Cases › security breach › LR-2026-0424

AI-generated malware used to exploit React2Shell vulnerability

Preliminary Why: Publisher not yet named · subject to change

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major

Reported 10 Feb 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: test met: a stated count of two or more affected parties (91 infected hosts).

Darktrace observed an intrusion on its CloudyPots honeypot network in which the malware was fully generated by an AI model and exploited the React2Shell vulnerability, CVE-2025-55182. The attacker started a container on a Docker honeypot that intentionally exposed its daemon without authentication, and the container downloaded and ran a Python script. The script was an exploitation toolkit designed to gain remote code execution and deploy a Monero cryptocurrency miner. The source states that the sample infected 91 hosts. The source suggests the attacker likely jailbroke an AI model by framing the request as educational, although AI safeguards would normally refuse to generate malware. Darktrace presents the case as evidence that AI lowers barriers to cybercrime and recommends rapid patching, attack-surface monitoring and behavioural detection.

What happened

1 · What went wrongThe source says the exploit framework was generated in a single prompting session and used to compromise more than ninety hosts.

2 · What it reached or didThe worker count reported by the source indicates 91 hosts were infected by the sample.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show every field, with its source and grade

What happened

Earliest source we hold

2026-02-10

D inferred by us from the described behaviour, reason shown

What went wrong

security breach

C one secondary source states it

primary risk

RK07

D inferred by us from the described behaviour, reason shown

Impact

Severity

major

D inferred by us from the described behaviour, reason shown

Why this severity

test met: a stated count of two or more affected parties (91 infected hosts).

D inferred by us from the described behaviour, reason shown

Notes on gaps

Attacker location (an Indian residential ISP IP) is explicitly unconfirmed attribution and is not recorded. Monetary values were given in GBP and were not converted or recorded. The advice controls (J1, F2, J8) map the source's general recommendations and are not reported as changes made by any party.

LR-2026-0424 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON