arXiv:2605.03619v3 Announce Type: replace Abstract: Malware authors traditionally rely on polymorphic techniques to produce variants within a malware family, complicating detection. Generative AI enables attackers to automatically synthesize structurally diverse payloads with identical behavior, raising the question of how much evasion Large Language Models (LLMs) actually provide. Recent work has assumed that LLMs can produce highly polymorphic payloads, leaving unquantified the variation that emerges when an attacker repeatedly generates a payload, or explicitly instructs the model to avoid prior implementations. In this work, we address this gap by measuring the polymorphic capacity of a commercial model (Claude Opus~4.6) acting as an automated malware generator. We build a dual-agent, four-stage pipeline that generates, tests, and refines a data-exfiltration payload comprising file traversal, encryption, exfiltration, and integration. We produce payloads under two settings: (a) functional prompting, and (b) explicit prompting injecting a structured history of prior variants. Evaluating structural (TEDs) and semantic (embeddings) variance, we find that explicit prompting fragments the structural space, creating variants that are hard to cluster for some ML classifiers. This structural diversity is operationally cheap, costing \$0.41--\$0.73 per validated payload. However, static n-gram analysis reveals that because the LLM treats inter-module boundaries as immutable, a single static signature targeting them achieves 100\% detection across all generations. Finally, a complementary evaluation of seven local small language models (SLMs) (20M--1.5B parameters) confirms that current open-weights architectures lack the generative stability required for reliable polymorphic synthesis.