Google's Threat Intelligence Group has uncovered an experimental malware project that can ask an artificial intelligence model to rewrite its own source code, creating a moving target for security software that relies on recognizing known patterns of malicious code. The project, called PROMPTFLUX, was discovered in June 2025 and represents what Google describes as an early example of «just-in-time» AI being built directly into malware.
PROMPTFLUX was a VBScript-based malware project whose most notable component was called the «Thinking Robot.» According to Google's findings, the malware could contact the Gemini AI model and request new obfuscation techniques designed to make its code harder for security software to recognize. Google later found multiple variations of PROMPTFLUX, including one that contained instructions telling Gemini to rewrite the malware's entire source code every hour while preserving the pieces needed for it to continue working.
The significance of this approach lies in how it complicates detection. Security software often identifies malicious code by looking for known patterns or digital fingerprints. If that code keeps changing, the malware becomes a moving target. However, researchers caution that this does not automatically make malware invisible to current security tools. Modern antivirus protection does much more than compare files against a list of known threats. Microsoft Defender Antivirus, for example, uses real-time monitoring, behavioral analysis, heuristic protection, cloud-delivered protection, and machine learning to identify new threats that may not match a known signature.
Google emphasized that PROMPTFLUX was still being developed when it was found. Researchers had yet to see it successfully compromise a victim's device or network, and Google disabled assets connected to the activity. The experimental nature of the project means it did not yet represent a fully operational threat, but its techniques offered a glimpse of how AI could be integrated into malware in the future.
The story does not end with PROMPTFLUX. Google has since documented AI being used by malware during live attacks. One notable example is PROMPTSTEAL, which Google identified as being used by the Russian government-backed group APT28 against targets in Ukraine. Google says this was its first observation of malware querying a large language model while deployed in live operations.
PROMPTSTEAL takes a different approach from PROMPTFLUX. Instead of asking AI to rewrite itself, it queries the Qwen2.5-Coder-32B-Instruct model through Hugging Face. The model generates Windows commands that PROMPTSTEAL can execute. Those commands can gather information about a computer and copy documents from folders including Documents, Downloads, and Desktop. The malware then sends collected information back to infrastructure controlled by the attacker. This marked a significant change, as the AI model becomes part of what the malware does after it starts running.
Google also detailed an Android backdoor called PROMPTSPY in May 2026, after it was initially identified by ESET. PROMPTSPY contains an AI-powered module called GeminiAutomationAgent. It can send information about what appears on an infected Android device to Gemini and use the response to help navigate the phone's interface. In other words, the malware can use AI to understand part of what is happening on the screen and determine how to interact with it.
Google found that PROMPTSPY could also make itself harder to remove. When a victim tried to uninstall it, the malware could place an invisible overlay over the uninstall button so taps would appear to do nothing. There was some good news for Android users: Google said it took action against the actor behind the malware and that no apps containing PROMPTSPY were found on Google Play at the time of its May report. Known versions are detected by Google Play Protect, which is enabled by default on Android devices with Google Play Services.
Still, PROMPTSPY provides a clearer picture of where this technology could go. Malware can begin reacting to the device it finds instead of relying only on instructions written before the attack starts. For defenders, the challenge is evolving. Signature detection remains one layer of cybersecurity, but it is not the only one. Behavioral analysis and machine learning can still catch suspicious activity even when code changes. The emergence of AI-powered malware suggests that security tools will need to continue adapting to threats that can think and react in real time.