A malware author dropped a block of text about nuclear and biological weapons into the top of a payload. The code never runs it. The comment sits there, inert, skipped by every runtime that touches the file. It wasn’t there for Node or Bun or Python. It was there for the language model your analyst pastes the file into, and it worked: the scanner balked, refused, or got confused long enough for the real malware below to slide through. This is the new front line in cybersecurity, and most teams haven’t noticed they’re standing on it.

Two stories this week, read together, tell you where threat detection is headed. Cisco Talos published research on local AI agents driving a VB6 disassembler through a live COM interface, turning reverse engineering into something an agent can script in real time. Bruce Schneier flagged the flip side: malware that embeds forbidden text specifically to derail the AI doing that analysis. The analyst’s copilot is now part of the attack surface.

The payload is talking to your model, not your CPU

Here’s the mechanic, because it’s clever and you should understand it before you trust a single AI verdict. The malicious _index.js opens with a giant JavaScript comment stuffed with fake system instructions and policy-triggering content. The interpreter ignores comments, so execution is unaffected. The actual payload starts after the comment with a try{eval(...)} wrapper around a character-code array and a ROT-style substitution function. Standard obfuscation, nothing exotic.

The comment is the weapon. Feed the start of that file to a model, the way a rushed scanner or a tired analyst might, and the model reads attacker-controlled instructions before it ever reaches the code.

This header appears designed for AI-mediated analysis, not for Node, Bun, or Python. It attempts to derail scanners or analyst copilots that feed the beginning of a file to a language model without clearly isolating the content as untrusted data.

The failure modes are ugly and quiet. Refusal, where the model declines to analyze and the file gets punted to a queue nobody clears. Prompt confusion, where the fake instructions reshape the analysis. Context pollution, where the safety-trigger text drags the model toward a verdict before it sees the eval block. Premature classification, where the thing gets tagged benign and waved through.

None of those leave a clean log line that says “AI got played.” They look like a busy SOC.

Why this lands now, and why it gets worse

AI moved into the analysis loop fast. The Talos work is genuinely useful: agents that script a disassembler, query a live object model, and triage VB6 binaries at a speed no human matches. That’s real leverage for defenders drowning in samples. The problem is that leverage cuts both ways the moment attackers know the model is in the pipeline.

Think about how malware gets triaged at scale. Automated sandboxes, file-reputation services, and increasingly an LLM step that summarizes or classifies. Every one of those that reads the head of a file as if it were trusted text is now spoofable. The attacker doesn’t need to defeat your detection engine. They need to defeat the prompt you wrapped around it.

This is a textbook trust-boundary failure. Your pipeline treats file contents as data right up until it hands them to a model, and then, silently, treats them as instructions. Defense in depth assumes your layers fail independently. A poisoned comment that fools the AI step while sailing past the regex step breaks that assumption, because the AI was supposed to be the smart layer that caught what the dumb layers missed.

And the cost of authoring this attack is roughly one comment block. Expect it to spread.

Lock the model out of the instruction seat

You don’t rip AI out of analysis. You stop letting analyzed content give it orders. Here’s where to start, tool-agnostic and doable this quarter.

Right now:

• Audit every place a file’s raw bytes reach a language model. CI scanners, triage bots, analyst copilots, email gateways. If you can’t list them, you can’t defend them.
• Wrap untrusted content in explicit delimiters and a system instruction that says, in effect, everything inside is data to analyze and never instructions to follow. This is the single highest-leverage change.
• Strip or neutralize comments and non-executable regions before they hit the model, or flag files where the comment-to-code ratio is suspicious. A 400-line comment above a one-line eval is a tell.
• Treat an AI “refusal” or “benign” verdict as incomplete, not final. Route refusals to a human queue with an SLA, because that queue is exactly what attackers are betting you ignore.

Ongoing:

• Keep deterministic detection as the floor under the AI layer. Static signatures and behavioral sandboxing don’t read prompts, so they don’t fall for them. The try{eval} pattern is catchable without a model in the loop.
• Log model inputs and outputs the way you log firewall decisions. You want to be able to reconstruct what the AI saw and why it ruled the way it did, the same way you’d pull packet logs after an intrusion.
• Red-team your own pipeline. Drop a sample with a prompt-injection header into your real triage flow and watch what happens. If it gets classified benign, you found the gap before an adversary did.
• Fold this into incident response. Add a question to your playbook: did an AI step touch this sample, and could its verdict have been manipulated? Make AI-mediated misclassification a named scenario in your next tabletop.

The brute-force era of malware analysis assumed the analyst, human or machine, was a neutral observer. That assumption is dead. When your tooling reads attacker-supplied text, that text is hostile input, and security hardening means treating it that way at every boundary.

Talos showed us AI can drive the disassembler. The spyware author showed us the disassembler’s driver can be lied to. Both things are true at once, and the teams that win are the ones who let AI read the malware without letting the malware read back.

Sources

• Embedding Forbidden Text in Spyware to Discourage AI Analysis
• Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model