{"schema_version":"0.10.0","id":"LR-2026-0377","record_version":1,"title":"VoidLink Linux malware framework built with AI assistance","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":55.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.24,"unhedged_language":4.38},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Check Point Research research","original_document":{"url":"https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/","organisation":"Check Point Research","role":"researcher"},"reports_total":3,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Check Point Research research"}]},"sources_hash":"1117fa986b74a389151575122fa0e66a7cc901f4c8f97bb010382d9fd030c8ca"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"TRAE SOLO","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-01-20","incident_class":"other","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A single individual reportedly used the TRAE SOLO AI coding environment to have an AI model plan and write VoidLink, a Linux malware framework written in Zig. The developer's documentation was repurposed as an execution blueprint, and the model implemented the code sprint by sprint. Operational security mistakes by the developer exposed project files and planning materials, which Check Point Research used to trace the development. Check Point reported that the framework reached a first functional implant in under a week, and that the code base grew to roughly 88,000 lines within about a week of the project start. The sources state that no real-world infections had been observed at the time of reporting. The sources do not describe any change made afterwards to the tools or the developer's practices.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/","publisher":"Check Point Research","date":"2026-01-20","type":"press","title":"VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun - Check Point Research","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.calcalistech.com/ctechnews/article/rjmg00jpszl","publisher":"CTech","date":"2026-01-20","type":"press","title":"“The long-awaited era of sophisticated AI-generated malware has likely begun” - CTech","archived_url":null},{"url":"https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html","publisher":"The Hacker News","date":"2026-01-21","type":"press","title":"VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code - The Hacker News","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.harness":"C","event.agent_involved":"C","event.incident_class":"D","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":2,"quote":"It's believed that the threat actor commenced work on the VoidLink in late November 2025, leveraging a coding agent known as TRAE SOLO to carry out the tasks."}],"event.agent_involved":[{"source_index":0,"quote":"That documentation was then repurposed as the execution blueprint, which the model likely followed to implement, iterate, and test the malware end-to-end."}],"event.incident_class":[{"source_index":0,"quote":"VoidLink stands as the first evidently documented case of this era, as a truly advanced malware framework authored almost entirely by artificial intelligence, likely under the direction of a single individual."}],"impact.severity":[{"source_index":2,"quote":"No real-world infections have been observed to date."}],"event.summary":[{"source_index":2,"quote":"The documentation is said to have been repurposed as an execution blueprint for the LLM to follow, build, and test the malware."},{"source_index":0,"quote":"Operational security (OPSEC) failures by the VoidLink developer exposed development artifacts."},{"source_index":1,"quote":"However, because the model effectively executed the project itself, it was able to complete the roughly 88,000 lines of code required within about a week from the start of the project."},{"source_index":2,"quote":"No real-world infections have been observed to date."}]},"notes_on_gaps":"The sources do not name the underlying AI model or its version, nor the developer of TRAE. No date of detection, trigger, root cause, direct loss, records, or affected parties is stated. No remediation was reported. Judgements: incident_class set to other because no attack or compromise occurred, only malware development; agent_involved set to true because the coding agent implemented the code; severity set to negligible because no real-world infections were observed; event.trigger, failure_class and controls were omitted because the sources do not state a cause or a control that held, failed or was bypassed; the jailbreak strategy is described only as unclear. Check Point's claims about artifacts and the Sysdig analysis are reported as stated and not independently verified. Autonomy level and deployment context are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Check Point Research research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A developer used an AI model to plan and implement the malware from a multi-team specification.","quote":"That documentation was then repurposed as the execution blueprint, which the model likely followed to implement, iterate, and test the malware end-to-end.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The developer's operational security failures exposed development artifacts.","quote":"Operational security (OPSEC) failures by the VoidLink developer exposed development artifacts.","source_index":0,"grade":"C"},{"step":"reached","text":"Check Point said the framework reached a first functional implant in under a week.","quote":"These materials provide clear evidence that the malware was produced predominantly through AI-driven development, reaching a first functional implant in under a week.","source_index":0,"grade":"C"},{"step":"caught","text":"Check Point researchers tracked the development through files exposed by the developer's mistake.","quote":"A mistake by the developer exposed supporting files and explanatory materials generated by the environment, enabling Check Point researchers to track its development and capabilities.","source_index":1,"grade":"C"},{"step":"done","text":"No real-world infections had been observed as of the reporting.","quote":"No real-world infections have been observed to date.","source_index":2,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/","https://www.calcalistech.com/ctechnews/article/rjmg00jpszl","https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html"]},"analysis":{"sections":{"timeline":[{"text":"Development believed to have begun, using TRAE SOLO.","quote":"It's believed that the threat actor commenced work on the VoidLink in late November 2025, leveraging a coding agent known as TRAE SOLO to carry out the tasks.","source_index":2,"when":"late November 2025"},{"text":"Earliest planning document with the development plan created.","quote":"One such document detailing the development plan was created on November 27, 2025.","source_index":2,"when":"November 27, 2025"},{"text":"Test artifact shows VoidLink functional with more than 88,000 lines of code.","quote":"One recovered test artifact, timestamped to December 4, a mere week after the project began, indicates that by that date, VoidLink was already functional and had grown to more than 88,000 lines of code.","source_index":0,"when":"December 4"},{"text":"No real-world infections observed as of the reporting.","quote":"No real-world infections have been observed to date.","source_index":2,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/","https://www.calcalistech.com/ctechnews/article/rjmg00jpszl","https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html"]}}