The sampling frame does a lot of the work here. A dataset assembled from WildFire analysis reports, VirusTotal Intelligence and published open-source research [1] is drawn from the three places proof-of-concept code goes specifically to be seen. Finding that most of it never ran anywhere is close to a property of where you looked.
The arithmetic is still worth having in front of you. 393 of the 405 hashes never showed up in endpoint telemetry [2], which puts the production rate at 2.96% [1]. The endpoint window runs December 2024 to June 2025 [6], seven months, so the twelve observed samples work out to fewer than two a month across a large commercial estate [3].
Then there is the denominator. Unit 42 says it deliberately counted any sample where AI was a functional component, a delivery feature, or merely branding, which pulled in cryptocurrency miners that just had "ChatGPT" in the filename [5]. A miner with a fashionable name sits in the same 405 as an LLM-driven ransomware framework. That choice raises the sandbox-only share, and it means any later count run under the same rules can produce a steep growth curve without a single new capability appearing.
The artefact fingerprints are the most useful part of the report for anyone triaging a scary-looking hash. Unit 42 describes samples configured against localhost or private address ranges, verbose debug logging left switched on, single uploads from research or academic organisations, and directory paths containing terms like research, mal or analysis [11]. The cleanest tell is a ransomware proof of concept whose hard-coded ransom address points at the Bitcoin Genesis Block, which cannot receive recoverable payments [10]. Nobody built that to get paid.
The load-bearing claim is the one about mechanism: existing behavioural detection, cloud sandboxing and endpoint analytics catch these samples the same way they catch conventional malware, because AI changes how the code is authored rather than how it executes [8]. That is falsifiable and it is the thing a defender can test locally. It also means the case for a separate AI-malware detection programme rests on a capability nobody in this dataset demonstrated.
Two limits on the read. Palo Alto reports that its own products detected and blocked every sample that tried to reach a customer environment [4], which is the vendor grading its own coverage, and absence from one vendor's non-test tenants [6] is not absence from the world. And the report is dated August 2026 [12] while its telemetry stops in June 2025 [6][7], a gap of about fourteen months [4]. A census this stale can tell you the visible corpus was mostly research exhaust; it cannot tell you what the last year looked like.
