Where’s the Brain? Hunting AI Malware at Machine Speed by Following the Prompts

In 2026 AI-powered intrusions dominated the security news. Autonomous agents broke into banks, ministries and AI platforms at “machine speed” with barely any human involved and unstoppable AI-powered malware supposedly bypasses your EDR on the fly. Look behind the hype, though, and every case still relies on a large model running outside the victim’s network. Commands have to get in and results have to get out. That’s noisy, slower than “machine speed” suggests, and defenders can detect it today. Most reported attacks look like pentests with automated tools like ARTEX, CyberStrikeAI & Co. The abliterated model runs on attacker infrastructure or reaches commercial LLM APIs via proxies and attacks internet-facing apps from the outside. These operations rarely move laterally, but they still work. Only a few attacks went deeper. In the Mexican government breach and the OpenAI–Hugging Face incident, agents proxied commands inside the target. Even S1ngularity, which hijacked victims’ own AI tools, relied on outside LLMs, so victims paid for their own compromise in tokens. We show how this external factor helps detection and also limits the attacks, and throw in a few deception ideas as a bonus disruption. We close with a look into the future of malware-less AI attacks, from memory poisoning, modified .md files and hijacked skills to MCP tooling. We’ll also show our proof-of-concept backdoor using Chrome’s built-in Gemini Nano for fully offline inference. No API calls, no model traffic to catch, yet still faster than spreading a model over 15 TV boxes.