- The Mess: A Russia-aligned threat actor embedded a fake request about building a nuclear weapon inside malware — not to execute it, but to distract or derail AI systems analyzing the malicious code.
ESET calls the technique GuardBreaker.
The text was placed inside a malicious VBS script as a comment, meaning it had no role in executing the malware itself. Its apparent purpose was to trigger an AI model’s safety mechanisms and prevent the system from properly analyzing the rest of the file.
The script was linked to UAC-0099 and designed to download MATCHBOIL, a loader previously associated with the group.
- The Damage: This attack doesn’t target the victim’s computer first. It targets the security analyst — or increasingly, the AI helping the analyst.
An AI-first malware analysis pipeline could potentially see the sensitive text, trigger a refusal or safety response, and fail to properly examine the malicious code surrounding it.
That’s the new attack surface.
The malware isn’t just hiding from antivirus signatures.
It’s trying to manipulate the system reading it.
There is an important limitation: public reporting does not identify a specific AI model or security product successfully bypassed by this technique. The evidence currently supports the attacker’s intent to interfere with AI-assisted analysis, not a proven universal bypass.
- The Fix: Treat malware samples as untrusted data, isolate their content from AI instructions and never interpret an AI refusal as a clean verdict.
If an automated analysis system refuses to process a file, that should trigger escalation.
Not approval.
AI-assisted security tools should also combine model analysis with static detection, sandboxing, behavioral analysis and human review.
Bugstoday’s Opinion
For years, malware authors tried to fool the computer analyzing their code.
Now they’re trying to fool the AI analyzing the computer.
That’s a different game.
An LLM can be incredibly useful for triage.
But once the malware knows that an AI is reading it, the malware can start writing for the AI.
The dangerous mistake is treating an AI refusal as the end of an investigation.
Sometimes the sample isn’t safe.
Sometimes it just learned how to make your analyst look away.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- ESET Research — GuardBreaker research
- CERT-UA reporting on UAC-0099 activity
- Help Net Security
- The Hacker News
