Detecting vibe-coded malware
Loading...
Date
2026-07-10
Authors
Roedig, Utz
Murphy, Seán Óg
Ryan, Ita
Sreenan, Cormac
Journal Title
Journal ISSN
Volume Title
Publisher
Association for Computing Machinery (ACM)
Published Version
Abstract
Malware is currently detected using predominantly static analysis techniques such as rule- and signature-based frameworks. Their effectiveness is largely due to attackers reusing well-known components and toolchains to lower skill requirements, reduce development effort and time to deployment. As a result, malware exhibits recognizable structural patterns that static detectors can reliably identify. The increasing availability of AI-assisted coding tools challenges this assumption by enabling and emboldening attackers to generate malicious software from scratch, producing samples with highly variable code structures but identical malicious intent. In this work, we demonstrate that AI-generated malware permutations can evade static analysis, while their runtime behavior remains largely invariant. We focus our work on malicious shell scripts as a specific class of malware. Such malicious shell scripts are commonly used in attacks against Linux based IoT devices such as routers, cameras, and smart home devices. Our experimental results show that dynamic and behavioral analysis techniques are more robust in this context, highlighting the need to lessen the prevailing dependency on static analysis and instead shift malware detection strategies for systems toward behavior-centric approaches.
Description
Keywords
Malware , Privacy , Security , [ComputerScience]
Citation
Roedig, U, Murphy, S Ó, Ryan, I & Sreenan, C 2026, Detecting vibe-coded malware. in H Franke, M Palesi, R Salvador & E Suarez (eds), Proceedings of the 23rd ACM International Conference on Computing Frontiers 2026 Workshops and Special Sessions, CF 2026 Companion. Proceedings of the 23rd ACM International Conference on Computing Frontiers 2026 Workshops and Special Sessions, CF 2026 Companion, Association for Computing Machinery (ACM), pp. 57-64. https://doi.org/10.1145/3801488.3807898