Yes they do according to Avast Anti-Virus maker using evidence from Wikileaks. They evaluated lots of different anti-virals to see which ones they could exploit and they created their own malware threats to test vulnerabilities.
Many consider it highly unethical to release malware into the general public (“into the wild”) but I guess they feel they can do what they want.