Recommended Free Tools
GuardBreaker is an observed prompt-injection attempt in which a malicious VBScript carried a decoy request in a comment, hoping to trigger an AI scanner’s safety refusal before it reached the harmful code. ESET reported the technique in an early stage of an attack against a target in Ukraine, but did not identify the scanner or show that the attempt successfully bypassed it.
What GuardBreaker did
ESET says researchers found the technique in a VBScript associated with Russia-aligned group UAC-0099. The script was intended to download and install MATCHBOIL, a loader ESET says UAC-0099 uses exclusively to deliver additional payloads. In a comment, the attacker placed a decoy request for guidance on building a nuclear weapon.
As an Amazon Associate I earn from qualifying purchases.
The comment was meant to provoke an LLM-powered code scanner’s safety guardrails and interrupt inspection before the scanner reached the malicious code. It was visible in the file but had no effect on the script’s runtime behavior. ESET calls the technique GuardBreaker and describes it as a prompt-injection attempt: attacker-controlled content in a file reaches an LLM while that file is being analyzed. ESET’s report does not name the scanner or model, provide a sample hash, or quantify whether or how often analysis stopped.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why a refusal is not a clean result
The risk is not simply that an AI system might refuse a request. It is that a security workflow might treat a refusal, missing output, or incomplete analysis as if the file had passed inspection. A refusal says the tool did not provide the expected analysis; it does not establish that the code is safe.
#1 Best Overall
For defenders, the key question is what happens next in the decision chain. If the AI tool cannot complete its task, the file should be sent for further checks rather than silently treated as benign.
How to evaluate an AI-assisted code-analysis workflow
ESET’s recommendations point to four practical checks for organizations using LLM-assisted security tools:
- Inspect what the system actually analyzes. Determine which file contents and code reach the model, including comments and other attacker-controlled text.
- Handle incomplete responses explicitly. Find out how the workflow detects refusals, truncation, and absent output, and ensure these states trigger additional analysis rather than a clean verdict.
- Cross-check findings. Use other analysis layers and models to validate AI output instead of relying on one model’s conclusion.
- Keep human review available. Give security specialists a way to investigate uncertain or conflicting results.
As Tomáš Foltýn, author of ESET’s report, puts it: “Crucially, however, no single LLM engine should have the sole authority to decide that a piece of code is safe.”
Related attempts are not the same technique
ESET also points to other efforts to interfere with LLM-powered scanners in software supply-chain attacks. Socket reported malicious PyPI packages with fabricated system instructions and policy-triggering content before a JavaScript payload. StepSecurity reported a prompt telling an analyzing model to ignore malicious code and report a package as clean. An npm package repeated “You’re absolutely right!” tens of thousands of times in an attempt to exhaust a model’s context window.
These examples illustrate other ways attackers have tried to manipulate or overwhelm AI-assisted analysis. They are separate reports cited by ESET, not evidence that the GuardBreaker file used those methods.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
