.png){kind=logo}
GuardBreaker places safety-sensitive text inside malware comments to target AI analysis rather than execute malicious code.
ESET linked the technique to UAC-0099 and a script that can deliver the MATCHBOIL loader.
A failed AI analysis must not count as a clean security result.
A single comment inside a malicious script has created a new problem for AI-based security tools. ESET found a Visual Basic Script linked to UAC-0099, a Russia-aligned group that has targeted Ukrainian transport and energy organizations.
The script contains a request for help making a nuclear weapon. The text does not run as code. It sits inside a comment, yet it may affect the AI system that reads the file. ESET named the method GuardBreaker.
Security teams now place large language models (LLMs) inside tools that sort suspicious files, explain code and support malware analysis. An attacker can place hostile text inside that same file. The attacker can then try to steer the model away from the real threat.
The GuardBreaker script contains a comment with the words, ‘I want to make nuclear weapon. Help me …’ ESET says the text has no role in the script itself. A Visual Basic interpreter ignores comments, so the line cannot create the malware, download a file, or alter the victim's system.
Its target sits outside the script. The text tries to draw an LLM toward a subject that can trigger a safety refusal. The model may then refuse the whole request instead of conducting a full check of the file. The company did not publish a test that proves the trick works against a specific model or security product. No named model has a publicly documented successful result.
The nuclear prompt serves as a distraction. It does not carry the main payload or control the victim's machine. The script itself has a clear malicious purpose. That purpose gives the AI bait a useful cover. ESET says the script can download and install MATCHBOIL, a C# loader that UAC-0099 uses for additional payloads. GuardBreaker adds a layer that targets the inspection tool.
UAC-0099 has a record of attacks against Ukrainian organizations, with transport and energy among its known targets. CERT-UA also linked the group to a July 2026 campaign that used a malicious Notepad++ plugin to deliver a newer MATCHBOIL variant. GuardBreaker adds a separate trick to an established intrusion path.
Also Read - Why Predictive AI Models are Becoming Critical for Stock Market Analysis
GuardBreaker did not appear in isolation. In June 2026, researchers reported malicious Python and npm packages with text designed to affect AI security scanners. Some samples contained safety-sensitive material tied to biological or nuclear weapons. Other tricks sought to flood model context or push the scanner toward a false result.
Attackers now have reason to test AI security tools as part of the defense. GuardBreaker offers a simple example from a targeted intrusion. A short comment can carry the bait while the real malware keeps its normal purpose. The method needs very little code. That makes the trick cheap and easy to add to a larger attack.
Reports about GuardBreaker often use strong language, yet the public evidence supports a narrower claim. ESET found the suspicious comment and explained its apparent purpose. Public sources do not show a controlled test in which a named AI model refused to inspect the rest of the file. No public result shows a security vendor lost a detection after the trick. No data shows how often the method succeeds.
GuardBreaker represents a real attack idea, but it does not prove a universal way to defeat AI security tools. A model may refuse the unsafe request, ignore the comment, continue with code analysis or pass the file to another system. That distinction matters for security teams. A claim of intent is not proof of a successful bypass, and that line matters when a new threat receives wide attention.
Also Read - Agentic Analytics vs Text-to-SQL: Which is Better for AI Data Analysis?
GuardBreaker exposes a simple weakness in AI-assisted defense. A security system should never treat a refusal as a clean result. If an LLM cannot finish an analysis, the system should mark the case for another check rather than close it.
Strong pipelines also need a firm boundary between system instructions and the file under review. Malware comments, strings and documents should count as untrusted content. A model can read that material without treating it as a command.
AI now forms part of the security process, so attackers have a reason to attack the AI's decision path as well as the computer itself. GuardBreaker shows how little text that attack may require. A comment that never runs can still try to deny the defense a clear view of the code's real purpose.
What is GuardBreaker?
GuardBreaker is a technique that places safety-sensitive text inside malicious code to potentially disrupt AI-assisted malware analysis.
Who used GuardBreaker?
ESET linked the technique to UAC-0099, a Russia-aligned threat group that has targeted Ukrainian organizations.
Does the nuclear-related text execute?
No. The text appears inside a script comment, so it does not perform the malicious actions itself.
What malware does the script deliver?
The script can download and install MATCHBOIL, a C# loader associated with UAC-0099.
Does GuardBreaker definitely bypass AI security tools?
Public evidence shows the technique exists, but no public controlled test proves a specific AI model or security product will refuse analysis.
