Check Point Research uncovered VoidLink, one of the first examples of advanced malware largely generated using AI.
Cyber security solutions Check Point Software’s research team discovered VoidLink, a malware framework created by AI that displays how cyber weapons can be built faster than before.
According to Check Point Research, VoidLink showed that it was mature, modular, and highly capable of using advanced technologies such as rootkits, cloud enumeration tools, and container-focused post-exploitation modules. While monitoring the programme, the malware evolved rapidly, adding new components, command-and-control infrastructure, and expanding into a full operational platform.
While the internal documentation described a development roadmap spanning more than 20 weeks and multiple teams, the actual malware was functional in less than a week. By early December 2025, VoidLink already consisted of more than 88,000 lines of code and had been submitted to VirusTotal.
Check Point Research mentioned that the attacker relied on an AI-driven workflow known as spec-driven development. Instead of manually coding everything, the developer focused on describing what the malware should do. The AI then translated those specifications into architecture plans, sprint schedules, coding standards, and ultimately, working code.
Leaked internal files revealed highly structured documentation, written in Chinese and formatted like professional software engineering plans. These included detailed sprint breakdowns, coding rules, and acceptance criteria across multiple “teams”. The level of structure, consistency, and detail strongly points to large language models generating much of this material.
The recovered source code also matched those AI-generated instructions. This tight alignment suggests the malware wasn’t just planned with AI, but largely implemented by it. The developer acted more like a product owner, guiding the process, reviewing output, and refining specifications, while the AI handled the bulk of the coding.
Check Point researchers replicated the process using the same type of AI-assisted development environment. Feeding the specifications back into an AI model produced code that closely resembled VoidLink’s structure and behaviour. With clear specs and tests in place, the AI was able to implement complex features sprint by sprint with minimal human intervention.
The implications are serious since it shows that a single individual can now produce malware that once required large, well-funded teams. As AI models improve, the barrier to creating advanced cyber threats continues to fall.
Stay updated on crypto and AI by following our socials
