In the wild
PROMPTFLUX: VBScript dropper that calls the Gemini API to rewrite its own source for evasion
AIR-2025-0169 AIR record · 2025-11-gtig-promptflux
From the supporting source
Our intelligence also indicates this activity is in a development or testing phase, as opposed to being used in the wild, and currently does not have the ability to compromise a victim network or device.cloud.google.com
The record
Disclosed
2025-11-05
Occurred
2025
Vendor
Google
Product
Google Gemini API
Risk domain
Governance › Policy drift
System type
Generative model
Who acted
Agent acted (contested) — the dropper calls Gemini and applies the rewritten source itself
Attack surface
Other
Autonomy level
Semi-autonomous
Initial vector
Dropper with decoy installer
Impact type
Evasion
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Unattributed, financially motivated; assessed to be in development/testing
Capability abused
Defense & remediation
Recorded defense
Gemini API abuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
Google disabled the associated assets and hardened the model against the misuse pattern
Taxonomy & references
Curator notes
Heavily over-reported in trade press as 'AI malware that rewrites itself hourly'. Google's own text says the self-modification function AttemptToUpdateSelf is commented out and the family cannot compromise a device. impact_realized deliberately false. Kept because the intent and the AI-response logging to %TEMP%\thinking_robot_log.txt are real artefacts.
Supporting sources
Cite as
Enkrypt AI. "PROMPTFLUX: VBScript dropper that calls the Gemini API to rewrite its own source for evasion". AIR, AIR-2025-0169. https://agentincident.vercel.app/i/AIR-2025-0169/ (accessed 2026-10-19).