{"schema_version":"0.10.0","id":"LR-2026-0424","record_version":1,"title":"AI-generated malware used to exploit React2Shell vulnerability","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"f32335716835cea79d0c4985a2feb8c0be17937b4d60d6db2b5c20cabd20f521"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-10","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Darktrace observed an intrusion on its CloudyPots honeypot network in which the malware was fully generated by an AI model and exploited the React2Shell vulnerability, CVE-2025-55182. The attacker started a container on a Docker honeypot that intentionally exposed its daemon without authentication, and the container downloaded and ran a Python script. The script was an exploitation toolkit designed to gain remote code execution and deploy a Monero cryptocurrency miner. The report states that the sample infected 91 hosts. The report suggests the attacker likely jailbroke an AI model by framing the request as educational, although AI safeguards would normally refuse to generate malware. Darktrace presents the case as evidence that AI lowers barriers to cybercrime and recommends rapid patching, attack-surface monitoring and behavioural detection.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test met: a stated count of two or more affected parties (91 infected hosts).","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.darktrace.com/blog/ai-llm-generated-malware-used-to-exploit-react2shell","publisher":"Darktrace","date":"2026-02-10","type":"press","title":"AI/LLM-Generated Malware Used to Exploit React2Shell - Darktrace","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A single prompting session with a model was sufficient for this attacker to generate a functioning exploit framework and compromise more than ninety hosts, demonstrating that the operational value of AI for adversaries should not be underestimated."}],"impact.severity":[{"source_index":0,"quote":"The worker count is 91, meaning that 91 hosts have been infected by this sample."}],"impact.severity_because":[{"source_index":0,"quote":"The worker count is 91, meaning that 91 hosts have been infected by this sample."}],"event.summary":[{"source_index":0,"quote":"A recently observed intrusion against Darktrace’s Cloudypots environment revealed a fully AI‑generated malware sample exploiting CVE-2025-55182, also known as React2Shell."},{"source_index":0,"quote":"The intrusion was observed against the Darktrace Docker honeypot, which intentionally exposes the Docker daemon internet-facing with no authentication."},{"source_index":0,"quote":"The attacker was observed spawning a container named “python-metrics-collector”, configured with a start up command that first installed prerequisite tools including curl, wget, and python 3."},{"source_index":0,"quote":"Finally it will download and run a python script from:"},{"source_index":0,"quote":"The script is a well constructed React2Shell exploitation toolkit, which aims to gain remote code execution and deploy a XMRig (Monero) crypto miner."},{"source_index":0,"quote":"The worker count is 91, meaning that 91 hosts have been infected by this sample."},{"source_index":0,"quote":"The presence of the phrase “Educational/Research Purpose Only” additionally suggests that the attacker likely jailbroke an AI model by framing the malicious request as educational."},{"source_index":0,"quote":"Further, AI will refuse to generate malware as part of its safeguards."},{"source_index":0,"quote":"While the amount of money generated by the attacker in this case is relatively low, and cryptomining is far from a new technique, this campaign is proof that AI based LLMs have made cybercrime more accessible than ever."}]},"notes_on_gaps":"Single press source (Darktrace blog); no government or implicated-party report. Publication date 2026-02-10 appears only in the source header, not in the body, so date_disclosed is left out. No date of occurrence, date of detection, duration or time to contain is stated. No model name, version or developer is stated for the AI that generated the malware. The source does not say an autonomous agent acted, so agent_involved and failure_class are left out. Attacker location (an Indian residential ISP IP) is explicitly unconfirmed attribution and is not recorded. Trigger is left out because the jailbreak is only stated as likely. Adversarial actor is left out because the source does not state whether the attacker was external. Root cause is left out: the unauthenticated Docker daemon was an intentional honeypot design, not a victim failure. Detection method is not stated. Monetary values were given in GBP and were not converted or recorded. Severity major is my judgement under the stated-count test (91 infected hosts). The D1 link (got_around) rests on the source's hedged word likely. The advice controls (J1, F2, J8) map the source's general recommendations and are not reported as changes made by any party. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The report says the exploit framework was generated in a single prompting session and used to compromise more than ninety hosts.","quote":"A single prompting session with a model was sufficient for this attacker to generate a functioning exploit framework and compromise more than ninety hosts, demonstrating that the operational value of AI for adversaries should not be underestimated.","source_index":0,"grade":"C"},{"step":"reached","text":"The worker count reported by the source indicates 91 hosts were infected by the sample.","quote":"The worker count is 91, meaning that 91 hosts have been infected by this sample.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.darktrace.com/blog/ai-llm-generated-malware-used-to-exploit-react2shell"]}}