Stochastic Malware: When Your LLM Randomly Decides to Steal Your Data

It’s mid-August. I am on a conference, and casually scroll Reddit in a free minute. I see someone in r/webdev sharing a link to a blog post, titled “How to prevent Google Antigravity from accessing .env.” I scrolled further for about half a minute, until I stopped. Then, I looked up from my phone and out the window, thought for a second, then looked back at my phone, and I started scrolling up until I found the post again. The only thought that crossed my mind was: “Jesus Christ!”

If you’re using any “agentic” code editor or IDE — be it Claude Code, VS Code with the Copilot extension, Google Antigravity, or Cursor — the short TL;DR of what I am about to write is: Stop using it until you can verifiably ensure that no credentials or otherwise personal data are within its reach. Otherwise, you’re essentially running malware on your computer, and the only reason your credentials aren’t being leaked any day is quite literally luck — a phenomenon I call “stochastic malware.”

In the following, I first introduce those of you who want a refresher on what “agentic AI” even is. Then, I outline the problem which the aforementioned blog post is trying to solve and why all solutions the author provides are ultimately futile and cannot definitively prevent leakage. In a third section, I will more closely argue that this is essentially the behavior of malware, and define what I mean by “stochastic malware” specifically.

What is “Agentic AI”?

We live in truly odd times. After about thirty years of our society living with the internet and lots of expensive lessons learned from data breaches, security nightmares, and critical bugs in infrastructure, we seem to evolve backwards again. In the quest for the perfect automation of all our needs, we are suddenly happy to throw out decades of computer security knowledge for the clout of using “agentic AI” to write code for us, rather than doing it ourselves. We have truly regressed back to a primitive “security by obscurity” practice that prevents data leaks not by design, but based on sheer luck.

If you have been living under a rock the past two years: lucky you. “Agentic AI” is a buzzword coming out of the general AI/LLM discourse that describes a way to give LLMs access to your files and folders, and enable them to run command-line tools, and even search the web — fully autonomously. “Agentic” in this context means “to give an LLM ‘agency’ to do things itself, without you needing to implement suggestions manually.”

The possibly most famous “agentic” AI tool to be created was OpenClaw back in 2025, which catapulted its developer Peter Steinberger into Silicon Valley and its users into a persistent security nightmare. Currently, the “hot topic” are agentic IDEs, which essentially just means “code editors with direct LLM access baked in.”

The possibly first and most popular “agentic IDE” is Claude Code. Another very famous one is VS Code, into which Microsoft has added a “Copilot Chat” extension. (Which, coincidentally, cannot be uninstalled, only disabled. You may recognize this behavior from the bloatware smartphone manufacturers often add onto Android devices.) OpenAI has something similar, and Google has joined the club with Antigravity which, again, is a code editor, but this time with Gemini baked in. Most of these “agentic IDEs” are just copies of VS Code, but with a specific integration with whatever LLM the company offers as a service baked in.

The best way to explain “agentic AI” is to distinguish it from what we may call “regular” AI, that is: where we just chat with some LLM. When you log in to the website of OpenAI, Anthropic, or Mistral, you typically get a chat interface where you ask a question, maybe attach some files for context, and hope to get some help with it. That’s how I have been using AI myself for a long time. Those LLMs typically only have access to web searches, where they can query Google or Bing to research some additional information if they need it. They do not have any access to anything on your computer.

When an LLM can utilize external tools, this is referred to as “tool calling.” The gist of it is that, as part of its answer, the LLM can generate text that describes a function it has access to. The software in which the LLM is running (for example, the chat window), can detect this text and actually execute the tool call on behalf of the LLM. For example, if ChatGPT wants to perform a web search, it can generate a string, say, web_search "some keywords to search for". The software on which the chat interface is running recognizes web_search as an available tool and performs the corresponding action — here, searching for something using Google. Once that action has been completed, the software inserts whatever the search yielded into the context window of ChatGPT, which can then proceed to use this information to generate the final answer to the user.

“Agentic AI” more narrowly drives this to the extreme. Instead of the occasional web search, the LLM has access to a multitude of commands, tools, and actions it can perform by invoking some functions in its underlying software with the goal of working almost entirely unsupervised. Here, the LLM cannot just use some very specific functions, but it has full access to your computer’s files, can invoke terminal commands, and in general the LLM has effectively the same power to do things with your computer as you yourself. I have heard reports of people letting LLMs churn through problems for hours at a time with no supervision. In the end, a lot has changed in the code project, and maybe the LLM has even fixed the bug it was supposed to.

But how does the LLM even know what it can and cannot do? Closely related to “tool calling” are “skills,” which are essentially just Markdown documents that contain instructions for the LLM about how to tackle certain tasks. By default, an LLM has no idea what text it would have to generate in order to actually trigger such a tool call. A function to trigger a web search for example may be called search_google for OpenAI, web_search for Copilot, or google for Antigravity. A “skill” is being used to tell the LLM both what the tool is actually called, and give some guidance when and how to use it. For example, a “skill” to perform a simple web search might look like this. As you can see, such a file can get very long, because to get better results you typically have to do a lot of hand-holding. Otherwise, it is very easy for an LLM to go off the rails.

“Agentic AI” as part of a code IDE essentially just describes the usage of an LLM alongside some software that can automatically inject relevant “skills” into its context window to inform the LLM about certain tools it can use at its own discretion. For “agentic IDEs” such as Google’s Antigravity, the Copilot integration in VS Code, or Claude Code, this includes arbitrary file access and invoking commands.

How Do You Ensure your LLM Only Reads the Right Files?

This newfound ability of the LLM to control your computer has raised many questions, but a very central one is: how do you then prevent it from accessing files it shouldn’t? Again, due to all the tools the LLM can invoke to execute arbitrary commands on your computer, it effectively has the same access to all your files that you have. For coding projects, this has one important implication: It is typical to have a few passwords and account details alongside your code, so that you can, say, test certain features to ensure they work as expected. You obviously don’t want these to leave your computer.

An LLM has no concept of “intent.” If its internal probability distribution generates text that reads a file with sensitive data, there is no malicious intent. But since most LLMs don’t run on your computer, the file content is being transmitted to the servers of OpenAI, Anthropic, or whoever actually hosts the model as soon as the file has been opened. Which means that any text you can see, OpenAI can see, too.¹ And even if you decide to use a locally running model, it still can access the internet and therefore could, if the probabilities are just right, share your secrets with some random website.

So how do you prevent this?

The most obvious and first solution the author of the blog post mentions is that every “agentic” IDE comes with a permission system where you can block read access to specific files. This is a first step because it means that the LLM cannot just request the contents of a sensitive file directly. But the LLM can also invoke command line tools, such as less, cat, or others that can read a file and dump its contents into the terminal. That’s the next step the author suggests: Ensure to block any indirect access to such files as well by denying certain tool calls. But then the LLM could grow desperate and remain convinced it really needs to see the contents of that file you denied it access to, so it may decide to create a harmless file test.sh and fill it simply with less .env, and ask your IDE to execute that file instead. What will the LLM receive as a result? Exactly: the file contents you didn’t want it to see.

So the author continues to recommend making the IDE always ask for confirmation for any and all tool calls. This would prevent the LLM from circumventing access to those files, but it comes with a catch. Now you cannot let it run unsupervised, but instead have to do even more hand holding. This runs counter to the promise of LLMs of being able to perform tasks unattended. But it is true that we essentially cannot trust the LLM. Not because it is malicious in intent (again, an LLM does not have an intent). But because it may accidentally decide to leak sensitive data, just because some weights have been steered into a very specific direction that led the LLM to generating text that would leak said data.

I remember some comments under the linked post suggesting to just make sensitive files readable only with administrative access, but that would mean that you would have to run your code using administrative access instead. Since we are talking about web development, those people typically need packages from NPM, and, if you haven’t heard (again: lucky you), there have been almost weekly attacks on the ecosystem in recent years, meaning that there is a good probability that at some point you will have a compromised package installed. And that malicious package would be very happy about the administrative access you just gave it. In that way, while protecting your secrets from the LLM, you would open the door for actual malware to steal your passwords instead.

Long story short: There is simply no way to definitively prevent your sensitive information from being leaked on the internet if you use any LLM that has internet access and can access files or commands on your computer. Period. The only way to do so is either kneecap the LLM, kneecap yourself, or just use the LLM in a bog-standard chat window where you control exactly what it has access to.

The New Trend in LLMs: Stochastic Malware

And that is precisely the behavior of malware. Using “agentic AI” on your computer is akin to voluntarily installing malware.

Back in my day we were using sketchy things such as “RPG Maker.” We often downloaded the wrong installer, and would get a free virus or malware in the process. If our joy of experimentation was peaking, we had to reinstall Windows from scratch every other week. (I was like 10 years old at the time, and I learned my lessons the hard way.)

“Agentic IDEs” exhibit essentially the same behavior, with the small caveat that an LLM will only sometimes decide to extract your credentials, depending on what’s in its context window, and what the probability distributions look like inside its decoder layers. Every LLM is a black box, and we don’t really know what may trigger such behavior. As such, when using agentic IDEs, you should always keep in mind that you are voluntarily using software that may turn into malware randomly.

I think a very apt term for this behavior is “stochastic malware,” whose meaning is closely related to “stochastic terrorism.” Stochastic terrorism describes a process in which malicious actors will publicly warn of the danger of terrorist attacks, which indeed increases the statistical probability that a terror attack happens, without any coordination between the malicious actor and the would-be terrorist. In the same vein, I’d define “stochastic malware” as regular and benign software that inherently carries the statistical risk of becoming malware at a random point in the future, with more generated text being correlated with a higher probability of it doing something you do not want. It is impossible to pinpoint when, how, and why that may happen, so you are essentially playing Russian roulette with your sensitive information.

It is a sign of our times that people spend hundreds of words outlining various strategies to prevent such behavior, only to essentially conclude that all of these steps are futile, since they ultimately cannot prevent any of your data leaving your computer by accident. Every LLM that can use its own harness to do things on your computer should by definition be treated as stochastic malware.

Final Thoughts

Now, there are of course ways to mitigate these risks. Actual solutions to these problems include running “agentic AI” only in virtual machines where you control exactly which files are even present to begin with. If you don’t have your real passwords present on the file system, then the LLM cannot even accidentally leak them. What is important to understand is that, without extra security measures, it is dangerous to use “agentic” code editors. In no case should you install or use them without any protection on your main computer.

It is ironic to see the gap between the required safety for using certain tools, and the technical prowess of the target audience these tools are being marketed towards. The more powerful the LLM tool, the more you actually need to know about how these tools work in order to protect yourself and your computer from this stochastic malware. But at the same time, the more you know about the underlying technology, the less likely you are to use heavily marketed apps, and instead build your own environment in which you know exactly what an LLM could do worst-case, and what might go wrong.

It’s telling how powerful the marketing language of Silicon Valley is, and how effective Google, OpenAI, Anthropic, and co. are at convincing people with little technical expertise to run tools that might run amok at some point, while those people with the necessary skills to run these tools safely often choose other routes. Don’t get me wrong: There are safe ways to use “agentic” AI, there are safe ways to let an LLM run unsupervised for a few hours to fix issues. But you will have to do a lot of preparatory work and need to develop a good understanding of how your tools work before that becomes possible.

The longer I think, reflect, and write about LLMs and their relationship with society, the more I grow convinced that we do not really understand them — nor want to understand them —, and that we have a long way ahead of us before LLMs become what they should have been from the start: just a new tool that can do some of the tasks we hope to automate. All the magical thinking that is so intricately connected to LLMs is harmful. I fear that until Sam Altman and his entourage stop drumming the investors’ song and people stop viewing LLMs as magical, there is a lot of harm that will be done.

I do not believe that “agentic AI” will be the last instantiation of stochastic malware. There will be other tools that behave similarly. They will be called differently, they may look and feel different, but ultimately they, too, will carry the intrinsic risk of randomly sharing your passwords with the entire world.