arXiv: Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

This publication, "Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware," presents new research demonstrating how advanced AI-driven malware can evade current static security scanners by dynamically altering its behavior. The paper introduces a novel detection framework that identifies such "agent skill" malware in real-time, highlighting a significant gap in existing cybersecurity defenses. While not a regulatory mandate itself, this research signals an emerging threat landscape that regulators and compliance frameworks, including the AI Safety framework, will likely address.

The findings directly affect organizations deploying or developing autonomous AI agents, particularly in critical infrastructure, financial services, healthcare, and defense sectors. Any entity using large language models or agentic AI systems that can execute external actions or access sensitive data is at heightened risk. Compliance teams in these sectors must reassess their AI risk management protocols, as traditional static scanning and signature-based detection may no longer suffice against adaptive threats.

Compliance teams should immediately review their AI governance policies to ensure they include dynamic threat monitoring and behavioral analysis capabilities. They should engage with cybersecurity teams to test existing detection tools against the evasion techniques described in the paper. Additionally, teams should monitor EU and national AI safety regulators for updated guidance on agentic malware, and consider incorporating runtime verification and anomaly detection into their AI supply chain and deployment audits. Proactive documentation of these assessments will be critical for demonstrating due diligence under evolving AI safety regulations.