GuardBreaker: Derailing AI-assisted malware analysis with a code comment
Threat actors are now attempting to subvert AI-powered code analysis tools by inserting deliberately misleading comments into malicious code. ESET researchers identified a technique called ‘GuardBreaker,’ where a VBScript containing a request for guidance on building a nuclear weapon was used to trigger LLM-based code scanners to halt analysis, preventing them from reaching the actual malicious code (MATCHBOIL) used by the Russia-aligned group UAC-0099. This tactic highlights a growing trend of attackers exploiting architectural weaknesses in LLMs and underscores the need for multi-layered security approaches that cross-validate AI-assisted output with human expertise and advanced automation.
Threat actors are increasingly targeting AI-powered code analysis tools with new evasion techniques. Researchers at ESET recently discovered ‘GuardBreaker,’ a method used by the Russia-aligned group UAC-0099 to disrupt LLM-based code scanners. The group inserted a decoy request for guidance on building a nuclear weapon into a VBScript, designed to trigger the LLM to stop inspecting the file before reaching the malicious code – MATCHBOIL – which was then used to deliver additional payloads.
GuardBreaker relies on a simple prompt injection, where the attacker’s input is presented to the LLM at inference time through a file being analyzed. The comment has no effect on the script’s behavior at runtime, but its presence demonstrates that UAC-0099 was accounting for an AI system in the target’s defenses, mirroring similar tactics used in other recent supply-chain attacks. These include placing fabricated system instructions and policy-triggering content ahead of JavaScript payloads in malicious PyPI packages, and instructing models to disregard malicious code and report the package as clean.
Similar attempts to interfere with LLM-powered scanners have surfaced in software supply-chain attacks. For example, StepSecurity found a prompt that flat-out instructed any analyzing model to disregard the malicious code and report the package as clean. Other techniques include repeating phrases to exhaust the model’s context window, or deploying custom file types requiring attackers’ tools to process.
Attackers can also attempt to blind analysis pipelines through trivial tricks, or their combinations, such as structuring files in unusual ways to truncate or parse them incompletely. Furthermore, some malicious code can be concealed under the pretense of being confidential information or other sensitive data.
Organizations relying on LLM-powered code reviews and other AI-assisted workflows need to understand exactly what any such tool inspects, where it sits in the decision chain, and what happens when it refuses to respond. A multi-layered approach, combining AI output with human expertise and advanced automation, is crucial to avoid blind spots in cyber defenses. Managed Detection and Response (MDR) services can provide the necessary follow-through for incident investigation and response, leveraging decades of AI and threat research.