AI malware analysis: defensive research with language models

This page collects defensive malware analysis work where analysts used language models to understand known samples faster. The entries are research: triage pipelines, lab comparisons of several models on the same samples, and studies of how far a model gets on its own. Most ran inside isolated analysis environments such as FLARE-VM or REMnux, with the model calling established tools like Ghidra, Binary Ninja, capa and FLOSS through MCP servers or command line skills. The useful pattern is that the model drafts a report, names functions and pulls out indicators, while the analyst checks every claim against the disassembly. Several write-ups describe where models went wrong, for example confident summaries of code they had not actually read. The directory lists analysis and detection work only and does not accept projects that write or change malicious code. Each entry links the original writeup, so you can read the method and the limits the authors report.