Status: Analysis / Google Threat Intelligence and our own runs, October 2026
Google Threat Intelligence Group (November 5th, 2025), our July 2026 run, and a recorded hold (October 21st, 2026)
CISO Perspective: Antivirus earned its place by checking before anything ran. It checked files against a list of known bad things. An AI agent with a real login carries no bad file, so there is nothing on the list to match. The antivirus for AI keeps the habit and changes what gets checked: the action, before it runs, against rules your team writes in plain English. Ask what checks your agents’ actions today.
In early June 2025, Google’s threat intelligence team found a piece of malware that asked an AI to help it hide.
They called it PROMPTFLUX. It was a small script with a module its author named “Thinking Robot,” and Google described its job in one line: it was “designed to periodically query Gemini to obtain new code for evading antivirus software.” One version went further and told Gemini to rewrite the malware’s entire source code every hour.
Google was careful about what this was and wasn’t. The code was experimental. Parts of it were commented out. In Google’s words, it “does not demonstrate an ability to compromise a victim network or device,” and Google shut down the accounts behind it.
It still told us something. We wrote about it the day after Google’s report came out, last November, because it showed where the old model of protection runs out. Antivirus has always worked from a list of known bad things. A program that asks for a new face every hour is never on the list.
What antivirus got right
For decades, antivirus did one thing well. It sat on every machine, and it checked before anything ran. Nobody asked whether a file meant well. The file got checked, then it got a decision.
That habit is the part worth keeping. The part that aged badly was how the decision got made. Signatures are fingerprints of attacks somebody has already seen. Researchers showed back in 2023, with a proof of concept called BlackMamba, that code which rewrites itself on every run never leaves the same fingerprint twice. PROMPTFLUX was the same idea with a large language model doing the rewriting.
The security industry adapted. Behavior-based tools watch what a program does instead of what it looks like. That works for programs.
AI agents are a different problem.
The agent with nothing to detect
An AI agent isn’t malware. It’s software your team installed on purpose and gave a real login. It reads the mail, opens tickets, edits records, runs commands and calls tools, and it decides for itself what to do next.
When an agent does something it shouldn’t, there’s usually nothing to detect. No malicious file, no strange binary, no attacker on the network. The agent used a credential it was given to take an action it was allowed to reach. Every log entry looks legitimate, because by the rules of the system it was.
We saw this in our own demo environment in July. A third-party model update, made outside our control, with no change to our prompts, our policies or our infrastructure, changed how our demo agent behaved overnight. Shaun Cuttill, our CTO, wrote it up on August 6th: the update “turned a stable governance demo into a string of novel, multi-step attempts to act beyond authority.”
Over the run, the agent made more than 140 attempts at actions its rules didn’t allow. Nobody had seen that behavior before, so no signature could have existed for it. None of the attempts executed. The rules didn’t change, and we didn’t write a new one or ship a patch. Every attempt was checked as an action before it ran, and none of them fit the rules.
A list of known bad things can’t hold behavior that started last night. A rule about what the agent is allowed to do can.
What it has to do instead
An antivirus for AI keeps the old habit and changes what gets checked. It checks the action, not the code.
It has to sit wherever an agent acts. Agents run on laptops, on servers and in the cloud, from coding agents like Claude Code and OpenAI Codex to models running in your own environment. A control that covers one of those places leaves the others open.
It has to check every action before it runs. After the fact is a log, and a log tells you what already happened.
It has to decide in more than two ways. Most actions are fine and should run without anyone noticing. Some are plainly wrong and should be blocked. A smaller set needs a person: a payment above a line, a change to a student record, a message to every customer. Those should wait, with a clock running, until someone with the authority says yes or no.
It has to work from rules people can read. A security team writes “finalizing a control assessment needs a person” in plain English, and that is the rule. No signatures to update.
And it has to keep the record. When the auditor asks who approved an action, the answer should be a row, not a search through logs.
What that looks like
On October 21st we recorded one action on our own environment, start to finish. A coding agent, Claude Code, was asked to finalize a control assessment in a GRC system. It wrote the call and went to run it. The rule for that company says finalizing an assessment is a decision a person makes, so the action was held. The agent waited. Nothing ran.
In the console, the hold showed up with a five-minute clock and six ways to answer: allow or deny, once, for this exact circumstance, or as a general policy. A person chose “allowed, just this once.” The agent ran the call and reported back. The record kept all of it: the held action, who answered, what they chose and the result.
That recording is 57 seconds long, and it’s on our proof page with what we don’t claim spelled out underneath it. The GRC system was a stand-in on the same machine, and the prompt was typed by a script so the frames could be captured. The hold, the clock, the answer and the record are the product’s, unedited.
A note on the phrase
We aren’t the only people reaching for the antivirus comparison. Some tools now describe themselves as antivirus for AI agents on a single developer’s machine, and that’s useful work. An enterprise needs more on top of it: one set of rules across every agent, a person in the loop for the actions that need one, and a record an auditor will accept.
Mountain Theory runs anywhere an AI acts. Our catalog lists 178 AI systems, 158 of them enforced today and 20 on the roadmap, and we keep it public at mountaintheory.ai/governable-ai. It’s a list of what we can govern, not a list of customers.
Where this leaves a security team
If your company runs AI agents, ask what checks their actions before those actions run. If the honest answer is “nothing, but we’d see it in the logs,” you’re where the industry was before antivirus: finding out from the damage.
The model still decides. The action does not run until it has been checked.
Mountain Theory is the antivirus for AI. It checks every action before it runs. No signatures to update.
See the run, the hold and the record: mountaintheory.ai/antivirus-for-ai
Sources: Google Threat Intelligence Group, “GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools”, November 5th, 2025. Mountain Theory, Zero-Day Agent Behavior, August 6th, 2026, and Held. Then released., recorded October 21st, 2026.