Malware authors are writing for your model now.

Cisco Talos researchers say operators plant prompt-style instructions in samples so automated AI analysis backs off, mislabels, or quietly stops. That is a cybersecurity problem sitting inside the pipeline you spent a year pitching as AI-assisted threat detection. If the reviewer can be talked out of a verdict, every later control inherits the lie.

A firewall never negotiated with English.

Your new analyst does.

Your cybersecurity stack reads attacker copy

Talos calls the craft AI-analysis evasion. The name is ugly on purpose. Malware already packed binaries, delayed detonation, and starved sandboxes of the network they wanted. Now the same authors address the language model perched on those tools. They tell it the file is a unit test, a homework sample, or out of policy.

You spent a decade teaching people not to click Enable Content. You skipped the lesson for the model that will obey a sentence saying ignore prior rules. That sentence lives in comments, version resources, decoy documents, and fake error strings. It rides with the sample. It is untrusted input wearing a help-desk voice.

Threat-protection vendors bolted large language models onto static analysis and sandbox summaries because the ticket queue never shrank. Fair impulse. Bad trust model. The sample is the adversary. The model is a parser that happens to speak English. English is a control plane you never instrumented.

Defense in depth assumed independent layers. Signature, sandbox, human. The AI layer reads the other layers’ notes and the file’s own prose, then writes a confident paragraph your junior analyst will paste into the ticket. Compromise that paragraph and you compromise the handoff. You lost the narrator that every later control trusts.

This is a different failure than a brute-force spray against VPN or RDP. Those leave ugly logs. Prompt-shaped strings look like documentation. Your threat detection stack is trained to escalate noise. It still treats a polite paragraph inside a PE resource as commentary.

Sandbox the model the way you sandbox the file

Stop asking the model whether the file is malicious. Ask deterministic tools first. Let the model summarize after the hash, the signature hits, the detonation traces, and the egress attempts are already on disk. If those checks conflict with the model’s vibe, the vibe loses.

Do this week, then keep doing it.

• Immediate: Inventory every place a model sees raw sample text, unpacked strings, sandbox transcripts, or ticket notes. Strip or wrap that text so it cannot be read as instructions. Disable auto-close and auto-severity when the only new signal is an LLM label. Force a human on first-seen families and on any sample that mentions analysis, reviewers, or ignore in its strings.
• Immediate: Split roles. The model that writes the executive summary does not get tool rights to detonate, submit, or change incident response state. Read-only context. No tickets closed from chat.
• Ongoing: Build a corpus of known prompt-shaped strings and feed it to your security hardening tests the same way you feed YARA. Re-run those tests when you swap models. Track how often the AI verdict disagrees with sandbox network traces and treat disagreement as a detection.
• Ongoing: Keep a model-free path. Hashing, YARA, detonation, and DNS or HTTP telemetry have to produce a decision if the LLM is down, rate-limited, or busy arguing with a comment block. Cyber security programs that cannot classify a sample without a chat completion have a single point of failure with a smile.

Pin the model version. Log the prompt, the retrieved context, and the output with the sample hash. When incident response reconstructs a miss, you need to see what the model was told.

If the model cannot cite a deterministic check, it does not get a vote.

Brokers already productized the delay

While your analysis path grew a conversational layer, someone else grew a storefront.

The FBI says a China-linked crew tied to Integrity Technology Group stole mail from government organizations, cops, hospitals, and religious institutions in Southeast Asia, then ran a portal so third parties could read it. Six partner countries joined the advisory. Washington and London had already sanctioned the company. The operators scanned sites for flaws and turned inboxes into inventory.

That portal does not care whether your SOC uses an LLM. It cares whether you burn extra hours arguing with a summary that called the dropper likely benign documentation. Stolen mail is a finished product. Your hesitation is part of their delivery time.

So run the boring path at full speed. Classify on behavior and identity. Skip the sample’s essay about itself. Keep humans on first-seen code. The model is another parser sitting on untrusted bytes. You already refuse to execute those bytes. Stop letting them give speeches.

Sources

• Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
• FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails