# ReversingLabs: malware calling LLM APIs is rising but still rare

> ReversingLabs file telemetry shows malware referencing LLM APIs growing every year while confirmed AI-run intrusions stay rare.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** ReversingLabs
- **Disclosed:** 2026-11-10
- **Affects:** LLM APIs
- **Research by:** [Igor Lasic](https://www.reversinglabs.com/blog/author/igor-lasic)
- **Primary source:** https://www.reversinglabs.com/blog/the-ai-cyberattack-surge-hasnt-arrived-but-the-warning-signs-are-growing
- **Page:** https://theinjection.dev/items/reversinglabs-ai-attack-surge-signals/

ReversingLabs counted 1,680 high-confidence malicious files that reference LLM APIs between January 1 and October 24, 2026, up from 620 in all of 2025, and calls the counts early signals rather than proof of AI-run intrusions.

## What happened

Igor Lasic, SVP of Engineering at ReversingLabs, published the measurement on November 10, 2026, drawing on the company's own file analysis corpus. The post asks whether the predicted wave of AI-run attacks has arrived and answers that it has not, even as the underlying counts climb each year, listed below. Lasic writes that the counts are early signals, not a count of AI-orchestrated intrusions.

## How it works

The measurement is a signature search across files ReversingLabs had already judged malicious, matched on references to LLM API endpoints. A looser second query widened the net, and the files it matched this year averaged about 1.8 endpoint references each. ReversingLabs states that an API reference does not prove model execution, attacker intent or successful exploitation, which is why the narrower high-confidence figure carries a sampling margin.

## Who is affected

Malware triage and detection teams are the audience for these numbers, not users of one named product. The families ReversingLabs names in its data call hosted models at runtime and remain small in volume, in the single or double digits of samples each.

## What to do

Treat an LLM API reference inside a sample as one weak indicator and not as evidence of an AI-run attack. ReversingLabs argues for detection based on behavior instead: in its PHP2Shell work it identified 10 exploit files on or within three days of disclosure, which only 5% to 12% of antivirus engines detected.

## Quick facts

- **High-confidence files:** Roughly 150 in 2024, 620 in 2025, 1,680 through October 24, 2026
- **Broader query:** 596 in 2024, 3,044 in 2025, 10,821 through October 24, 2026
- **Endpoint references:** 19,601 across the 10,821 files, about 1.8 per file
- **Named families:** PromptFlux (11 samples), LameHug and LameHubloader (23), PromptSpy (3)
- **Exploitation rate:** VulnCheck confirmed 14 of 1,061 AI-attributed vulnerabilities exploited in 1H 2026, about 1.3%
- **Method:** Pooled sample of 160 named detections, 66% qualifying share, about plus or minus 7 points
- **Author:** Igor Lasic, SVP of Engineering, ReversingLabs

## Sources

1. [RL Research](https://www.reversinglabs.com/blog/the-ai-cyberattack-surge-hasnt-arrived-but-the-warning-signs-are-growing)
2. [VulnCheck Data](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026)
3. [PHP2Shell Analysis](https://www.reversinglabs.com/blog/the-sky-is-falling-again-what-php2shell-says-about-ai-the-disclosure-process-and-security)