Ai can definately write code. Just not without some level of supervision. Take for example, its possibly to develop a basic game using chat gpt to code modules for the game, while the "programmer" is in charge of interconnecting and telling chatgpt to make some revisons after they reach some problem. Code generation isnt outright autonomous as of the moment.
As for malware, yeah you would probably need a trained database on actual malware code to get gpt to a level on generating (really, its probably going to replicate) malware code, but the problem is that if malware codebase is public, there are already likely security patches for said exploits.