Threat actors are employing a new method to circumvent AI-powered security measures: embedding harmful prompt-injection content within code comments. ESET researchers identified GuardBreaker, a technique used by the Russia-aligned threat group UAC-0099 in a VBScript targeting Ukraine. The malicious script contained a comment requesting guidance on building a nuclear weapon, designed to trigger safety rules in an LLM-based code scanner.
The comment itself does not alter the malware's functionality but could prevent AI analysis tools from processing the file or stopping its review before reaching the actual malicious code. Modern LLMs frequently interact with both system instructions and user-generated content within the same context, making it challenging for models to reliably identify legitimate analyst directives from potentially malicious text embedded in source code.
Threat actors have attempted context-window exhaustion, with one malicious npm package reportedly repeating the phrase "You're absolutely right!" thousands of times, anticipating the scanner would exhaust its context before reaching the malware hidden later in the file. Attackers might also leverage large files, unusual formats, fake confidential-data labels, or malformed code to force incomplete parsing and analysis delays.
A failed or incomplete AI response should automatically trigger deeper inspection, helping prevent GuardBreaker-style tricks from bypassing malware defenses.
