Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

Some malware now asks an AI model what to do at run time. What is real so far, and how should detection and response change?

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

mediumNewPreparation tags: Google, Microsoft, CrowdStrikeUpdated Nov 2026

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 4 follow-ups like an interviewer would

EDR on a finance workstation shows a script host process making repeated HTTPS calls to a public model-hosting API, followed by bursts of system discovery commands and a zip archive being written to a temp folder.

  1. What is the most likely explanation, and what makes it suspicious?
  2. What do you do in the first hour?
  3. What durable controls come out of this?
  4. How do you summarise malware that calls LLMs?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackYour SIEM receives normal log volume but stops correlating sensitive reads. How would you investigate?Next in this trackA SOAR containment action times out after approval. What should the playbook do next?Next in this trackA YARA retrohunt returns zero matches. How would you explain that result to incident leadership?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.