What was done #
An air-gapped Rust analysis tool looks for structural and behavioral features in polymorphic, metamorphic and AI-rewritten malware without relying only on file hashes.
Agat is an offline, air-gapped Rust tool for defensive analysis of polymorphic, metamorphic and AI-rewritten malware. Its README describes an artificial-immune-system approach that looks for structural features and behavioral signals rather than relying only on byte signatures. It produces analysis output such as SARIF and is designed to run without network access.
Analysis approach
The project documents signals for packers, high-entropy executable sections, suspicious section names and artifacts associated with AI-generated code. It also describes model packs and a workflow for comparing samples. The repository presents itself as a research and analysis tool, not as a malware payload or exploit.
AI contribution and limits
Claude Opus 4.8 co-authored changes to AI-artifact detection rules and static danger signals, along with analysis and reporting code. The README discusses detecting AI-rewritten malware; that describes the tool’s target, while the commit records show Claude assisting with the defensive analyzer itself. No live sample is included in this directory entry.