--- title: Moving target defense url: https://ftrlg.com/en/wiki/moving-target-defense/ lang: en published: 2026-10-23 version: 1 summary: Defence that does not close every hole but keeps moving them, so the attacker's map goes out of date before it can be used. AI speeds up both sides. cite_as: "future.log, «Moving target defense», https://ftrlg.com/en/wiki/moving-target-defense/" license: CC BY 4.0 https://creativecommons.org/licenses/by/4.0/ --- # Moving target defense **Moving target defense** (MTD), sometimes figuratively called “liquid code”, is an approach to protecting computer systems in which the system constantly and unpredictably changes whatever the attacker relies on: memory addresses, network addresses, the names of fields on a web page, the machine code itself. The goal is not to close every vulnerability but to make the attacker's reconnaissance go out of date before they get to use it. The idea appeared in the early 1990s; in 2011 the US government named it one of the “game-changing” research areas,[^1] and its most widespread form, memory address randomization, has long been at work in ordinary operating systems: Microsoft, for example, announced in 2006 that it was on by default in Windows Vista.[^5] With the arrival of AI, attackers' code has become “fluid” as well: the first malware, still mostly experimental, has appeared that asks a language model to write code for it while running, and defenders answer with AI that finds and patches vulnerabilities on its own.[^2][^20] ## History - **10.1993** Fred Cohen proposes protecting operating systems through program evolution: code that keeps changing its form while doing the same thing is harder to attack automatically.[^3] - **05.05.1997** Stephanie Forrest, Anil Somayaji and David Ackley write that diversity is “an important source of robustness in biological systems”, while computers “are notable for their lack of diversity”, and propose making every copy of a program slightly different.[^4] - **26.05.2006** Microsoft announces that address space layout randomization (ASLR) is on by default in Windows Vista: a library is loaded into one of 256 locations, and an attacker guesses the address with a probability of 1/256.[^5] - **2011** The collection “Moving Target Defense” comes out, edited by Sushil Jajodia and co-authors.[^6] - **12.2011** The US federal cybersecurity research plan names the moving target one of four “game-changing” themes: systems must become “less deterministic, less homogeneous, and less static” in order to “substantially increase the cost of attacks”.[^1] - **21.01.2014** The startup Shape Security comes out of stealth with ShapeShifter, an appliance that rewrites a web page's code every time it is served, producing “an unending stream of randomized code variations” and breaking bots that look for fields by name.[^7] - **30.03.2014** Linux 3.14 adds randomization of the kernel's own addresses (KASLR).[^8] - **03.11.2014** The first ACM academic workshop on moving target defense takes place in Scottsdale.[^9] - **19.12.2019** F5 announces that it will buy Shape Security for about $1 billion.[^10] - **19.03.2025** Cloudflare launches AI Labyrinth: instead of blocking a crawler that breaks a site's rules, it feeds the crawler a maze of plausible AI-written pages.[^11] - **05.11.2025** Google describes the PROMPTFLUX malware, one variant of which asks the Gemini model every hour to rewrite its entire source code so that antivirus software will not recognise it.[^2] ## How it works All kinds of moving target defense rest on one observation: an attack almost always begins with reconnaissance, and reconnaissance assumes that the system will be the same tomorrow as it is today. What changes is whatever the attacker studies. **Memory.** On every launch a program and its libraries end up at new addresses (ASLR in Windows, Linux, macOS, OpenBSD); research systems such as Shuffler reshuffle the code of a program that is already running every few tens of milliseconds.[^5][^12] The Israeli company Morphisec sells the same idea for workstations; in 2018 the US Department of Homeland Security gave it $200,000 for a version for virtual desktops.[^13] **Network.** Computers regularly change their addresses in such a way that legitimate parties stay connected, while the attacker's scanner sees a different picture each time (MT6D, 2011; OpenFlow Random Host Mutation, 2012).[^14][^15] **Web page.** Field names, markup structure and protective scripts change on every load, so that a bot filling in a form by rote misses: Shape Security (part of F5 since 2020), and Kasada, which writes that its scripts “constantly morph with a different obfuscation each time they load”.[^7][^16] A related trick is a trap in which the page itself is endless: AI Labyrinth and Nepenthes lead a crawler into a maze of generated pages.[^11][^17] **Attacker's code.** Malware has long changed its appearance so that antivirus software will not recognise it; when Shape Security launched, its product was described outright as carrying this trick over to the defender's side.[^7] With language models, rewriting has become cheap. The BlackMamba sample (HYAS, 2023) fetched its code afresh from an [OpenAI](https://ftrlg.com/en/models/openai/) model on every launch; LAMEHUG, attributed to the APT28 group, stores no commands at all: it asks the Qwen model to compose them from a description.[^18][^19] **Defender's code.** The flip side of the same cheapness: AI systems look for vulnerabilities and write the fixes themselves. In the final of the DARPA AIxCC competition such systems worked through more than 54 million lines of code, and CodeMender from [Google DeepMind](https://ftrlg.com/en/models/google-deepmind/) sent 72 fixes to open-source projects in six months, sometimes rewriting whole sections of code rather than just patching them.[^20][^21] Bruce Schneier and his co-authors call this “continuous discovery/continuous repair (CD/CR)”.[^22] ## Data **What it costs attack and defence** | Who and when | What they looked at | What they found | |---|---|---| | Shacham et al., 10.2004[^23] | Whether memory randomization on a 32-bit system can be beaten by brute force | The Apache web server protected by PaX is broken in 216 seconds on average. | | Okhravi et al. (MIT Lincoln Laboratory), 03.2014[^24] | Weak points of randomization | No technique survives a leak of an arbitrary region of memory; 16 bits of randomness on an automatically restarted server are guessed within minutes. | | Williams-King et al. (Columbia University), 2016[^12] | What on-the-fly code randomization costs | With reshuffling every 50 ms, the program runs 14.9% slower. | **What AI does to the moving target** | Who and when | What they looked at | What they found | |---|---|---| | Unit 42 (Palo Alto Networks), 20.12.2024[^25] | Whether a language model can rewrite malicious JavaScript so that a neural-network detector does not recognise it | In 88% of cases the detector began to treat the code as safe. Retraining the detector on 10,000 such variants improved detection of new samples by 10%. | | Hortea et al., 05.2026[^26] | How diverse the malicious code written by AI models is | A variant costs $0.41–0.73, but the model leaves the boundaries between modules untouched, and a single signature catches every variant. | | Nogueira et al., 07.2026[^27] | Whether the bugs in several AI-written versions of a program are independent | No: three to five versions give less than half the reliability gain there would be with independent bugs, and versions from a single model give less than a third. | | DARPA AIxCC, 08.08.2025[^20] | Whether AI systems can find and fix vulnerabilities on their own | Across the 63 challenges of the final, 54 planted vulnerabilities were found and 43 fixed; along the way, 18 real ones that nobody had planted were found. | > **[EDITORIAL CONCLUSION]** Moving target defense raises the cost of an attack but does not make it impossible: memory randomization is brute-forced within minutes if there is too little randomness (Shacham, Okhravi), and constant motion costs the defender speed (Williams-King). AI has made “fluidity” cheaper for both sides, but so far only on the surface: model-rewritten code fools a neural-network detector (Unit 42) yet is caught by one precise signature (Hortea), and AI-written versions of the same program fail in the same way (Nogueira), so AI does not yet deliver real diversity. The most measurable shift is on the defence side: systems that find and fix vulnerabilities on their own (AIxCC). ## Incidents ### LAMEHUG: malware asks a model for its commands, July 2025 Ukraine's computer emergency response team, CERT-UA, reported an email campaign targeting bodies in the security and defence sector: the attachment was a program that, following a predefined description, asked the Qwen 2.5-Coder language model via the Hugging Face service to generate commands, and then ran them. CERT-UA linked the attack to the APT28 group with moderate confidence.[^19] In November, Google called this family (PROMPTSTEAL in its naming) the first case it had observed of malware querying a language model in a real operation.[^2] ### PromptLock: the “first known AI-powered ransomware” turned out to be research, August 2025 ESET reported the discovery of the “first known AI-powered ransomware”: the program generated malicious scripts on its own using the open gpt-oss-20b model, although it had not been seen in attacks.[^28] It soon emerged that the samples found on VirusTotal were a prototype by researchers at NYU Tandon School of Engineering: ESET updated its article on 3 September, and the university described the work on 17 September.[^29] ### Bots learned to get past Anubis, August 2025 The code hosting service Codeberg, protected from AI scrapers by Anubis (software that makes the browser solve a computational puzzle), reported: “It seems like the AI crawlers learned how to solve the Anubis challenges.”[^30] The researcher Tavis Ormandy calculated that such a puzzle costs a scraper almost nothing: access to every site behind Anubis for a week comes to “approximately $0”.[^31] ## Criticism The limits of the approach became visible early: in 2004 Shacham and his co-authors concluded that “on 32-bit architectures, the only benefit of PaX-like address-space randomization is a small slowdown in worm propagation speed”.[^23] The authors of the 2011 US federal plan admitted the main contradiction themselves: complexity is commonly thought to add risk to a system, and “The challenge is to demonstrate that complexity is indeed a benefit and not a liability.”[^1] This site faced the same question. In the prototype of the future.log comment form, every opening produced new random field names and shuffled decoy fields. In the review before launch they were dropped: when a newcomer's first comments are checked by the editors and trust is tied to the author's permanent signature (a tripcode), random names added almost nothing to protection. What remained was a one-time signed token, one honeypot field and rate limits.[^35] The researcher Marcus Hutchins called the noise around PROMPTFLUX overblown: the code has no mechanism to guarantee that a new version differs from the previous one and still works, and the rewriting function itself was commented out.[^32] Google itself wrote that the program is not yet able to infect a victim's network.[^2] ⧗ ## Development Moving target defense is shifting in two directions. Bot protection is adding signature checks to obfuscation: as [AI agent](https://ftrlg.com/en/wiki/autonomous-ai-agents/) traffic grows, Cloudflare writes that “what's considered a bot is no longer clear-cut” and proposes that honest bots sign their requests cryptographically, so that websites do not have to recognise them from traits that are easy to fake.[^33] And the “motion” of defence is becoming the speed of fixes: in May 2026 Google reported that for the first time it had found a zero-day exploit that, by its assessment, had been created with the help of AI, and had caught it before a mass attack.[^34] > **[EDITORIAL CONCLUSION]** Originally, moving target defense meant “shuffle so the enemy can't find it”. In the AI era it increasingly means “rewrite faster than the enemy can find it”: both sides use models to change code, and whoever has the shorter cycle wins. Shuffling still works against cheap mass automation, but against an attacker who reads a system the way a human does, what matters most is not the form of the code but the speed at which it is fixed. ## Signals - 2025-10-10 — Bruce Schneier: «We have long taken it for granted that we have time to patch systems after vulnerabilities become known … This is no longer the case. … these developments threaten to tip the scales completely. We’re potentially looking at a singularity event for cyber attackers» — cryptographer, in an essay written with Heather Adkins (Google) and Gadi Evron; they see the defence's answer in AI-driven “continuous discovery/continuous repair” of vulnerabilities (https://ftrlg.com/en/signals/cydmuidxd/) - 2025-08-08 — Stephen Winchell: «Finding vulnerabilities and patching codebases using current methods is slow, expensive, and depends on a limited workforce – especially as adversaries use AI to amplify their exploits. AIxCC-developed technology will give defenders a much-needed edge in identifying and patching vulnerabilities at speed and scale» — DARPA director, in the press release on the results of the AIxCC competition, in which AI systems found and fixed vulnerabilities on their own; four of the seven finalist systems have been released as open source (https://ftrlg.com/en/signals/cmnxgsk24/) ## See also Proof-of-work shields · [Behavioral biometrics](https://ftrlg.com/en/wiki/behavioral-biometrics/) · [Death of CAPTCHA](https://ftrlg.com/en/wiki/death-of-captcha/) · [Dead internet theory](https://ftrlg.com/en/wiki/dead-internet-theory/) · [Autonomous AI agents](https://ftrlg.com/en/wiki/autonomous-ai-agents/) · [AI safety](https://ftrlg.com/en/wiki/ai-safety/) · [Open source](https://ftrlg.com/en/wiki/open-source/) ## References [^1]: Trustworthy Cyberspace: Strategic Plan for the Federal Cybersecurity Research and Development Program — National Science and Technology Council, Executive Office of the President, 12.2011. [nitrd.gov](https://www.nitrd.gov/pubs/Fed_Cybersecurity_RD_Strategic_Plan_2011.pdf) [^2]: GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools — Google Threat Intelligence Group, 05.11.2025. [cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools) [^3]: F. B. Cohen. Operating system protection through program evolution — Computers & Security, vol. 12, no. 6, 10.1993. [doi.org](https://doi.org/10.1016/0167-4048(93)90054-9) [^4]: S. Forrest, A. Somayaji, D. H. Ackley. Building diverse computer systems — HotOS-VI, IEEE, 05.05.1997. [doi.org](https://doi.org/10.1109/HOTOS.1997.595185) [^5]: M. Howard. Address Space Layout Randomization in Windows Vista — Microsoft, 26.05.2006. [learn.microsoft.com](https://learn.microsoft.com/en-us/archive/blogs/michael_howard/address-space-layout-randomization-in-windows-vista) [^6]: S. Jajodia, A. K. Ghosh, V. Swarup, C. Wang, X. S. Wang (eds.). Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats — Springer, 2011. [doi.org](https://doi.org/10.1007/978-1-4614-0977-9) [^7]: J. Casaretto. Shape Security emerges from stealth, looking to change website security forever — SiliconANGLE, 21.01.2014. [siliconangle.com](https://siliconangle.com/2014/01/21/shape-security-emerges-from-stealth-looking-to-change-website-security-forever/) [^8]: Linux 3.14 — Kernel Newbies, 30.03.2014. [kernelnewbies.org](https://kernelnewbies.org/Linux_3.14) [^9]: First ACM Workshop on Moving Target Defense (MTD 2014) — George Mason University, 03.11.2014. [csis.gmu.edu](https://csis.gmu.edu/MTD2014/) [^10]: F5 to Acquire Shape Security, Transforming Application Security — F5 Networks (exhibit to a Form 8-K filed with the SEC), 19.12.2019. [sec.gov](https://www.sec.gov/Archives/edgar/data/1048695/000104869519000036/pressrelease12192019.htm) [^11]: R. Tatoris. Trapping misbehaving bots in an AI Labyrinth — Cloudflare, 19.03.2025. [blog.cloudflare.com](https://blog.cloudflare.com/ai-labyrinth/) [^12]: D. Williams-King et al. Shuffler: Fast and Deployable Continuous Code Re-Randomization — OSDI, USENIX, 2016. [cs.columbia.edu](https://www.cs.columbia.edu/~junfeng/papers/shuffler/) [^13]: News Release: Israeli Morphisec Gets $200K for Cybersecurity Tech — U.S. Department of Homeland Security, 02.10.2018. [dhs.gov](https://www.dhs.gov/science-and-technology/news/2018/10/02/news-release-israeli-morphisec-gets-200k-cybersecurity-tech) [^14]: M. Dunlop, S. Groat, W. Urbanski, R. Marchany, J. Tront. MT6D: A Moving Target IPv6 Defense — MILCOM, IEEE, 11.2011. [doi.org](https://doi.org/10.1109/MILCOM.2011.6127486) [^15]: J. H. Jafarian, E. Al-Shaer, Q. Duan. OpenFlow random host mutation: transparent moving target defense using software defined networking — HotSDN, ACM, 13.08.2012. [doi.org](https://doi.org/10.1145/2342441.2342467) [^16]: JavaScript Deobfuscation: Hiding Intent to Fortify Bot Defenses — Kasada, 12.03.2021. [kasada.io](https://www.kasada.io/blog/javascript-deobsfusction-bot-defenses) [^17]: J. Koebler. Developer Creates Infinite Maze That Traps AI Training Bots — 404 Media, 23.01.2025. [404media.co](https://www.404media.co/developer-creates-infinite-maze-to-trap-ai-crawlers-in/) [^18]: J. Sims. BlackMamba: Using AI to Generate Polymorphic Malware — HYAS Labs, 07.03.2023 (archived copy). [web.archive.org](http://web.archive.org/web/20230327012801/https://www.hyas.com/blog/blackmamba-using-ai-to-generate-polymorphic-malware) [^19]: [Cyberattacks by UAC-0001 on the security and defence sector using LAMEHUG, a software tool that uses an LLM] (CERT-UA#16039), in Ukrainian — CERT-UA, 17.07.2025. [cert.gov.ua](https://cert.gov.ua/article/6284730) [^20]: AI Cyber Challenge marks pivotal inflection point for cyber defense — DARPA, 08.08.2025. [darpa.mil](https://www.darpa.mil/news/2025/aixcc-results) [^21]: R. A. Popa, F. Flynn. Introducing CodeMender: an AI agent for code security — Google DeepMind, 06.10.2025. [deepmind.google](https://deepmind.google/discover/blog/introducing-codemender-an-ai-agent-for-code-security/) [^22]: H. Adkins, G. Evron, B. Schneier. Autonomous AI Hacking and the Future of Cybersecurity — Schneier on Security (reprinted from CSO), 10.10.2025. [schneier.com](https://www.schneier.com/blog/archives/2025/10/autonomous-ai-hacking-and-the-future-of-cybersecurity.html) [^23]: H. Shacham et al. On the Effectiveness of Address-Space Randomization — ACM CCS, 10.2004. [hovav.net](https://hovav.net/ucsd/papers/sppgmb04.html) [^24]: H. Okhravi, T. Hobson, D. Bigelow, W. Streilein. Finding Focus in the Blur of Moving-Target Techniques — IEEE Security & Privacy, 03.2014. [ll.mit.edu](https://www.ll.mit.edu/sites/default/files/publication/doc/2018-04/2014_04_15_OkhraviH_IEEES%26amp%3BP_FP.pdf) [^25]: Now You See Me, Now You Don’t: Using LLMs to Obfuscate Malicious JavaScript — Unit 42, Palo Alto Networks, 20.12.2024. [unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/using-llms-obfuscate-malicious-javascript/) [^26]: Hortea, Varlese, Romano, Tapiador. The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code — arXiv, 05.05.2026. [arxiv.org](https://arxiv.org/abs/2605.03619) [^27]: Nogueira, Pattabiraman, Vieira, Campos. A Systematic Methodology for Evaluating Failure Independence in LLM-Generated Code — arXiv, 02.07.2026. [arxiv.org](https://arxiv.org/abs/2607.02808) [^28]: A. Cherepanov, P. Strýček. First known AI-powered ransomware uncovered by ESET Research — ESET, 26.08.2025. [welivesecurity.com](https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/) [^29]: AI-Powered Ransomware That Sparked Concern Was NYU's Work — NYU Tandon School of Engineering, 17.09.2025. [engineering.nyu.edu](https://engineering.nyu.edu/news/ai-powered-ransomware-sparked-concern-was-nyus-work) [^30]: T. Claburn. Codeberg beset by AI bots that now bypass Anubis tarpit — The Register, 15.08.2025. [theregister.com](https://www.theregister.com/2025/08/15/codeberg_beset_by_ai_bots/) [^31]: T. Ormandy. Anubis. — lock.cmpxchg8b.com, 2025. [lock.cmpxchg8b.com](https://lock.cmpxchg8b.com/anubis.html) [^32]: R. Lakshmanan. Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly — The Hacker News, 05.11.2025. [thehackernews.com](https://thehackernews.com/2025/11/google-uncovers-promptflux-malware-that.html) ⧗ [^33]: T. Meunier, M. Galicer. Forget IPs: using cryptography to verify bot and agent traffic — Cloudflare, 15.05.2025. [blog.cloudflare.com](https://blog.cloudflare.com/web-bot-auth/) [^34]: GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access — Google Threat Intelligence Group, 11.05.2026. [cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access) [^35]: future.log decision log, decisions No. 23 (10.10.2026) and No. 108 (12.10.2026) — future.log editorial team; internal document. — future.log, «Moving target defense», https://ftrlg.com/en/wiki/moving-target-defense/ · CC BY 4.0