{
 "public_id": "AIR-2026-0041",
 "incident_id": "2026-02-gtig-honestcue",
 "date_disclosed": "2026-02-13",
 "date_occurred": null,
 "title": "HONESTCUE: fileless downloader that asks Gemini for C# payload source and compiles it in memory",
 "class": "in_the_wild",
 "attack_surface": "other",
 "initial_vector": "downloader_framework",
 "agent_capability_abused": [
  "runtime_llm_code_generation",
  "model_api_abuse",
  "in_memory_compilation"
 ],
 "target_product": "Google Gemini API",
 "target_vendor": "Google",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "malware_execution",
  "evasion"
 ],
 "blast_radius": "Unspecified",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "llm_in_malware",
   "fileless",
   "just_in_time_payload"
  ]
 },
 "defense_present": "Gemini API abuse detection",
 "defense_bypassed": true,
 "fix_shipped": "Google disabled associated assets",
 "primary_sources": [
  "https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use"
 ],
 "verified_quote": "Write a complete, self-contained C# program with a public class named 'Stage2'...This method must use 'System.Net.WebClient' to download the contents of the URL...execute the entry point of the newly loaded assembly. The program must not write any files to disk...",
 "confidence": "high",
 "notes": "The successor generation to PROMPTFLUX: instead of rewriting itself, the malware outsources second-stage generation to the model so no payload ever touches disk. GTIG lists it among families observed rather than experimental, but gives no victim count.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Unclassified",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the downloader compiles and runs the C# the model returns",
 "vector_family": "other",
 "vector_detail": "downloader_framework",
 "guardrail_kind": [
  "abuse_detection"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "policy_drift",
 "eai_domain": "governance",
 "eai_secondary": [],
 "eai_reason": "impact rule: policy_drift",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}