ReversingLabs: malware calling LLM APIs is rising but still rare

01What happened

Igor Lasic, SVP of Engineering at ReversingLabs, published the measurement on November 10, 2026, drawing on the company's own file analysis corpus. The post asks whether the predicted wave of AI-run attacks has arrived and answers that it has not, even as the underlying counts climb each year, listed below. Lasic writes that the counts are early signals, not a count of AI-orchestrated intrusions.

02How it works

The measurement is a signature search across files ReversingLabs had already judged malicious, matched on references to LLM API endpoints. A looser second query widened the net, and the files it matched this year averaged about 1.8 endpoint references each. ReversingLabs states that an API reference does not prove model execution, attacker intent or successful exploitation, which is why the narrower high-confidence figure carries a sampling margin.

03Who is affected

Malware triage and detection teams are the audience for these numbers, not users of one named product. The families ReversingLabs names in its data call hosted models at runtime and remain small in volume, in the single or double digits of samples each.

04What to do

Treat an LLM API reference inside a sample as one weak indicator and not as evidence of an AI-run attack. ReversingLabs argues for detection based on behavior instead: in its PHP2Shell work it identified 10 exploit files on or within three days of disclosure, which only 5% to 12% of antivirus engines detected.

Sources 3 links, all fetched

1. 1reversinglabs.comRL Research
2. 2vulncheck.comVulnCheck Data
3. 3reversinglabs.comPHP2Shell Analysis