Good Vibes, Shady Scripts :: Vow to Protect, Woe to Detect
Vibe-coding is turning false positives from a manageable inconvenience into a systemic security vulnerability. Unlike conventional false positives that can often be addressed through application allow-listing or targeted exclusions, AI-generated artifacts may be short-lived and non-repetitive: a new prompt can produce a different implementation, invoke another LOLBin, or exhibit an alternate behavioural sequence.
Generative AI is being rapidly adopted across both adversarial and enterprise workflows, powering everything from malware loaders and phishing infrastructure to operational automation and software delivery. The “why” is simple: AI-generated code readily incorporates legitimate LOLBAS and GTFOBins (read PowerShell, Certutil, BITSAdmin, etc.) because they are among the best-documented and most efficient paths to common sysadmin tasks.
This presents a growing challenge to modern detection mechanisms. Behavioural heuristics rely on various characteristics like patterns of scripting activity, process ancestry, or command execution sequences rather than explicit malicious intent, as that may not be obvious until it’s too late.
The recent rise of vibe-coding is accelerating the proliferation of AI-authored scripts across enterprise environments, and AI-assisted benign code instances increasingly exhibit behavioural patterns similar to those used by malicious actors. The boundaries between the two are blurring steadily, setting the stage for higher false-positive rates, increased alert fatigue, and reduced confidence in detection fidelity. As AI adoption expands on both sides of the security perimeter, this problem is likely to worsen, eroding the effectiveness of conventional rule-based and behaviour-centric detection strategies.
In this talk, we examine the emerging collision between malicious AI-enabled behaviour and legitimate AI-enabled operations, exploring why traditional detection methodologies are becoming more error-prone. We shall discuss whether the granularity of existing OS instrumentation data is sufficient to differentiate malicious intent from legitimate automation. We conclude by evaluating practical mitigation strategies – including policy-aware detections, behavioural baselining (IOB/UEBA), and multi-signal correlation – to help security research teams adapt before AI-generated malware patterns become indistinguishable from everyday enterprise operations.
Kaarthik R. Muthukrishnan – K7 Computing
Kaarthik R. Muthukrishnan is a Senior Threat Researcher at K7 Labs, with extensive experience in cybersecurity. He holds a Master’s degree in Computer Applications and began his threat research career in 2008. Since joining K7 Labs in 2010, he has focused on malware research, analysis, and emerging cyber threats.
Kaarthik has authored and co-authored research papers presented at leading industry conferences like Virus Bulletin and AVAR, and has contributed extensively to the K7 Labs’ blog. His professional interests span threat research, malware analysis, and cybersecurity trends.
Outside of work, he enjoys photography and exploring new perspectives through the lens.