{"slug": "polymorphic-metamorphic-and-ai-rewritten-malware-agat-offline-analysis-of", "title": "Polymorphic, metamorphic and AI-rewritten malware: Agat: Offline Analysis of Polymorphic Malware", "summary": "Agat, an offline air-gapped Rust tool, analyzes polymorphic, metamorphic and AI-rewritten malware by detecting structural features and behavioral signals rather than relying only on byte signatures, according to its README. The project documents signals for packers, high-entropy executable sections, suspicious section names and artifacts associated with AI-generated code, and emits analysis output such as SARIF without network access. Commit records show Claude Opus 4.8 co-authored changes to the tool's AI-artifact detection rules, static danger signals, and analysis and reporting code; no live malware sample is included in the directory entry.", "body_md": "## What was done\n\nAn air-gapped Rust analysis tool looks for structural and behavioral features in polymorphic, metamorphic and AI-rewritten malware without relying only on file hashes.\n\nAgat is an offline, air-gapped Rust tool for defensive analysis of polymorphic, metamorphic and AI-rewritten malware. Its README describes an artificial-immune-system approach that looks for structural features and behavioral signals rather than relying only on byte signatures. It produces analysis output such as SARIF and is designed to run without network access.\n\n### Analysis approach\n\nThe project documents signals for packers, high-entropy executable sections, suspicious section names and artifacts associated with AI-generated code. It also describes model packs and a workflow for comparing samples. The repository presents itself as a research and analysis tool, not as a malware payload or exploit.\n\n### AI contribution and limits\n\nClaude Opus 4.8 co-authored changes to AI-artifact detection rules and static danger signals, along with analysis and reporting code. The README discusses detecting AI-rewritten malware; that describes the tool’s target, while the commit records show Claude assisting with the defensive analyzer itself. No live sample is included in this directory entry.", "url": "https://wpnews.pro/news/polymorphic-metamorphic-and-ai-rewritten-malware-agat-offline-analysis-of", "canonical_source": "https://reversedwithai.com/p/agat-offline-malware-analysis", "published_at": "2026-10-21 14:46:06+00:00", "updated_at": "2026-10-21 15:43:13.047988+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["Agat", "Rust", "Claude Opus 4.8", "Anthropic", "SARIF"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/polymorphic-metamorphic-and-ai-rewritten-malware-agat-offline-analysis-of", "markdown": "https://wpnews.pro/news/polymorphic-metamorphic-and-ai-rewritten-malware-agat-offline-analysis-of.md", "text": "https://wpnews.pro/news/polymorphic-metamorphic-and-ai-rewritten-malware-agat-offline-analysis-of.txt", "jsonld": "https://wpnews.pro/news/polymorphic-metamorphic-and-ai-rewritten-malware-agat-offline-analysis-of.jsonld"}}