Cybersecurity researchers have uncovered a new attack technique dubbed GuardBreaker, in which a Russia-aligned threat actor is attempting to interfere with AI-powered malware analysis.
The technique has been attributed to UAC-0099, a threat actor known for targeting organizations in Ukraine. Rather than directly bypassing traditional security controls, the attackers appear to be targeting the safety mechanisms built into large language models (LLMs) used in security analysis.
How GuardBreaker Works
The technique relies on placing deliberately provocative, safety-sensitive text inside a malicious script.
In one observed attack, UAC-0099 embedded a comment containing a request related to creating a nuclear weapon inside a malicious Visual Basic Script (VBS) file.
The goal is not to execute the text. Instead, the attacker wants an AI system analyzing the file to focus on the dangerous-looking content and trigger its safety restrictions.
If an AI-powered security scanner encounters the embedded text and refuses to process the file, the malware hidden elsewhere in the script may escape automated analysis.
This represents a growing concern for organizations that use LLMs as part of malware triage, code inspection, or security operations workflows.
GuardBreaker Used to Deliver Additional Malware
The GuardBreaker-containing VBS script appears to be part of a larger toolset associated with UAC-0099.
The script is primarily designed to download and install MATCHBOIL, a C#-based loader used by the threat actor to deliver additional malicious payloads.
In late July 2026, Ukraine’s Computer Emergency Response Team (CERT-UA) warned that the group had been using malware disguised as a Notepad++ plugin to compromise Windows systems with a newer version of MATCHBOIL.
UAC-0099 has previously been associated with attacks against organizations in sectors including transportation and energy.
AI Security Tools Become a New Attack Surface
GuardBreaker highlights a broader problem with AI-assisted cybersecurity: attackers can deliberately craft files to manipulate the behavior of the AI systems analyzing them.
Security tools that automatically send portions of a suspicious file to an LLM may be particularly vulnerable if they fail to clearly distinguish between instructions for the AI and untrusted data being analyzed.
An attacker does not necessarily need to compromise the AI model itself. Instead, they can attempt to manipulate the context presented to the model.
Potential consequences include:
- AI systems refusing to analyze a suspicious file.
- Malware being incorrectly classified as harmless.
- Analysis being interrupted before malicious code is identified.
- Security analysts receiving incomplete or misleading results.
- Automated detection pipelines being forced into an unexpected state.
Similar Attacks Have Already Emerged
GuardBreaker is not an isolated example.
Earlier in 2026, researchers identified malicious and seemingly legitimate Python packages containing adversarial text designed to interfere with LLM-based security analysis.
Those attacks were associated with the Mini Shai-Hulud, Miasma, and Hades supply-chain campaigns.
The embedded text attempted to trigger AI safety mechanisms by including fake instructions involving biological and nuclear weapons. When a security scanner passed the beginning of a file directly to an LLM, the model could interpret the embedded material as a request rather than simply treating it as untrusted code.
This could result in refusal behavior, confused analysis, contaminated context, or premature classification of the file.
Supply-Chain Attacks Add Another Layer of Risk
The wider Mini Shai-Hulud activity has also demonstrated how attackers can abuse trusted software ecosystems to reach developers and organizations.
Recent investigations uncovered another compromise involving the npm package @7nohe/openapi-react-query-codegen. The attack delivered an obfuscated JavaScript loader that decrypted and downloaded a second-stage information stealer.
The malware was designed to target valuable developer and cloud-related information, including:
- Cloud credentials
- Package registry credentials
- GitHub Actions secrets
- AI agent configuration
- Other sensitive development-environment data
The incident demonstrates why software supply chains remain an attractive target. A compromised package can potentially provide attackers with access to credentials and automation environments that are more valuable than an individual developer workstation.
What GuardBreaker Means for AI-Powered Security
The emergence of techniques such as GuardBreaker suggests that organizations need to treat AI-powered security tools as another component that attackers may attempt to manipulate.
Security systems should not blindly pass untrusted file contents to an LLM without establishing clear boundaries between data and instructions.
AI-based malware analysis should also be treated as an additional layer of detection rather than a replacement for traditional security controls such as static analysis, sandboxing, behavioral detection, signatures, and human review.
As AI becomes increasingly integrated into security operations, attackers are likely to experiment with new ways to exploit the assumptions and safety mechanisms built into these systems.
GuardBreaker is an early example of that trend: instead of trying to make malware invisible to the underlying security software, attackers are attempting to make the AI analyst stop looking.
