Attackers Are Learning to Live Off the AI Toolchain

July 22, 2026 · Dark Reading · Severity: HIGH

The Sandworm_Mode malware represents an evolution in attacker tradecraft by exploiting trusted AI tools and agentic workflows to live off the AI toolchain, analogous to living off the land techniques that abuse legitimate system tools. Rather than deploying custom malware that might be detected, attackers manipulate AI coding assistants, agentic frameworks, and ML pipelines to perform malicious actions under the guise of legitimate AI operations. This approach makes detection significantly harder because the malicious activity uses authorized tools, follows expected behavioral patterns, and leverages AI agent capabilities that are explicitly designed to execute multi-step tasks with autonomy.