Executive Summary
The x47.c Windows botnet uses xAI's Grok to choose from predefined actions to maintain persistence, and drains AI API access.
What Happened
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining appeared first on SecurityWeek .
Affected Products
- xAI Grok
- Windows
Vulnerability / Attack Technique
Malware using an LLM API to decide actions; AI API abuse
Technical Mechanism
The malware queries Grok to pick its next action from a fixed list, keeping itself running, while consuming AI API resources.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
Malware is outsourcing decisions to commercial LLM APIs. RealGround analysis: traffic to AI APIs from unexpected hosts is now a detection signal.
Recommended Controls
- Alert on AI API traffic from hosts that should not use AI services
- Monitor AI API keys for unexpected usage
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
securityweek.com: https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.