What AI-generated malware looks like under the microscope

In an interview, Lindsay Kaye, VP of Threat Intelligence at HUMAN Security, explains how analysts spot malicious code that was likely produced with AI assistance — tell-tale signs include overly neat per-function comments, consistent logging formats, and even emojis, though much of this evidence is lost once code is decompiled or obfuscated. She warns that AI is shrinking the window defenders have to patch, citing the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) as an example of how quickly working exploits could follow disclosure. Kaye also describes how criminals now use AI to mass-produce fraudulent apps and phishing content, sift through stolen data, and even verify stolen card numbers via agents, while stressing that her own team never lets AI-generated conclusions go out without human review. She will discuss these themes further at the "Agents Gone Wild" panel at Nullcon Berlin on November 5.