In the wild
Realized harm
HONESTCUE: fileless downloader that asks Gemini for C# payload source and compiles it in memory
AIR-2026-0041 AIR record · 2026-02-gtig-honestcue
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Write a complete, self-contained C# program with a public class named 'Stage2'...This method must use 'System.Net.WebClient' to download the contents of the URL...execute the entry point of the newly loaded assembly. The program must not write any files to disk...cloud.google.com
The record
Disclosed
2026-02-13
Vendor
Google
Product
Google Gemini API
Risk domain
Governance › Policy drift
System type
Generative model
Who acted
Agent acted (contested) — the downloader compiles and runs the C# the model returns
Attack surface
Other
Autonomy level
Semi-autonomous
Initial vector
Downloader framework
Impact type
Malware execution, Evasion
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Unspecified
Capability abused
Defense & remediation
Recorded defense
Gemini API abuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
Google disabled associated assets
Taxonomy & references
Curator notes
The successor generation to PROMPTFLUX: instead of rewriting itself, the malware outsources second-stage generation to the model so no payload ever touches disk. GTIG lists it among families observed rather than experimental, but gives no victim count.
Supporting sources
Cite as
Enkrypt AI. "HONESTCUE: fileless downloader that asks Gemini for C# payload source and compiles it in memory". AIR, AIR-2026-0041. https://agentincident.vercel.app/i/AIR-2026-0041/ (accessed 2026-10-19).