Ghosts in the machine: AI malware shows why it is time to extend Zero Trust to code

Software security was built around human development.

<![CDATA[ <article> <p>Software security was built around human development. </p><p>People wrote, reviewed and deployed code. Now machines are taking over. </p><p>In a recent paper, Anthropic reports that more than 80% of the code merged into its production codebase is authored by their <a href="https://www.techradar.com/best/best-ai-tools">AI</a> model, Claude. </p><p>The same capabilities that make <a href="https://www.techradar.com/best/sites-for-hiring-developers">developers</a> more productive are changing the economics of cyberattacks. </p><p>While adversaries still define the objective, machines can generate the payloads, test variants, adapt code to different environments and repeat the process at a velocity that security programs can’t match.</p><h2 id="speed-is-marginalizing-security-controls">Speed is Marginalizing Security Controls</h2><p>Most enterprise software security workflows assume there is time for review. <a href="https://www.techradar.com/pro/software-services/best-no-code-platforms">Code</a> is written, scanned, tested, approved and deployed. If something suspicious happens later, security teams investigate and respond.</p><p>That model breaks down when <a href="https://www.techradar.com/best/best-open-source-software">software</a> moves from prompt to execution in minutes.</p><p>AI-generated code can become a script, dependency, <a href="https://www.techradar.com/pro/best-it-automation-software">automation</a> job or infrastructure change almost immediately. While development agents can modify files, resolve packages and run commands. </p><p>Human reviewers are no longer in the loop.</p><p>Attackers can use the same mechanics to generate exploits, test evasion techniques and adjust payload behavior for different targets. This creates more variation with fewer stable indicators for defenders to recognize.</p><p>While AI-assisted analysis can improve triage, it still often produces probability, not policy. At machine speed, “probably suspicious” is not good enough.</p><h2 id="machines-change-the-attack-model">Machines Change The Attack Model</h2><p>Human attackers are not disappearing. But more of the attack chain is becoming machine-executed.</p><p>AI can automate reconnaissance, accelerate vulnerability discovery, generate exploit code, rewrite payloads and adapt command sequences to the target environment. But most defensive measures are designed around human constraints: reused infrastructure, shortcuts and trackable patterns. These don’t apply to machine attacks.</p><p>A machine-generated payload may not match a known signature or have an established reputation. It may be created, used briefly and discarded. But AI <a href="https://www.techradar.com/best/best-malware-removal">malware</a> must still interact with the target environment to achieve its objective. Its behavior cannot conceal its intent, since it must access resources and change the environment in ways that advance the attack. </p><p>What malicious code is capable of doing is the more durable security signal.</p><h2 id="security-needs-to-ask-a-different-question">Security Needs to Ask A Different Question</h2><p>Software supply chain security has improved, but much of it still validates the artifact’s properties before execution rather than governing execution itself.</p><p>SBOMs, signing and provenance give security teams greater confidence in a code's composition, origin and build history. But knowing where software came from does not reveal what it will do when it runs.</p><p>Software can pass each of those checks and still create risk. Even an artifact produced through a legitimate build process may violate policy at runtime, while an AI-generated script may complete its intended task in a way that exposes data or systems. As a result, a clean dependency list is not proof of safe behavior.</p><h2 id="post-execution-detection-is-too-late">Post-Execution Detection Is Too Late</h2><p>Detection and response remain essential, but they intervene after risk has entered the environment. By the time suspicious behavior is visible, software may have accessed secrets, changed system state, opened network connections or created persistence. </p><p>AI compresses that window. Code can be generated, modified and deployed faster than humans can review it. Waiting for post-execution evidence gives attackers too much room to operate.</p><p>We need to shift the decision point left. Instead of asking, “Can we contain this software if it behaves badly?” the question should be, “Should this behavior be permitted to execute in the first place?”</p><p>That does not mean replacing existing controls, but rather changing where the decisive security gate sits.</p><h2 id="zero-trust-for-code">Zero Trust for Code</h2><p>Zero Trust changed enterprise security by rejecting implicit trust. Users, devices, sessions and access requests are not trusted simply because they appear familiar. They must be verified against policy.</p><p>Software execution needs the same level of verification.</p><p>Code should not be trusted solely because it came from a known repository, was signed by a recognized publisher, passed through a build pipeline or has not been seen exhibiting malicious behavior before. Those are useful indicators, but they are not conclusive.</p><p>Zero Trust for Code addresses this problem. Before software runs, its expected behavior should be evaluated against policy. If the behavior is acceptable, execution can proceed. If not, the artifact should be blocked, restricted, isolated or escalated for review.</p><p>Organizations can start by mapping every path through which code enters the environment or executes with meaningful privilege. This includes formal development channels such as repositories, open-source packages, containers and CI/CD pipelines, as well as email attachments, downloaded files, macros, browser extensions, endpoint installers, third-party integrations and scripts introduced through AI or automation tools. </p><p>Then identify where those paths rely on inherited trust. If execution is allowed because software came from an approved source, was signed, passed through a build process or has no malicious history, the control is incomplete. Behavior still has to be evaluated before the artifact is allowed to run.</p><p>As AI takes on more of the work of creating legitimate and malicious code, enterprises can no longer assume that code which clears existing checks should be allowed to run. Execution must become a deliberate security decision.</p><p><em></em><a href="https://www.techradar.com/news/best-internet-security-suites"><em>We've listed the best internet security suites for PCs, Macs and mobile devices</em></a><em>.</em></p><p><em>This article was produced as part of </em><a href="https://www.techradar.com/pro/perspectives" target="_blank"><em>TechRadar Pro Perspectives</em></a><em>, our channel to feature the best and brightest minds in the technology industry today.</em></p><p><em>The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: </em><a href="https://www.techradar.com/news/submit-your-story-to-techradar-pro" target="_blank"><em>https://www.techradar.com/pro/perspectives-how-to-submit</em></a></p> </article> ]]>