AI Risk Wire

Cases › other › LR-2026-0377

VoidLink Linux malware framework built with AI assistance

Confirmed Why: Check Point Research research · Check Point Research · 2 independent reports

Status: action reported, no fix

Severity negligible
Reported 20 Jan 2026
Agent tool TRAE SOLO

No source states: loss or records, developer and model, could do, deployer, industry.

A single individual reportedly used the TRAE SOLO AI coding environment to have an AI model plan and write VoidLink, a Linux malware framework written in Zig. The developer's documentation was repurposed as an execution blueprint, and the model implemented the code sprint by sprint. Operational security mistakes by the developer exposed project files and planning materials, which Check Point Research used to trace the development. Check Point reported that the framework reached a first functional implant in under a week, and that the code base grew to roughly 88,000 lines within about a week of the project start. The sources state that no real-world infections had been observed at the time of reporting. The sources do not describe any change made afterwards to the tools or the developer's practices.

What happened

1 · What it was doingA developer used an AI model to plan and implement the malware from a multi-team specification.
2 · What went wrongThe developer's operational security failures exposed development artifacts.
3 · What it reached or didCheck Point said the framework reached a first functional implant in under a week.
4 · How it was caughtCheck Point researchers tracked the development through files exposed by the developer's mistake.

What was done

No real-world infections had been observed as of the reporting.

Risks

Not yet sorted into a risk

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 4 items from the primary sources

What happened, in order

  1. late November 2025 Development believed to have begun, using TRAE SOLO.
  2. November 27, 2025 Earliest planning document with the development plan created.
  3. December 4 Test artifact shows VoidLink functional with more than 88,000 lines of code.

Not dated in the sources:

  • No real-world infections observed as of the reporting.
Show every field, with its source and grade

The AI system

Software around the model
TRAE SOLO
C one secondary source states it

What happened

Earliest source we hold
2026-01-20
D inferred by us from the described behaviour, reason shown
What went wrong
other
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it

Impact

Severity
negligible
D inferred by us from the described behaviour, reason shown

Notes on gaps

No remediation was reported. Check Point's claims about artifacts and the Sysdig analysis are reported as stated and not independently verified.

LR-2026-0377 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON