Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners

Threat actors are adapting malware not only for conventional endpoint defenses and sandboxes, but also for large language model-powered tools increasingly used to triage suspicious code.

ESET researchers linked the activity to Russia-aligned threat actor UAC-0099, which used the method during an attack against an organization in Ukraine.

The group inserted a safety-sensitive, weapon-related request into a comment inside a malicious VBScript file.

Since comments are ignored during normal script execution, the text did not alter the malware’s runtime behavior.

Its intended target was the analysis layer: an LLM that may interpret the embedded text as an instruction rather than inert, attacker-controlled content.

The apparent objective was to trigger a model refusal or otherwise derail the scanner before it inspected the code that followed.

The VBScript was designed to download and install MATCHBOIL, a C#-based loader associated with UAC-0099 that can retrieve follow-on payloads.

Public reporting does not identify a specific affected LLM product, nor does it establish a measured success rate for the technique; the evidence shows the adversarial comment and ESET’s assessment of its intended purpose.

GuardBreaker illustrates a form of indirect prompt injection. In this scenario, the attacker does not send a malicious prompt directly to an AI assistant.

Instead, the hostile instruction is embedded in a file, package, comment, string, or metadata field that an automated security workflow later feeds into an LLM.

The attack exploits a fundamental design challenge in many LLM applications: instructions and untrusted data are handled in the same language-processing context, without a dependable security boundary between them.

OWASP warns that external material, including code comments and documentation, must be treated as untrusted content, sanitized before analysis, and clearly separated from system instructions.

The practical risk is not that a code comment compromises an endpoint by itself. Rather, it can influence the AI component of a detection pipeline.

If a scanner treats an LLM refusal, truncated response, or incomplete analysis as a benign verdict, attackers may gain a blind spot without having to defeat signatures, behavioral detection, or sandbox execution.

ESET Researchers have identified a technique called GuardBreaker, that attempts to exploit AI safety guardrails and prevent an LLM-assisted scanner from reaching the malicious portion of a file.

AI Safety Guardrails

UAC-0099 has a history of targeting Ukrainian government, defense, transportation, and energy-related entities using phishing-led delivery chains.

CERT-UA and other researchers have previously documented the group’s use of MATCHBOIL, MATCHWOK, and DRAGSTARE malware families.

MATCHBOIL can profile infected hosts and retrieve additional components from command-and-control infrastructure.

The GuardBreaker discovery aligns with similar techniques observed in malicious open-source packages.

Researchers have found PyPI and npm packages containing fabricated “system” instructions, text telling AI models to classify the package as clean, and excessive repeated strings intended to consume a model’s context window before it reaches the payload.

This creates several opportunities for adversaries. Malicious code can be placed after a large volume of filler text, hidden inside comments described as confidential data, or stored in unusual file formats that automated workflows parse only partially.

AI agents that can invoke unpackers, deobfuscators, repositories, or external tools also introduce additional risk if prompt-injected content can steer those actions.

Organizations should avoid assigning a single LLM the authority to declare a sample safe.

Security teams should correlate AI-assisted analysis with static signatures, sandbox telemetry, EDR signals, reputation data, detonation results, and analyst review.

An LLM can assist analysts by explaining code, clustering artifacts, or prioritizing suspicious behavior, but it should not replace deterministic inspection and human validation.

A resilient workflow should classify every scanned artifact including comments, strings, filenames, package metadata, and embedded documents as untrusted input.

It should preserve strict boundaries between model instructions and sample content, detect encoding and context-flooding attempts, and route incomplete or refused analyses for further inspection.

OWASP specifically recommends structured prompts, input sanitization, output monitoring, least-privilege tool access, and logging of LLM interactions and agent behavior. Most importantly, a refusal is not a clean verdict.

GuardBreaker demonstrates that as defenders add AI to malware-analysis pipelines, attackers will increasingly treat the model itself and its safety controls as another surface to evade.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.