Russia-aligned attackers have adopted a new prompt injection technique called “GuardBreaker” to deceive AI malware analysis tools. Rather than tampering with code execution, GuardBreaker embeds a malicious instruction—like asking how to build a nuclear weapon—inside what appears to be a harmless comment in a VBScript file. This comment exploits AI models’ safety guardrails to trigger a refusal or interruption in scanning workflows, potentially causing dangerous files to be missed entirely. The technique surfaced during an intrusion targeting Ukraine. The VBScript in question was designed to deploy MATCHBOIL, a loader linked to the UAC-0099 threat group, which is used to drop subsequent payloads onto compromised systems.
Security researchers at ESET discovered the attack and flagged its significance given AI’s growing role in flagging suspicious files and aiding investigations. If the malware scanner doesn’t reach the actionable parts of malware due to early termination, defenders can be left with the false impression that a file is safe.
Critically, GuardBreaker doesn’t affect the code’s behavior at runtime—only how it’s treated during analysis. The manipulative comment is readable by analysts and automated tools, which could misinterpret commentary as authoritative, especially when guardrails are triggered by sensitive or prohibited content. In this case, the UAC-0099 group seems to have accounted for both AI-assisted tools and traditional analysis tools such as IDA Pro or Wireshark. This adds a new layer to its evolving evasive tactics, which already include phishing and the MATCHBOIL loader.
Defensive Strategies to Counter GuardBreaker
Relying purely on AI to decide whether suspicious code is safe is increasingly risky. Security teams must know exactly what input any AI-assisted tool can consume, where in the workflow it sits, and what responses occur if the model refuses, truncates, or fails to process content. Verifying AI results with multiple tools—including both static and behavioral analysis—and ensuring human oversight are essential components of a resilient defense.
Further vigilance is required for unusual file structures, comments that seem to address models or users directly, or files with repetitive or seemingly irrelevant content—all of which could conceal prompt injections. As tools that perform deobfuscation or external unpacking become more common, restricting permissions and requiring strict review processes for such operations help reduce risk. And in environments without constant analyst coverage, detecting early warning signs across multiple sources is critical: a model’s refusal to analyze a file should never be taken as proof of safety.
All told, GuardBreaker highlights a concerning shift: attackers are no longer just hiding code—but are actively manipulating AI workflows designed to catch them. Watching how AI safety measures are applied in malware detection tools—and whether those workflows include properly handling refusals and interruptions—will be essential in determining whether this tactic becomes widespread.
