Google caught malware that uses AI to rewrite itself every hour. Here’s why your free antivirus may never see it coming, and the 10-minute fix.

September 14, 2026

By Kim Komando

This sounds like science fiction, but it’s in Google’s threat report.

Google’s security team caught malware called PromptFlux that asks Gemini’s AI to rewrite its own code, some versions every single hour, for one purpose: slipping past your antivirus. A cousin called PromptSteal has been used in attacks overseas. Malicious code that never looks the same twice.

Here’s the trick in plain English. The malware pings an AI service the way you’d ask a chatbot for a recipe, except it asks for a new disguise. Fresh code, same crime, no fingerprints.

Full disclosure before we go on: Webroot sponsors today’s Deep Dive. They buy airtime. They don’t buy my opinion.

🧬 The mugshot problem

Most antivirus, including almost every free tool, works off signatures. Think of it as a most-wanted list. Security companies fingerprint known malware, and your software blocks anything that matches. It worked for 30 years.

Rewrite the code, and the mugshot becomes worthless. Stack that against the roughly 560,000 new malware samples researchers log every day, and the most-wanted list was already losing the race. Then AI moved the finish line.

The stakes are not abstract. Americans reported a record $15.9 billion lost to scams and fraud last year, plenty of which started with this kind of code on somebody’s computer.

Straight talk: Google caught PromptFlux early, still in development, not spreading across the country. But the blueprint is public, and copycats work fast. You don’t wait for the flood to buy the sandbags.

🛡️ Lock it down

Step one: Run protection that watches behavior, not just mugshots. Webroot Essentials monitors threats in real time, 24/7, with scans 6x faster than the average competitor, plus Web Threat Shield, Breach Monitor and a Text Scam Detector. Exclusive for my readers: 62% off, starting at $19 a year.

Step two: Let your computer patch itself. On Windows: Settings > Windows Update > turn on automatic updates. On Mac: System Settings > General > Software Update > automatic. Most malware, AI-written or not, walks in through a hole that was already fixed.

Step three: Remember the front door. Shape-shifting code still needs an invitation, usually a link in an urgent text or email. When a message rushes you, that’s your cue to slow down.

The crooks taught their code to change its face. Make sure your protection isn’t still thumbing through a photo album.

🗣️ TEXT/POST THIS STAT: Researchers log about 560,000 new malware samples every day. Google found one that uses AI to rewrite itself every hour. GetKim.com

📩 Send this to the person still running the antivirus that came free with the laptop in 2019.