Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners

ESET linked UAC-0099 to a technique named GuardBreaker that embeds weapon- or safety-related instructions inside comments of a malicious VBScript to trigger refusals or truncated analyses from LLM-powered scanners; the script later fetched MATCHBOIL, a known loader used by the group. The report warns defenders to treat comments and metadata as untrusted input, maintain strict boundaries between model prompts and sample content, and correlate AI-assisted outputs with deterministic signals like signatures, sandbox telemetry, and analyst review.