A recent Dark Reading threat intelligence analysis cuts through two years of breathless vendor marketing: generative AI has not produced the predicted wave of hyper-sophisticated cyberattacks. Instead, the criminal ecosystem is being flooded with what researchers bluntly call "AI slop" — grammatically hollow phishing lures, vibe-coded malware riddled with bugs, hallucinated infrastructure references, and copy-paste attack playbooks that fall apart under even cursory analysis. The serious operators — ransomware affiliates, initial access brokers, and nation-state intrusion sets — are barely touching LLMs for core tradecraft, because their existing tooling works better.
For defenders, this is genuinely good news, but only if you act on it. The AI slop wave still generates volume: thousands of mediocre phishing campaigns and half-functional malware droppers that occasionally land a victim through sheer numbers. Every one of these low-effort attacks carries detectable artifacts that a competent SOC can catch cheaply — if detections are tuned for the actual patterns rather than the Hollywood version of AI-powered attack. This post breaks down what the AI slop ecosystem looks like in practice, the observables it produces, and the specific detections and hardening steps your team should deploy now.
Technical Analysis
What the reporting actually shows
The Dark Reading piece, drawing on threat intelligence observations across 2025 and into 2026, documents several consistent patterns in AI-assisted low-tier cybercrime:
- Phishing quality has plateaued or declined. LLM-generated lures are fluent but generic — overly polished, context-free, and stripped of the insider detail that makes targeted spear phishing work. They rely on the same delivery vehicles as always: HTML attachments, QR codes, fake voicemail and document-share notifications, and links to adversary-in-the-middle (AiTM) credential phishing kits.
- Vibe-coded malware is functionally broken at scale. Lower-tier actors are prompting LLMs to generate stealers, loaders, and ransomware, producing code with hallucinated API calls, non-existent registry keys, embedded comments in the LLM's characteristic verbose style, hardcoded placeholder strings, and — critically — a growing subset that calls out to public LLM APIs at runtime to generate or mutate payloads, exfiltrate data, or make decisions. Samples observed in the wild (such as the PromptLock proof-of-concept lineage and its criminal imitators) make direct HTTPS requests to services like
api.openai.comandapi.anthropic.comfrom compromised endpoints. - Hallucinated IOCs pollute both attacks and defenses. Slop-generated phishing kits reference domains and URLs that were never registered. Slop-adjacent "threat intel" content does the same, which means defenders must validate indicators before blocking on them.
- Sophisticated actors are abstaining. Mature ransomware operations and APT groups continue to use proven, hand-maintained tooling. AI usage among top-tier actors is largely confined to reconnaissance summarization and translation — not payload generation.
Affected products, versions, and platforms
This is not a vulnerability advisory; no CVE is associated with this reporting, and none is cited in the source material. The exposure surface is organizational rather than product-specific:
- Email platforms (Microsoft 365, Google Workspace, on-prem Exchange) receiving high volumes of AI-generated phishing with HTML attachments and QR-code lures.
- Windows endpoints executing vibe-coded scripts and binaries — frequently PowerShell, Python bundled via PyInstaller, or commodity .NET loaders with LLM stylistic fingerprints.
- Any endpoint with outbound internet access that could run malware which depends on public LLM APIs at runtime.
Attack chain (defender's view)
The dominant AI-slop intrusion path observed today looks like this:
- LLM-generated phishing email arrives with an HTML attachment, QR code, or "shared document" lure.
- User opens the attachment in a browser; an AiTM kit (or slop-built clone of one) proxies the real Microsoft 365/Google login and harvests session tokens.
- If malware is involved, a loader or script is dropped — frequently into
%TEMP%,%APPDATA%, or the user's Downloads folder — often with telltale LLM artifacts: dense explanatory comments, generic variable naming, or embedded prompts. - A subset of these payloads make outbound TLS connections to public LLM API endpoints (
api.openai.com,api.anthropic.com,generativelanguage.googleapis.com) from non-browser processes — an extremely high-fidelity signal, because legitimate business software rarely does this from end-user workstations.
Exploitation status
There is no single exploit to track. This is an active, ongoing criminal ecosystem trend confirmed in current threat intelligence reporting. The practical implication: your detection backlog should prioritize the cheap, high-fidelity signals these low-quality attacks emit, rather than hypothetical "AI super-malware" scenarios.
Detection & Response
The core detection philosophy here: AI slop attacks are noisier and more patterned than human-built ones. Three detection opportunities stand out as high-fidelity and low-noise:
- Email clients launching browsers against local HTML files — the dominant AI-slop phishing delivery mechanism.
- Non-browser processes connecting to public LLM APIs — the signature of LLM-dependent malware. In most enterprises, the only processes that should ever touch
api.openai.comare a short allowlist of approved developer tools. - Scripts with embedded LLM prompt artifacts — vibe-coded payloads frequently contain literal prompt text or telltale instructional comments.
Sigma Rules
YAML
---
title: Email Client Launched Browser With Local HTML Attachment
tid: 3f7a2c91-8b4e-4d1a-9c6f-2e8a5b7d9031
status: experimental
description: Detects email clients (Outlook, Thunderbird) spawning a browser process pointing at a local HTML file, a dominant delivery pattern for AI-generated phishing lures using HTML attachments that render credential harvesting pages or redirect to AiTM kits.
references:
- https://www.darkreading.com/threat-intelligence/ai-slop-ruining-cyberattacks
- https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\outlook.exe'
- '\thunderbird.exe'
selection_browser:
Image|endswith:
- '\msedge.exe'
- '\chrome.exe'
- '\firefox.exe'
- '\iexplore.exe'
selection_html:
CommandLine|contains:
- '.htm'
selection_path:
CommandLine|contains:
- '\Temp\'
- '\Temporary Internet Files\'
- '\INetCache\'
- '\Downloads\'
condition: selection_parent and selection_browser and selection_html and selection_path
falsepositives:
- Rare legitimate HTML reports or newsletters opened from email
level: high
---
title: Non-Browser Process Connection to Public LLM API
tid: 8d4e1b62-5c7f-4a39-b2e8-6f1a9d3c7042
status: experimental
description: Detects processes other than approved browsers or developer tools establishing network connections to public LLM API endpoints (OpenAI, Anthropic, Google Gemini). LLM-dependent malware generated via vibe-coding increasingly calls these APIs at runtime for payload generation, decision-making, or exfiltration. Legitimate workstation software almost never initiates these connections.
references:
- https://www.darkreading.com/threat-intelligence/ai-slop-ruining-cyberattacks
- https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1102
logsource:
category: network_connection
product: windows
detection:
selection_dest:
DestinationHostname|contains:
- 'api.openai.com'
- 'api.anthropic.com'
- 'generativelanguage.googleapis.com'
- 'api.cohere.ai'
- 'api.mistral.ai'
filter_browsers:
Image|endswith:
- '\msedge.exe'
- '\chrome.exe'
- '\firefox.exe'
- '\brave.exe'
filter_approved_dev:
Image|endswith:
- '\code.exe'
- '\cursor.exe'
- '\node.exe'
condition: selection_dest and not 1 of filter_*
falsepositives:
- Approved internal AI tooling (tune the approved-dev filter to your environment)
- Developer workstations using CLI AI assistants
level: high
---
title: Script File Containing Embedded LLM Prompt Artifacts
tid: 5b9c3e47-2a6d-4f81-8e3c-1b7a4d9f2053
status: experimental
description: Detects PowerShell or batch script execution where the command line contains literal LLM prompt-instruction artifacts. Vibe-coded malware frequently retains fragments of the prompts used to generate it, or instructional comments characteristic of LLM output, in the delivered script body.
references:
- https://www.darkreading.com/threat-intelligence/ai-slop-ruining-cyberattacks
- https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
selection_prompt:
CommandLine|contains:
- 'as an ai language model'
- 'you are a helpful assistant'
- 'ignore previous instructions'
- 'here is the code you requested'
- '```powershell'
condition: selection_img and selection_prompt
falsepositives:
- Security research and prompt-injection testing
- Administrators experimenting with AI-generated scripts (itself worth reviewing)
level: medium
KQL — Microsoft Sentinel / Defender
This query hunts two of the highest-fidelity AI-slop signals in a single pane: browsers launched from email clients against local HTML files, and non-browser processes beaconing to public LLM APIs. It assumes Defender for Endpoint tables; if you ingest firewall/proxy logs as CommonSecurityLog, the LLM-API section adapts directly to DestinationHostName matching.
KQL — Microsoft Sentinel / Defender
let LlmApiHosts = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "api.cohere.ai", "api.mistral.ai"]);
let ApprovedBrowsers = dynamic(["msedge.exe", "chrome.exe", "firefox.exe", "brave.exe"]);
let ApprovedDevTools = dynamic(["code.exe", "cursor.exe", "node.exe", "WindowsTerminal.exe"]);
let HtmlPhish =
DeviceProcessEvents
```kql
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("outlook.exe", "thunderbird.exe")
| where FileName in~ ("msedge.exe", "chrome.exe", "firefox.exe", "iexplore.exe")
| where ProcessCommandLine has_any (".htm")
| where ProcessCommandLine has_any ("\\Temp\\", "Temporary Internet Files", "INetCache", "\\Downloads\\")
| project TimeGenerated, DeviceName, AccountName, Signal = "EmailClient-Browser-LocalHTML", FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId;
let LlmBeacon = DeviceNetworkEvents
KQL — Microsoft Sentinel / Defender
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (LlmApiHosts)
| where not(InitiatingProcessFileName in~ (ApprovedBrowsers))
| where not(InitiatingProcessFileName in~ (ApprovedDevTools))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName = InitiatingProcessAccountName, Signal = "NonBrowser-LLM-API-Connection", FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessFileName = RemoteUrl, ReportId;
union HtmlPhish, LlmBeacon
KQL — Microsoft Sentinel / Defender
| sort by TimeGenerated desc
Code
Tune the `ApprovedDevTools` list to your actual AI tooling inventory — if your organization has sanctioned Copilot CLI or internal LLM integrations, allowlist their process names explicitly rather than broad paths. The non-browser LLM-API signal should be close to zero in a typical enterprise; every hit deserves analyst eyes.
### Velociraptor VQL
For IR scoping on a suspected AI-slop compromise, this artifact combines process inspection for LLM-style command-line artifacts with live network connections to LLM API endpoints, plus a sweep for recently created HTML files in user-writable staging directories (a common phishing attachment artifact).
```vql
-- Hunt: AI-slop indicators - LLM API beacons, prompt artifacts in scripts, staged HTML phishing files
LET proc_hits = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(as an ai language model|you are a helpful assistant|ignore previous instructions|here is the code you requested)'
OR Name =~ '(?i)(powershell|pwsh|cmd|wscript|cscript|mshta)'
AND CommandLine =~ '(?i)(appdata|temp|downloads)'
LET net_hits = SELECT Pid, Name, Path, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
AND NOT Name =~ '(?i)(msedge|chrome|firefox|brave)'
LET html_staging = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/Downloads/*.htm*', 'C:/Users/*/AppData/Local/Temp/*.htm*'])
WHERE Mtime > now() - 604800
```sql
SELECT 'process_artifact' AS Signal, format(format='%v', args=proc_hits) AS Detail FROM scope()
WHERE proc_hits
Code
In practice, run `proc_hits` and `html_staging` as separate artifacts in a multi-client hunt across the estate, and pair `net_hits` with a DNS-resolution enrichment notebook to flag remote addresses resolving to LLM provider infrastructure. The HTML staging glob catches the attachment residue even after the phishing page is closed — useful for confirming which user clicked during scoping.
### Remediation & Hardening Script
This PowerShell script (run elevated on Windows endpoints or via your RMM/Intune) audits and hardens against the two most actionable AI-slop vectors: it inventories current outbound connections and recent DNS cache entries for LLM API endpoints (evidence of LLM-dependent malware), optionally creates egress firewall blocks for those domains on non-approved devices, and verifies that Office is configured to block untrusted HTML attachment behaviors via Protected View.
```powershell
# Security Arsenal - AI-Slop Defense Audit & Hardening
# Run elevated. Use -Enforce to apply blocks; default is audit-only.
param([switch]$Enforce)
$llmDomains = @('api.openai.com','api.anthropic.com','generativelanguage.googleapis.com','api.cohere.ai','api.mistral.ai')
$report = @()
# 1. Check active TCP connections whose remote host resolves to LLM API infrastructure
foreach ($d in $llmDomains) {
try {
$ips = (Resolve-DnsName -Name $d -Type A -ErrorAction Stop).IPAddress
foreach ($ip in $ips) {
$conns = Get-NetTCPConnection -State Established -RemoteAddress $ip -ErrorAction SilentlyContinue
foreach ($c in $conns) {
$proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
$report += [pscustomobject]@{
Finding = 'ACTIVE_LLM_API_CONNECTION'; Domain = $d; RemoteIP = $ip
Process = $proc.ProcessName; Path = $proc.Path; PID = $c.OwningProcess
}
}
}
} catch {}
}
# 2. Sweep DNS client cache for LLM API lookups (evidence of prior beacons)
$cache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $e = $_.Entry; $llmDomains | Where-Object { $e -like "*$_*" } }
foreach ($entry in $cache) {
$report += [pscustomobject]@{ Finding='DNS_CACHE_LLM_LOOKUP'; Domain=$entry.Entry; RemoteIP=$entry.Data; Process=''; Path=''; PID='' }
}
# 3. Verify Office Protected View for files originating from the internet (phishing HTML/docs)
$pvPaths = @('HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView',
'HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView')
foreach ($p in $pvPaths) {
if (Test-Path $p) {
$v = (Get-ItemProperty -Path $p -Name DisableInternetFilesInPV -ErrorAction SilentlyContinue).DisableInternetFilesInPV
if ($v -eq 1) { $report += [pscustomobject]@{ Finding='PROTECTED_VIEW_WEAKENED'; Domain=$p; RemoteIP=''; Process=''; Path=''; PID='' } }
}
}
# 4. Optional: egress-block LLM API domains at the host firewall (for endpoints with no sanctioned AI use)
if ($Enforce) {
foreach ($d in $llmDomains) {
try {
$ips = (Resolve-DnsName -Name $d -Type A -ErrorAction Stop).IPAddress
foreach ($ip in $ips) {
```powershell
New-NetFirewallRule -DisplayName "SA-Block-LLM-API-$d-$ip" -Direction Outbound -Action Block -RemoteAddress $ip -ErrorAction SilentlyContinue | Out-Null
Code
}
} catch {}
}
$report += [pscustomobject]@{ Finding='EGRESS_BLOCKS_APPLIED'; Domain=($llmDomains -join ','); RemoteIP=''; Process=''; Path=''; PID='' }
}
$report | Format-Table -AutoSize if ($report) { $report | Export-Csv -Path "$env:ProgramData\SA-AISlop-Audit.csv" -NoTypeInformation }
Code
Any `ACTIVE_LLM_API_CONNECTION` finding from a non-browser process on a standard user endpoint should be treated as a probable compromise: isolate the host, capture memory, and scope for the loader that initiated it. Note that firewall blocks keyed to resolved IPs are a stopgap — providers rotate addresses — so pair host blocks with DNS-layer filtering (next section) for durable control.
## Remediation
Because no CVE is involved, remediation is architectural: close the cheap opportunities AI-slop attacks depend on, and exploit their low quality against them.
1. **Control egress to LLM APIs.** Most organizations have no business need for general workstation access to `api.openai.com`, `api.anthropic.com`, or similar endpoints. Enforce a DNS- or proxy-layer category block, allowlisting only approved developer subnets and service accounts. This single control neuters the entire class of LLM-dependent vibe-coded malware and gives you a near-zero-noise detection signal.
2. **Strip or sandbox HTML attachments.** Configure your secure email gateway (Defender for Office 365, Proofpoint, Mimecast, or equivalent) to quarantine or detonate HTML/HTM/SHTML attachments from external senders, and alert on first-time sender + HTML attachment combinations. For M365 specifically, validate that Safe Attachments detonation and Safe Links URL rewriting are enabled for all users, and review anti-phishing policy impersonation settings in the Microsoft 365 Defender portal (https://security.microsoft.com/antiphishing).
3. **Kill the QR-code blind spot.** AI-slop campaigns lean heavily on QR lures to move victims onto unmanaged personal devices. Ensure your email security stack extracts and detonates URLs embedded in QR images, and push conditional access policies (compliant-device requirements, token protection where licensed) so a phished session token alone is insufficient.
4. **Enforce phishing-resistant MFA on high-value accounts.** FIDO2/passkeys and certificate-based authentication defeat AiTM session-token theft outright. Prioritize admins, finance, and executives — the slop campaigns target breadth, but credential replay lands where MFA is weakest.
5. **Validate indicators before operationalizing them.** The same LLM slop ecosystem polluting attacks is polluting threat feeds with hallucinated domains and file hashes. Require source corroboration before pushing IOCs to blocklists, or you'll burn analyst time chasing artifacts that never existed.
6. **Refocus threat models on observed TTPs.** Update tabletop scenarios and detection content away from speculative "AI super-attack" narratives and toward what is actually arriving: high-volume, low-quality phishing, AiTM kits, and buggy commodity malware. Map coverage against MITRE ATT&CK T1566.001/002, T1557 (AiTM), and T1102 (web service C2) and close the gaps.
7. **Measure, don't assume.** Track click rate, report rate, and time-to-triage on AI-pattern phishing simulations. The quality gap in slop attacks only helps you if your users and SOC can actually see it.
There are no vendor patches or CISA KEV deadlines tied to this reporting; the defensive work is configuration, egress control, and detection tuning — all achievable this quarter with existing tooling.
## Conclusion
The AI-slop era is a rare gift to defenders: adversaries adopting immature tooling that emits loud, patterned, easily detected signals. The organizations that benefit are the ones that stop bracing for hypothetical AI super-weapons and start instrumenting for the reality — HTML attachment lures, AiTM credential theft, and malware that literally phones home to `api.openai.com`. Deploy the detections above, lock down LLM API egress, tighten email attachment handling, and let the attackers' quality problem become your detection advantage.
## Related Resources
[Security Arsenal Managed SOC Services](https://securityarsenal.com/services/mdr)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[soc-mdr Intel Hub](https://securityarsenal.com/intel/mdr)
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.