLMs.

Google recently detailed an experimental threat called PROMPTFLUX. As developers, the technical details are both terrifying and fascinating.

đź‘ľ How PROMPTFLUX Works (The Attack)

It's deceptively simple, which is what makes it scary.

  1. Base Language: VBScript.
  2. Mechanism: The script contains a hard-coded API key.
  3. Execution: When run, it calls an LLM API (the report mentioned Gemini 1.5 Flash).
  4. The Prompt: It sends a prompt like, "Act as an expert VBScript developer. Create obfuscated code to help evade antivirus detection."
  5. The Result: A brand-new, malicious script is generated "just-in-time." Every time it runs, it can be completely different, rendering signature-based detection useless.

🛡️ How Big Sleep Works (The Defense)

This is where it gets really cool. This isn't just another fuzzer. Big Sleep is an AI agent from DeepMind and Project Zero.

It's designed to mimic the behavior of a human security researcher:

  • Understands Code: It uses an LLM to understand the logic of a codebase.
  • Intelligent Fuzzing: Instead of random inputs, it generates complex inputs to test logic it "thinks" might be vulnerable (e.g., stack buffer overflows).
  • Real-World Finds: This agent has already found a critical Zero-Day vulnerability in SQLite and another in the Chrome graphics library. It found them before they could be widely exploited.

🤔 What This Means for Us as Developers

  1. API Security: Securing our APIs (especially if they serve LLMs) is more critical than ever. "Abuse" just got a whole new meaning.
  2. Defensive Programming: We may soon be using "AI agents" like Big Sleep to test our own code before it hits production.
  3. The Arms Race: We are on the front lines of a new arms race. Our own tools (AI) are now being used by both sides.

What are your thoughts on this? Have you started using any AI-powered tools for vulnerability hunting in your own projects? And how can we build defenses against the misuse of AI tools themselves?

Let's discuss in the comments!


This content originally appeared on DEV Community and was authored by freerave


Print Share Comment Cite Upload Translate Updates
APA

freerave | Sciencx (2025-11-10T16:58:13+00:00) AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back). Retrieved from https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/

MLA
" » AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back)." freerave | Sciencx - Monday November 10, 2025, https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/
HARVARD
freerave | Sciencx Monday November 10, 2025 » AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back)., viewed ,<https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/>
VANCOUVER
freerave | Sciencx - » AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back). [Internet]. [Accessed ]. Available from: https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/
CHICAGO
" » AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back)." freerave | Sciencx - Accessed . https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/
IEEE
" » AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back)." freerave | Sciencx [Online]. Available: https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/. [Accessed: ]
rf:citation
» AI vs. AI: How Google’s ‘PROMPTFLUX’ Malware Rewrites Itself (And How ‘Big Sleep’ Fights Back) | freerave | Sciencx | https://www.scien.cx/2025/11/10/ai-vs-ai-how-googles-promptflux-malware-rewrites-itself-and-how-big-sleep-fights-back/ |

Please log in to upload a file.



There are no updates yet.
Click the Upload button above to add an update.

You must be logged in to translate posts. Please log in or register.

Related Posts