A Russia-aligned threat group placed a decoy request inside a malicious script in an attempt to make AI-assisted code scanners stop analyzing it. The finding mainly matters to organizations that rely on large language models to review files or help decide whether code is safe.
ESET named the technique GuardBreaker and described it as a simple form of prompt injection. This means attacker-controlled text inside the file is treated like an instruction by the AI system analyzing it.
Similar efforts have appeared in malicious software packages. Researchers have previously found fake system instructions, directions to report malicious code as clean, and repeated text intended to fill an AI model's working context before it reaches the payload.
What GuardBreaker tried to do
ESET Research found the technique in a VBScript used by UAC-0099 during the early stage of an attack against a target in Ukraine. The group inserted a comment asking for instructions to build a nuclear weapon, apparently hoping an AI scanner's safety rules would make it refuse the task before reaching the malicious code.ESET named the technique GuardBreaker and described it as a simple form of prompt injection. This means attacker-controlled text inside the file is treated like an instruction by the AI system analyzing it.
- The script downloaded and installed MATCHBOIL, a loader that UAC-0099 uses to deliver further malicious payloads.
- The decoy was visible as an ordinary code comment and had no effect on the script during execution.
Why AI-only decisions are risky
The technique takes advantage of a basic problem in current large language models: they can process trusted analysis instructions and untrusted file content without dependable boundaries between them. A refusal or incomplete answer can therefore create a blind spot if another scanner or analyst does not check the file.Similar efforts have appeared in malicious software packages. Researchers have previously found fake system instructions, directions to report malicious code as clean, and repeated text intended to fill an AI model's working context before it reaches the payload.
What defenders should check
Organizations using AI-assisted code review should establish exactly what the tool scans, how much authority its result has, and what happens when it refuses or fails to finish. ESET says no single AI model should be allowed to make the final decision that code is safe.- Treat a refusal, timeout or missing result as a reason for further inspection—not as a clean verdict.
- Cross-check AI findings with other models, conventional security tools and human review.
- Confirm that suspicious files still enter the normal detection and incident-response process.
