VirusTotal Code Insight
Gemini-written explanations of suspicious files, on Google's VirusTotal
Overview
VirusTotal Code Insight is the generative-AI layer of Google's VirusTotal, launched at RSA 2023. It uses Gemini to explain in plain English what a submitted script, binary, package or AI agent skill does, alongside verdicts from more than 70 antivirus engines. The Community tier is free; paid tiers start with Lite at $5,000 a year.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- File scanning
- URL scanning
- Public API
- Community features
- Feed of blindspots
- Discounts based on contribution tier
- Advanced search
- YARA hunting
- File downloading
- Private API
- Private Scanning
- Full feature set
- High API quota
- Community Intelligence only
Use cases
What you can produce with VirusTotal Code Insight
- Verdicts from more than 70 antivirus engines on a file, URL, IP or domain
- A plain-English Code Insight account of what a suspicious script or binary does
- AI analysis of browser extensions, NPM and Python packages, MCP servers and AI agent skills
- A Code Insight API endpoint and IDA Pro plugin for reverse-engineering workflows
- Free Community-tier scanning plus the public API
- Advanced search, YARA hunting and private scanning on paid tiers
The best free starting point in malware triage, and Code Insight makes it better: a plain-English account of what a script, extension, package or binary does, now extended to AI agent skills. VirusTotal's own research shows it catching samples that antivirus engines missed, though its summaries still need checking by hand.
Two cautions. Uploads are shared with the security community, so never submit confidential files. And paid access was repackaged in October 2025: Lite from $5,000 a year for small non-commercial teams, with enterprises steered to Duet or Google Threat Intelligence on quote.
What we found
VirusTotal Code Insight is the generative-AI layer of VirusTotal, the Google-owned malware scanning service that began in Málaga; this page was previously listed as VirusTotal AI. VirusTotal itself checks a file, URL, IP address or domain against more than 70 antivirus engines and pools the results in a shared corpus that, by its own count, takes in more than two million samples a day. Code Insight was announced at the RSA Conference on 24 April 2023, running on Google's Sec-PaLM model and analysing a subset of PowerShell scripts. It now runs on Gemini models and writes a plain-English account of what a file does and why it looks malicious.
Coverage has grown in steps documented on VirusTotal's blog. In 2024 it took on Office macros and larger binaries; in August 2025 it added browser extensions, Python and NPM packages and MCP servers, plus an API endpoint and an IDA Pro plugin for reverse engineers. SWF and SVG files followed in September, Apple Mach-O binaries in November, and in February 2026 OpenClaw agent skill packages, analysed with Gemini 3 Flash. An October 2026 study of 35,878 skills found 18.5% malicious, most of them written as plain-language instructions with no malicious code at all.
Treat Code Insight as triage, not a verdict. VirusTotal's own posts show it catching malware that antivirus engines missed and flagging their false positives, but a model summary can still be wrong and should be checked. The other rule never changes: uploads are shared with VirusTotal's community of security vendors and researchers, so a confidential file should never be submitted to see if it is safe.
Pricing changed in October 2025. The Community tier remains free with web scanning and the public API, a Contributor tier serves engine partners, Lite starts at $5,000 a year for small, non-commercial teams, and larger organisations buy Duet or Google Threat Intelligence on quote.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
Notable facts
- VirusTotal was founded in 2004 by a Spanish cybersecurity researcher and acquired by Google in 2012 for an undisclosed sum.
- The service processes over 1 million files per day and maintains one of the world's largest malware databases with over 3 billion unique samples.
- VirusTotal's Code Insight AI feature can explain what a 200-line obfuscated PowerShell script does in 3 sentences — a task that would take a trained analyst 30 minutes.
Frequently asked questions
About this listing
This entry was compiled from publicly available data including VirusTotal Code Insight's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with VirusTotal Code Insight unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to VirusTotal Code Insight directly →
Spotted something out of date? Suggest an update →
Related reading
Cybersecurity
Unit 42 Links Fortinet Path-Traversal Bug to Memory-Only FortiGate Implant in Telecom Intr...
AI & ML
Gemini 4 Argon Launches at $2 per Million Tokens. On 1 December the Price Doubles
Cyber Threat Intel
The FBI Seized a Chinese Contractor's Hacking Tools Used Against Taiwan, Japan and the US
Alternatives to VirusTotal Code Insight
More in Security & Safety
