405 AI malware samples, 12 sightings: Unit 42's own count argues against an AI defence line item

The tells Unit 42 lists are the tells of code written to be read rather than run at a target: configurations aimed at localhost or private address ranges, debug logging left verbose, submission histories showing a single upload from a research organisation or academic institution, and directory paths containing research, mal or analysis ^[9]. In the proof-of-concept pile sit LLM-powered ransomware frameworks whose hard-coded ransom addresses point at the Bitcoin Genesis Block, which cannot receive a recoverable payment ^[10]. The whole non-production remainder is sorted into three buckets: proof-of-concept and research code, security validation testing, and AI-themed brand abuse ^[8].

Subtraction is blunter than the percentage. 393 of the 405 hashes have no sighting on a protected endpoint at all ^[14]. The twelve that do sit inside an endpoint telemetry window running from December 2024 to June 2025 ^[5], which works out to fewer than two sightings a month across every non-test Cortex XDR tenant Palo Alto can see ^[16].

What those twelve did matters more than the fact that there were twelve, because the collection criteria treat a functional agentic loop and a coin miner with ChatGPT in its filename as the same kind of sample ^[6]. On criteria that inclusive, a production sighting is not by itself evidence of AI doing any work at runtime.

Two things about the source deserve to be held at once. The prevalence measurement is entirely Palo Alto's own: Cortex XDR agent telemetry, plus WildFire sessions forwarded by its firewalls and agents ^[11]. Absence from that estate is not absence everywhere, and the statement that its products detected and blocked every sample that attempted to reach a customer environment ^[4] is a vendor marking its own work. Against that, the argument runs away from the vendor's commercial interest in a fresh category. Unit 42 describes the space as overwhelmingly proof-of-concept code, security validation testing and researcher submissions that never reached production ^[12], and says the AI component does not evade detection, it changes how the code is authored rather than how it executes ^[1].

That last point is the procurement argument in full. If AI-written malware executes like malware, the things catching it are behavioral detection, cloud-based sandboxing and endpoint analytics ^[1], which are the same budget lines raided when a parallel AI-specific stack gets bought mid-cycle. Unit 42 still says the threat is real, only that operational volume is a fraction of what public repositories imply ^[13]. The spending case that survives its own data is better telemetry, the kind that would show the twelve becoming twelve hundred, not a second detection layer bought on the strength of VirusTotal counts.