Malicious programs, commonly called malware, have had a pervasive presence in the world for nearly forty years and have continued to evolve and multiply exponentially. On the other hand, there are multiple research works focused on malware detection with different strategies that seem to work only temporarily, as new attack tactics and techniques quickly emerge. There are increasing proposals to analyze the problem from the attacker’s perspective, as suggested by MITRE ATT&CK. This article presents a proposal that utilizes Large Language Models (LLMs) to generate malware and understand its generation from the perspective of a red team. It demonstrates how to create malware using current models that incorporate censorship, and a specialized model is trained (fine-tuned) to generate code, enabling it to learn how to create malware. Both scenarios are evaluated using the $pass@k$ metric and a controlled execution environment (malware lab) to prevent its spread.

While data scarcity is often cited as a major challenge in machine learning, the opposite problem—having too much data or an unlimited stream of incoming data—is equally relevant. In such cases, a key question arises: which examples are the most useful for training a model while avoiding excessive computational cost? This work addresses the problem by proposing a strategy to automatically select useful examples while preserving model effectiveness and training efficiency. We propose and evaluate a new strategy—Adding Only Errors (AOE)—to avoid using the full training set for classifier training. Our results show that when the training-validation split is properly sampled, the size of the training set can be reduced by more than three orders of magnitude without compromising performance. Although this reduction may initially incur higher computational costs, in real-world scenarios involving continuous streams of labeled data requiring frequent model retraining, AOE amortizes this cost by significantly decreasing dataset size.