RST Cloud: 18 of 293 in-the-wild AI cases were malware calling a model
RST Cloud's review of public threat reports finds adversary AI is mostly abuse of AI tooling teams already run, not self-directing malware.
· RST Cloud · Research by Yury Sergeev, Alex Gould
RST Cloud screened 3,980 public threat reports from August 2025 to September 2026 and found 293 in-the-wild cases involving AI. Only 18 were malware that calls a model at runtime, 185 used AI as a helper and 29 were attacker-run agents.
01What happened
RST Cloud published its analysis on October 13, 2026, alongside a talk by Yury Sergeev and Alex Gould at CyberCon Melbourne. The pair screened 3,980 public threat reports covering August 2025 to September 2026, removed duplicates, added two Anthropic reports and kept 319 cases involving AI. Of those, 293 were seen in the wild rather than in a lab.
02How it works
Living off the Harness is the authors' name for attacks that abuse the tooling wrapped around a model rather than the model itself: project task files, session hooks, repository-local Git settings and approval switches. Their phrasing is that, like living off the land, the attacker brings no new tool, uses the one you already trust, and the model is optional. The counts behind each category are listed below, and the authors stress these are floors, because missing information was coded as a no.
03Who is affected
Developer AI tooling carries most of the risk the report measures. The authors name Claude Code, Codex, Hermes, Qwen Code, Cursor and OpenClaw as the agents attackers reach for, describe runs that used Claude Code with its skip-permissions flag, Gemini CLI in yolo mode and Amazon Q CLI with trust-all-tools, and cite malware going after Cline and Continue configuration files. Attacker-run agent cases rose from 3 between August and December 2025, to 7 from January to April 2026, to 19 from May to September 2026.
04What to do
Inventory which AI coding tools run in your estate, their versions and their update paths, then decide who may authorize tool use and which automation modes are allowed. Treat project task files, session hooks and repository-local Git settings as execution paths, and hunt for attacker harness files such as CLAUDE.md and SKILL.md and for settings with approvals switched off. Test one execution path end to end and confirm analysts can reconstruct what ran.
Questions people ask
- Is malware that calls an LLM at runtime common in the wild?
- Malware that queries a model while running on a victim machine accounted for 18 of the 293 in-the-wild cases RST Cloud counted between August 2025 and September 2026. The authors argue the common assumption that adversary AI means self-thinking malware is not supported by the evidence, and they acknowledge overstating the PROMPTFLUX case in their own earlier reporting.
- What does Living off the Harness mean?
- Living off the Harness is RST Cloud's term for attacks that abuse the tooling wrapped around a model, such as settings files, session hooks and approval switches, instead of prompting the model at all. RST Cloud counted eight such cases among the 293 it reviewed. The authors describe the pattern as bringing no new tool and using the one the victim already trusts.
- How reliable are RST Cloud's adversary AI counts?
- RST Cloud's counts come from 3,980 public threat reports the two authors screened and coded themselves, so they reflect what gets publicly reported rather than all attacks. Missing information was coded as a no, which makes the attribute figures floors rather than totals. The underlying dataset is not published, and RST Cloud sells threat intelligence, so the numbers cannot be independently checked.
Sources 2 links, all fetched
- 1rstcloud.comRST Cloud Analysis
- 2melbourne2026.cyberconference.com.auCyberCon Session