First per-app firewall that catches AI-powered worms
AI-augmented malware now queries ChatGPT, Claude, and Gemini during live attacks to generate reconnaissance commands and evade detection. NetInsightPro identifies non-browser processes making LLM API calls, flags autonomous lateral movement in the 60-second window after an LLM response, and escalates when the same threat pattern appears across 3 or more hosts in your network.
Available on Pro and Enterprise tiers. AI-threat detection and telemetry now live.
From lab to confirmed deployment
AI-augmented malware crossed from theoretical research into confirmed state-sponsored use in 2025. CrowdStrike documented an 89% surge in AI-enabled adversary operations in their 2026 Global Threat Report.[5]
First demonstrated self-replicating worm targeting GenAI ecosystems. Exploited RAG database poisoning and adversarial prompt embedding to propagate across ChatGPT-4, Gemini Pro, and LLaVA.
First confirmed in-the-wild malware that queries a live LLM (Hugging Face, Qwen2.5) during active attacks to generate Windows reconnaissance commands, then exfiltrates documents via SSH to attacker C2.
Backdoor using the OpenAI Assistants API as its C2 channel. A .NET DLL polls an attacker-controlled OpenAI account for encrypted commands — traffic is standard HTTPS to api.openai.com, indistinguishable from legitimate developer use by TLS inspection.
How it works: three detection heuristics
NetInsightPro's existing per-app egress telemetry creates a unique detection surface. The initial release ships three heuristics with the best signal-to-noise ratio — chosen for low false-positive rates after allowlist calibration.
LLM API egress from non-browser processes
Alerts when any process not in the tenant allowlist establishes connections to known LLM API endpoints (api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, Hugging Face, Mistral, Cohere). Non-developer processes calling these endpoints is the foundational indicator for both LLM-as-C2 (SesameOp pattern) and LLM-assisted reconnaissance (PROMPTSTEAL pattern).
Malware disguises exfiltration as ordinary traffic to a legitimate AI API. Because detection is per-app, NetInsightPro sees the call come from a process that has no reason to talk to an LLM — a signal TLS inspection and traditional firewalls miss entirely.
Post-LLM lateral move detection
Flags when the same process (or a child it spawns) initiates an SSH, SMB, or Kubernetes API connection to a host outside the device baseline within 60 seconds of receiving an LLM API response. This is the signal of LLM-orchestrated reconnaissance — the LAMEHUG/PROMPTSTEAL pattern where malware receives LLM-generated commands and immediately attempts lateral movement.
Malware asks a live model for its next step, then immediately probes a neighbouring host. NetInsightPro links the AI response to the follow-up intrusion within seconds — catching the attack while there is still one machine to contain, not a network to rebuild.
Cross-host process hash replication
Escalates when the same process binary hash appears making LLM API calls on 3 or more distinct devices within a tenant in a 5-minute window, and that hash was not previously in the tenant baseline. This is the clearest worm propagation signal — novel binary spreading to multiple hosts and calling out to AI APIs.
One infected workstation starts seeding an unknown binary across the fleet. NetInsightPro correlates the same new hash calling AI APIs on host after host and escalates within minutes — the security team isolates the source before the worm becomes an incident.
False-positive estimates are pre-calibration; allowlist tuning reduces rates significantly within 14 days per tenant.
Detection without reading your prompts.
AI threat detection works at the network metadata layer. NetInsightPro never sees prompt text or LLM response content. Detection is based entirely on behavioral signals: which process is connecting, to which endpoint, at what interval, and at what byte volume.
Payload entropy capture (Heuristic H3) is opt-in per-tenant and off by default. Every tenant can opt out entirely from AI threat telemetry via a single configuration setting.
- No raw prompt text or LLM response content is ever stored, logged, or transmitted — only network metadata (endpoint hostnames, byte counts, timing intervals)
- Process metadata is limited to process name and a one-way lineage hash — full command-line arguments are explicitly excluded
- Payload entropy capture (Heuristic H3) is opt-in per-tenant, default off
- Per-tenant opt-out: configuration key ai_threat_telemetry_enabled (default on) — when set to false, no AI threat heuristic events are collected or stored
- No cross-tenant aggregation of threat data — correlation runs within the tenant stack only
- GDPR Art. 5 data minimisation and storage limitation: AI threat anomaly records retained 90 days, consistent with existing anomaly records
Where your data goes is a control, not a footnote.
Shadow-AI tools can route prompts — and the data inside them — to AI services hosted in jurisdictions with no reciprocal data-protection guarantees. For defence, government, and regulated sectors, egress to an adversarial-jurisdiction AI endpoint is a data-sovereignty, exfiltration, and compliance exposure in one. NetInsightPro classifies AI traffic by the endpoint it reaches, so egress to non-Western AI services is visible — not blended into ordinary encrypted traffic.
DeepSeek (China · api.deepseek.com) is classified today, alongside the Western AI endpoints already covered — so egress to it surfaces as a named, categorised event.
Classification coverage is expanding across additional Chinese and Russian AI endpoints — surfaced here so security teams can see which jurisdictions their shadow-AI traffic reaches.
- AI services hosted in high-risk jurisdictions may be subject to local data-access laws with no reciprocal protection for foreign data
- Prompts frequently carry source code, credentials, customer records, and internal documents — the exact material a data-sovereignty regime is meant to keep in-territory
- Traditional firewalls see only ordinary HTTPS to a well-known domain; per-app classification names the destination and the jurisdiction
- For defence, government, and regulated sectors, non-Western AI egress can breach data-residency, export-control, and procurement obligations
DeepSeek is classified today; the remaining endpoints are on the active expansion path. Classification identifies the destination and jurisdiction from network metadata — it never reads prompt or response content.
Included on Pro and Enterprise.
Pro
Early Access- H1: LLM API egress alerting on your device
- H5: Post-LLM lateral move detection (60s window)
- H7: Worm hash-replication signal (5-min window)
- Per-tenant opt-out available
- AI threat telemetry in your device flow history
Enterprise
Early Access- Everything in Pro
- Cross-host H7 worm signal across your fleet
- AI-threat detections viewable in the app and retained in your tenant backend; tenant-admin console visibility expanding
- SIEM forwarding of ai_category threat values (OCSF)
Detection is live. More is coming.
Live and protecting you today
ShippedThree detections and the telemetry behind them are running in production right now — catching AI-era attacks that firewalls and traditional EDR wave straight through.
Stops your secrets leaving for an unknown AI
The moment a process that has no business talking to an AI service starts streaming data to one, NetInsightPro flags it — before your code, credentials, or clipboard leave the device.
A browser extension a developer trusted quietly begins piping clipboard contents to an unfamiliar AI endpoint. NetInsightPro catches the anomalous outbound call from a non-browser process the instant it starts — the exfiltration is cut off before a single line of proprietary code leaves the laptop.
Catches an attack the second it tries to spread
AI-assisted malware asks a live model for its next move, then pivots. NetInsightPro links the AI call to the follow-up intrusion attempt and raises the alarm in the narrow window where containment still works.
Malware on a workstation queries an AI model for reconnaissance commands, then tries to jump to a neighbouring machine over SSH. NetInsightPro ties the lateral move to the AI response within seconds and alerts before the attacker gains a second foothold.
Contains a worm before it owns your fleet
When one machine's malicious binary starts appearing across others, NetInsightPro correlates the spread fleet-wide and surfaces the worm signal in minutes — giving the security team time to isolate, not just investigate.
A single compromised workstation begins replicating a never-before-seen binary to other hosts, each phoning an AI API for instructions. NetInsightPro escalates the cross-host replication within minutes; the team quarantines the origin machine before the worm reaches the wider network.
Turns invisible AI abuse into a named, recorded signal
Every AI-threat detection is classified and written to your tenant's flow record — so an AI-era attack is captured as a clear, categorised event instead of blending into ordinary encrypted traffic. Analyst-facing views of these events are expanding.
A finance workstation that no one authorised to use AI tooling starts making AI-endpoint calls. Traditional firewalls see only ordinary HTTPS to a well-known domain; NetInsightPro names the behaviour and records it as a categorised AI-threat event — so the investigation starts with an answer instead of a hunch.
Keeps the evidence, wherever your people are
Detected events sync to a secure cloud backend, so remote and roaming devices stay covered and every AI-threat signal is retained for review — no on-prem collector, no gaps when someone works from home.
A laptop triggers an AI-egress detection on hotel Wi-Fi, far from the corporate network. The event still reaches your tenant backend, timestamped and attributed, and is retained for review as customer-facing access rolls out.
Purpose-built for the sectors where a breach is catastrophic.
NetInsightPro is extending its detection platform into the environments where conventional security tooling fails — high-assurance, regulated, and operationally critical.
- Defence & IntelligenceKernel and firmware-level spyware detection. Air-gap-friendly telemetry for classified and sensitive compartmented environments.
- Healthcare & Life SciencesRegulatory-aligned anomaly reporting for HIPAA and NIS2 obligations. Continuous posture monitoring across distributed clinical networks.
- Critical InfrastructureOT/IT convergence visibility. Detection coverage for industrial control systems and SCADA-adjacent endpoints where downtime is not an option.
- Financial ServicesDORA-ready incident telemetry and immutable audit trails. Advanced insider-threat and supply-chain detection for regulated institutions.
References
- Cohen, S., Bitton, R., Nassi, B. "Here Comes the AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications." arXiv:2403.02817, March 2024 (revised January 2025). Cornell Tech.
- CERT-UA / Splunk Threat Research. "LAMEHUG's LLM-Driven Cyber Intrusion." Splunk Security Blog, July 2025.
- Google Threat Intelligence Group (GTIG). "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools." Google Cloud Blog, 2025. Covers PROMPTSTEAL, PROMPTFLUX, APT28 attribution.
- Microsoft Security Blog. "SesameOp: Novel backdoor uses OpenAI Assistants API for command and control." November 3, 2025.
- CrowdStrike. "2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface." February 2026.
Talk to us about AI-worm detection.
Tell us your fleet size, SIEM, and IdP. We will walk you through the detection heuristics and the allowlist calibration process. No spam. One business day turnaround.
Pro and Enterprise tiers · Early access · AI-threat detection live