Proactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware

Proactive EDR Against Adaptive Evasion: Countering Self-Modifying Agentic Malware

Speakers: Hiroaki Toyota, AI Researcher, LAC Co., Ltd.

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=K2_ZnEECI7o

Overview

In an era where artificial intelligence is rapidly integrating into everyday software and infrastructure, the cybersecurity landscape faces an unprecedented challenge: agentic malware. This talk, presented by Hiroaki Toyota, an AI Researcher at LAC Co., Ltd., at FIRSTCON, delves into the critical and emerging threat posed by self-modifying, AI-driven malware designed to autonomously evade traditional Endpoint Detection and Response (EDR) systems. Toyota's research highlights a new class of threats that leverage AI for dynamic runtime behavior, self-modification, and "living off the AI" or "living off the agent" within compromised environments, making them incredibly difficult to detect with conventional signature-based or even heuristic-based approaches.

The presentation serves as a proactive call to action, urging security professionals to rethink their defensive strategies before these advanced techniques mature and become widely weaponized. Toyota, an AI researcher with expertise in security automation and offensive AI, candidly admits not being a malware expert, yet his insights into the adversarial use of AI provide a crucial perspective. The core message is that current EDR solutions are fundamentally unprepared for malware that lacks static signatures, executes in memory, and mimics legitimate AI-driven workflows, demanding a paradigm shift towards detecting impossible behavioral patterns and the "connective tissue" between seemingly benign events.

This article will explore the architecture of such agentic malware, dissect three illustrative attack scenarios—AI-driven Living off the Land, Living off AI, and Living off the Agent—and detail the proposed proactive EDR countermeasures and a broader defense-in-depth strategy. The research emphasizes that the barrier to weaponization for these threats is low, while the barrier to detection needs to come down much faster, necessitating immediate attention to inventorying AI tools, auditing context files, and implementing advanced correlation rules to maintain visibility and resilience against this evolving threat.

Background

▶ Watch: Introduction and agenda for AI-driven malware (0:00)

The evolution of AI-driven malware can be broadly categorized into three types, as outlined by Google's ZTID report from November 2025, which serves as a foundational context for this research. First, AI-assisted malware represents a traditional approach where AI is used externally, primarily for generating malicious code or content before deployment. Second, AI-integrated malware embeds AI directly within the malware, enabling autonomous decision-making, dynamic code generation, self-modification, and AI-driven living off the land (LOTL). Third, AI-targeted malware exploits the victim's own AI infrastructure, exemplified by generative AI worms or "living off the AI" and "living off the agent" techniques. Toyota's talk primarily focuses on the latter two categories, which represent the cutting edge of this threat landscape.

Current proof-of-concept malware families like Prompt-to-steal (adaptive data exfiltration using external AI APIs), Prompt-to-frag (hourly self-rewriting for evasion), and Quick Bot (hijacking pre-installed AI tools like Claude and Gemini) illustrate these capabilities. While these are still primitive and no mass incidents have been observed, the risk of rapid weaponization is significant. This necessitates proactive threat modeling to understand and counter these techniques before they mature. The fundamental problem addressed by Toyota's research is the stealth and adaptability of agentic malware. Unlike traditional malware controlled by a remote C2 server, this new breed operates as an independent agent, autonomously embarking on its mission within the target host. It possesses no static signatures, rewrites its own execution logic, and uses hard-coded API keys to communicate with trusted programs, allowing it to blend seamlessly into legitimate administrative activities and stay below EDR alert thresholds.

Traditional EDR systems struggle because the entire malicious payload flows inside encrypted TLS traffic to trusted LLM endpoints and executes in-line within parent processes. While tools like Sysmon might capture standard Python execution logs and HTTPS connections (Sysmon ID 3), EDR often fails to trigger specific behavior alerts due to the absence of suspicious file writes or anomalous process spawns that would typically flag malicious activity. The core of this evasion lies in the malware's architecture, which leverages a sophisticated loop comprising orchestration, execution, and evaluation phases, utilizing only Python built-in standard libraries to minimize its supply chain footprint and maximize stealth. This inherent blending problem—where malicious AI-driven actions are structurally identical to legitimate AI workflows—is the central challenge that Toyota's research aims to address.

Key Findings

▶ Watch: Core concept: autonomous, self-modifying agentic malware (5:00)

The central discovery of Toyota's research is the profound challenge posed by agentic malware to existing cybersecurity defenses. This new class of threat is characterized by its autonomous, self-modifying, and adaptive nature, allowing it to operate without static signatures and blend seamlessly into legitimate system activities. The core findings highlight three distinct, yet interconnected, attack scenarios that demonstrate this evasion capability:

1. AI-driven Living off the Land (LOTL): This scenario proves that agentic malware can leverage external LLMs (like GPT-4) to generate and execute commands just-in-time, adapting its behavior based on execution outputs. The key is on-demand code generation and self-modification, meaning the core payload never exists as a static file and mutates with each iteration. Traditional EDR monitoring of standard process creations (e.g., PowerShell, certutil) fails because these actions blend into background noise. Detection becomes possible only by observing LLM latency gaps and the cyclical nature of API calls followed by process execution, rather than individual events. Crucially, even with core Defender protections active, destination hostnames in Sysmon ID 3 were often empty, circumventing hostname-based filtering. The automatic reflection loop enables the malware to analyze errors and generate structurally different alternatives, making it resilient to initial detection attempts.

1. Living off AI (LOAI): This scenario demonstrates the malware's ability to pivot to local AI infrastructure. Instead of calling external APIs, the stub detects and utilizes local LLMs (like Ollama running Gemma 4 E2B) on the victim's host. This on-device prompt generation eliminates all egress inference traffic, making the attack invisible to perimeter network defenses. After the "backend pivot" to localhost, all inference traffic remains within the host, bypassing network-based C2 detection entirely. Sysmon typically doesn't record loopback traffic, and even deep packet inspection (DPI) would struggle without semantic evaluation of the prompt context, which no current endpoint tool provides.

1. Living off the Agent (LOA): This is perhaps the most insidious, as it involves contextual payload injection into configuration files of legitimate AI agents (e.g., modifying CloudMarkdown for CloudCode). The attacker's work is completed by a single file write, after which the legitimate AI agent (under its own trusted identity and high integrity) ingests the contaminated context and executes the attacker's instructions. The attacker process exits long before the malicious payload is activated, leaving no live process to trace. This attack circumvents standard File Integrity Monitoring (FIM) because paths like CloudMarkdown are not typically monitored by default, and the file modification itself appears as a normal file operation.

The overarching finding is the "blending problem": legitimate AI workflows and malicious agentic scenarios produce structurally identical telemetry from an EDR perspective. This means blocking these actions would break legitimate AI functionality, while allowing them enables agentic malware. Therefore, the research concludes that detection must shift from identifying known artifacts or individual actions to identifying impossible behavior patterns and the "connective tissue" between components, focusing on sequences, API bindings, and context file integrity, rather than isolated events.

Technical Deep Dive

▶ Watch: Scenario: Living Off AI, pivoting to local LLMs (14:30)

The core of Hiroaki Toyota's research centers on the sophisticated architecture of agentic malware, designed to operate autonomously and evade detection through self-modification and integration with legitimate AI infrastructure. The proposed threat model is built around a three-layered loop: orchestration, execution, and evaluation.

1. Orchestration Layer: This layer manages the malware's overarching goal, array of tasks, and current context. It dynamically adapts the attack strategy based on previous outcomes and environmental observations.
2. Execution Layer: Here, an LLM (Large Language Model) generates code just-in-time. Critically, this code is compiled directly into memory, meaning no files are written to disk for the core payload. The generated code then executes host actions, typically tailored commands that mimic normal administrative activities (e.g., PowerShell, certutil).
3. Evaluation Layer: The LLM acts as a "judge," analyzing the standard output and error streams of the executed commands. If a security restriction is encountered or a command fails, the LLM rewrites the prompt context and devises a new execution strategy. This feedback loop is what makes the malware self-modifying and adaptive, allowing it to autonomously achieve its goal.

A key design principle of this agentic malware is its reliance solely on Python built-in standard libraries, eliminating the need for third-party SDKs and thus minimizing its supply chain footprint and making it harder to identify through dependencies.

The engine powering this adaptive loop incorporates three critical features:

• DAG-driven Context Injection: Execution history is modeled as a Directed Acyclic Graph (DAG). This allows the malware "stub" to inject only the necessary prior outputs into the next LLM prompt, keeping token usage low and preventing context pollution, which is crucial for efficient LLM interaction.
• Hybrid Backend Adoption: The stub can dynamically switch between cloud APIs (e.g., GPT-4) and local LLM instances (e.g., Ollama running Gemma). This flexibility is fundamental to the "Living off AI" scenario, enabling the malware to eliminate egress traffic when local resources are available.
• Automatic Reflection Loop: This is the concrete implementation of the self-modification feedback. When a command fails, the engine analyzes the error trace and generates a structurally different alternative, preventing repetitive alert triggers and increasing resilience against simple behavioral blocking.

AI-driven Living off the Land (LOTL)

In this scenario, the malware leverages an external LLM for sequential, adaptive tasks without leaving static file indicators. The demo illustrates a multi-phase attack:

1. Reconnaissance: Collecting OS information and directory listings.
2. Staging: Managing output, base64 encoding data using utilities like certutil.
3. Exfiltration: Sending encoded data to a C2 server via HTTP POST.
4. Artifact Deletion: Deleting all temporary files and the initial script.

Crucially, Sysmon ID 3 (network connections) for OpenAI endpoints showed an empty destination hostname when routed through Cloudflare, bypassing hostname-based filtering. Detection hinges on observing the time-series characteristic cycling anomalies—blue gaps in the timeline representing LLM latency—between OpenAI API calls and process executions, a pattern unfakeable by human operators. The reflection loop was evident, with three phases hitting errors, leading to self-modification and successful re-execution. MITRE ATT&CK mapping shows known individual TTPs, but the autonomous orchestration is the novel threat.

Living off AI (LOAI)

This scenario demonstrates the malware's ability to divert its cognitive function to on-host AI infrastructure. The stub first locates a verified local LLM process (e.g., Ollama), then queries localhost:11434 to enumerate available models. In the demo, Gemma 4 E2B was detected and injected at runtime. From this point, all inference traffic moves to localhost, eliminating egress traffic and rendering perimeter network defenses blind. Sysmon does not typically record loopback traffic, and the activity is indistinguishable from a developer using a local chatbot. Detecting this requires semantic evaluation of prompt contexts, a capability currently lacking in endpoint tools.

Living off the Agent (LOA)

This scenario involves subverting an autonomous agent via context file pollution. The stub confirms the presence of an AI agent (e.g., CloudCode) and locates its global system prompt file (CloudMarkdown). A single add-content core injection appends malicious instructions to CloudMarkdown. The attacker's work is done in under 65 seconds, and the attacker process exits. Subsequently, when CloudCode starts, it ingests the contaminated context and executes the attacker's instructions under its own trusted identity. Sysmon logs show PowerShell spawns and file operations, but the critical CloudMarkdown path is often not monitored by default FIM solutions. The process tree only shows CloudCode, as the attacker's process is long gone, making lineage difficult to trace.

These scenarios collectively underscore the technical sophistication of agentic malware and the fundamental limitations of current EDR approaches, which are designed to detect binary artifacts or suspicious process trees, not dynamic, in-memory, context-aware AI-driven operations.

Demo / Proof of Concept

▶ Watch: Scenario: Living Off the Agent via context file pollution (19:30)

Hiroaki Toyota's presentation included compelling demonstrations for each of the three attack scenarios, recorded across virtual machines to illustrate the real-world impact and evasion techniques. These demos were crucial in visualizing the autonomous nature of agentic malware and the challenges it poses to traditional security tools.

AI-driven Living off the Land (LOTL) Demo

The first demo showcased the agentic malware executing a multi-stage attack on a victim's Hyper-V VM (left screen), while an attacker VM (right screen) awaited exfiltrated data. The victim simply ran a Python script, initiating an entirely autonomous process. The malware, interacting with GPT-4 as its external LLM backend, dynamically generated code for each phase.

1. Reconnaissance & Staging: The stub successfully collected OS information and directory listings. Temporary files were intentionally created for visual clarity in the demo (though in a real attack, these might be minimal or in-memory). The collected data was then base64 encoded using the certutil Windows binary.
2. Exfiltration: The base64 encoded data was exfiltrated to the attacker's C2 server via HTTP POST. The attacker VM visibly received the data, confirming successful exfiltration.
3. User Impact & Cleanup: The victim's Explorer UI changed, and a pop-up message box appeared, indicating the final stages of the attack. Crucially, the malware then proceeded to delete all artifacts, including the initial script itself, leaving no static files behind.

The timeline analysis of this demo highlighted several key observations: consistent cycles of OpenAI API calls followed by process execution, and blue gaps representing LLM latency. When the AI execution encountered errors (marked in red), the LLM autonomously fixed them and issued new commands, demonstrating the reflection loop in action. Furthermore, Sysmon logs for network connections (Sysmon ID 3) to the OpenAI endpoint, which was routed via Cloudflare, showed an empty destination hostname, illustrating how basic network filtering can be bypassed.

Living off AI (LOAI) Demo

This demonstration focused on the malware's ability to utilize local AI resources, eliminating external network traffic. The stub began by locating a verified local LLM process, specifically Ollama. Without any external network contact, it queried localhost:11434 to detect available models. In this case, Gemma 4 E2B was identified, and the "backend pivot" to the local model was completed.

1. Local Inference: The stub then sent a connectivity check to the local LLM and injected an attacker-controlled prompt. The example prompt was a "FIFA World Cup 2026 prediction."
2. On-Device Response: The response, predicting "France will be the champion," was generated entirely on the victim's hardware using the local Gemma model.
3. No Egress Traffic: The critical takeaway from this demo was the complete absence of egress inference traffic after the pivot to the local LLM, rendering the attack invisible to perimeter network defenses. The timeline clearly showed the shift in phase three, where all subsequent inference traffic remained on the localhost.

Living off the Agent (LOA) Demo

The third demo illustrated the stealthy subversion of a legitimate AI agent through context file pollution.

1. Reconnaissance & Injection: The stub first confirmed the existence of the .cloud directory, indicating CloudCode was installed, and enumerated markdown files within it to locate CloudMarkdown (the global system prompt file). A single add-content core injection was then performed, appending malicious instructions to CloudMarkdown.
2. Attacker Exit: The attacker's work was complete in under 65 seconds, and the attacker process exited, demonstrating a short "time on target" for the initial compromise phase.
3. Agent Activation: The demo then showed opening CloudMarkdown in VS Code, clearly displaying the injected instruction appended at the end. Subsequently, when CloudCode was launched, it naturally ingested the contaminated context. The malicious payload became active, and the agent returned the output of the attacker's command (e.g., "your account"), even though the attacker's process had exited long before this moment. CloudCode executed the malicious instructions under its own trusted identity, showcasing the "inherited trusted root" concept.

These demos vividly conveyed the capabilities of agentic malware, highlighting their dynamic nature, ability to leverage legitimate infrastructure, and the inherent difficulties in detecting them using current EDR paradigms.

Defensive Implications

▶ Watch: Concrete actions for practitioners to enhance visibility (31:00)

The defense against agentic malware presents a fundamental challenge, encapsulated by what Hiroaki Toyota terms the "blending problem." From a telemetry perspective, legitimate AI workflows (e.g., CloudCode executing instructions, Ollama performing local inference, PowerShell running scripts) appear structurally identical to malicious agentic scenarios (e.g., agent poisoning files, hijacking local models, running autonomous scripts). Blocking these actions indiscriminately would break legitimate AI workflows, while allowing them enables agentic malware. This dilemma cannot be solved with better IOCs or static signatures; it requires a new paradigm.

To break this dilemma, countermeasures must focus on the "connective tissue" between components rather than individual actions. Toyota proposes three pillars of proactive EDR, structured as a coverage matrix:

1. Sequence Monitoring: This pillar targets the link between orchestration and execution. It involves using Sysmon ID 1 to follow repetitive interpreter-to-PowerShell cycles, specifically looking for LLM latency gaps. These structural patterns, characterized by delays between AI API calls and subsequent process execution, are unfakeable by human operators. The risk here is evasion through deliberate jitter or slowing down the loop by a patient attacker.
2. API-to-Runtime Binding: This addresses the link to the LLM backend. It involves correlating Sysmon ID 3 (network connections) with process trees to flag unauthorized local API calls, such as those made to local LLM ports (e.g., localhost:11434 for Ollama). The challenge lies in the significant operational overhead of maintaining allow-lists in dynamic development environments.
3. Context File Integrity: This focuses on the target access layer—who is modifying AI agent context files. It recommends extending File Integrity Monitoring (FIM) to include AI-related paths like CloudMarkdown. The inherent problem is that FIM can only detect a write event, not evaluate the semantic intent of the payload.

Because these pillars rely on stateful, multi-event correlation, many current SIEM/SOAR solutions may fail. Therefore, AI-driven autonomous alert correlation is deemed absolutely mandatory for effective detection.

Beyond endpoint-specific EDR, Toyota advocates for a broader defense-in-depth architecture to build resilience against agentic malware:

• Perimeter Defense: At the outermost layer, proxying all EDR and API calls through a controlled gateway allows for prompt inspection and rate limiting at the infrastructure level. This can stop autonomous API abuse before it even reaches the host.
• Endpoint Behavior: Moving inwards, establishing behavior baselines for local AI tools (like Ollama or CloudCode) can help flag statistical anomalies in request timing. Additionally, locally dumping prompt content provides critical forensic visibility into what attackers are instructing the AI to do, even if it doesn't prevent the attack.
• Application Context: Treating AI context files as code is crucial. Version control for context files and similar configuration files via Git makes any unauthorized modification instantly traceable. Toyota highly recommends exploring the agent-threat-rules project, which offers an open-source detection standard specifically for this layer.

In summary, the defensive strategy must shift from identifying known malicious artifacts to detecting impossible behavioral patterns by layering defenses across perimeter, endpoint, and application contexts.

Key Takeaways for Practitioners:

1. Inventory AI Tools: Gain full visibility into all AI tools (e.g., Ollama, Stable Diffusion, CloudCode) installed across your environment and on which machines.
2. Audit AI Agent Context Files: Regularly check for unexpected modifications to AI agent context files, such as CloudMarkdown or similar configuration files.
3. Enhance Sysmon Coverage: Ensure AI-related file paths and local API calls are explicitly monitored by Sysmon and other logging mechanisms.
4. Implement Sequence Correlation Rules: Create detection rules that correlate interpreter-to-PowerShell cycles with LLM latency gaps, as this pattern is indicative of agentic malware.
5. Extend FIM to AI Agent Context Paths: Configure File Integrity Monitoring to specifically cover the context files used by AI agents, even if they are not in default monitored paths.
6. Implement Process-to-LLM API Socket Binding: Develop mechanisms to correlate processes with their outgoing API calls, particularly flagging unauthorized or anomalous local API calls to LLM instances.

Ultimately, the core message for practitioners is: "You cannot defend what you cannot see. Start with visibility." This proactive approach is essential to counter the adaptive and evasive nature of agentic malware.

Key Takeaways

• Agentic malware represents a paradigm shift in threats: It operates autonomously, self-modifies, executes in memory, and leverages legitimate AI infrastructure, rendering traditional signature-based and even many behavioral EDRs ineffective.
• Three primary attack vectors exploit AI integration: AI-driven Living off the Land (LOTL) uses external LLMs for dynamic code generation; Living off AI (LOAI) pivots to local LLMs, eliminating egress traffic; and Living off the Agent (LOA) pollutes AI agent context files, allowing the agent to execute malicious code under its own trusted identity.
• Detection requires a new approach focused on "connective tissue" and behavioral patterns: Individual actions of agentic malware often mimic legitimate AI workflows, creating a "blending problem." Effective detection must identify impossible sequences, LLM latency gaps, and anomalous API bindings, rather than relying on isolated IOCs.
• Proactive EDR pillars are essential but must be layered: Sequence monitoring (interpreter-to-PowerShell cycles with LLM latency), API-to-runtime binding (correlating process with local LLM API calls), and context file integrity (FIM for AI agent configuration files) form the core. These need to be augmented by defense-in-depth strategies including perimeter prompt inspection, endpoint behavior baselining, and version control for AI context files.
• Organizations must gain immediate visibility into their AI landscape: This includes inventorying all AI tools, auditing AI agent context files for unauthorized modifications, and enhancing Sysmon and FIM coverage for AI-related paths to establish a baseline for detecting anomalous behavior.

About the Speaker(s)

Hiroaki Toyota is an AI Researcher at LAC Co., Ltd., one of Japan's leading cybersecurity service providers. His professional focus is bifurcated into two critical areas: security automation with agentic AI and offensive AI, which involves adversarial testing across the entire AI pipeline. Toyota openly acknowledges that he is not a malware analysis expert, instead approaching the topic from the unique perspective of an AI researcher exploring the adversarial capabilities of artificial intelligence. This presentation at FIRSTCON marked his first time speaking outside of Japan, a testament to the global relevance and cutting-edge nature of his research into AI-driven threats. His work aims to proactively model agentic malware behaviors and propose defensive strategies before these advanced techniques become widespread.