Security1 publisher2 min readPublished
Prompt injection embedded in malware turns an LLM scanner's refusal into a free pass
Security Weekly News #615 credits Google's threat tracker with malware carrying text meant to make an LLM scanner decline to analyse it. The exposed decision is what the pipeline writes when the model returns no verdict.
The Watch · Security desk
What happened
- SC World's Security Weekly News #615 notes report, among items from Google's threat tracker, malware carrying prompt-injection text written to make an LLM scanner refuse to look at the sample.
- The same tracker items include a credential-harvesting campaign built and run in under six hours, with Markdown files serving as the attacker's playbooks.
- A CVSS 10 in Gemini CLI involved no prompt, no injection and no tool call, and by the episode's account the attacker simply arrived before the sandbox did.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The sample that provokes a refusal is the one that most warrants a human look, and in a two-state pipeline it draws the least.
- decision Teams running model-assisted triage have to specify what a non-answer writes to the case, and choose between a pass and a review queue nobody has staffed.
- capability Evasion moves into the file's prose, so an author can rewrite the injected paragraph for every sample without touching the code that actually has to run.
- contradiction The episode treats the refusal as an effective free pass, while the material supports only authoring intent, with no family, scanner or case record available to check.
An LLM scanner can return three things: malicious, benign, or no verdict at all. The pipeline around it was usually built for two. Whoever wrote the wrapper chose a default for the third case, and that default is what the injected text is aiming at. SC World's episode notes say a refusal that gets read as clean amounts to a free pass [3].
Producing the injection is cheap. It is content, not code: a paragraph in a comment or a string in a resource section, varied per sample. The injection does not have to defeat a static engine or even run; it has to get one model to stop [2].
That same failure showed up before, in a case that involved no model at all. Unit 42's pay-per-install operation ran out of eleven gaming YouTube channels with more than ten thousand loader samples underneath, and the notes describe every layer as built to look too boring to escalate [5][6]. Eleven channels and ten thousand samples is an average above 900 per channel [9]. The same summary warns that an analyst closing that alert as adware may have closed three separate compromises [6].
The episode covers a second case of a system doing what it was told. Two hundred and sixty-three million dollars left a Bitcoin sidechain and then came back. "Nobody stole the keys. They just convinced the system to sign a lie," the notes say [11].
Model-layer trickery is not the only AI failure in the episode. A CVSS 10 in Gemini CLI involved no prompt, no injection and no tool call, and the notes describe it this way: "The attacker just turned up before the sandbox did" [7]. That one is a race condition in the sandbox setup.
The refusal-evasion finding reaches us as three lines in a podcast summary crediting Google's threat tracker [12]. The summary does not name a malware family, a scanner product or a date. What the material documents is intent on the authoring side. Whether any production pipeline actually maps a model refusal to a benign verdict is not shown. A defender can answer that question locally in an afternoon, by feeding a scanner a file it will decline and reading the resulting case record.
The same segment makes the parallel argument about coding agents: shift-left did not fail, the starting line moved, and the earliest trust boundary is now the moment an agent gets context and authority [8].
What to watch
- Publication of the underlying Google threat-intelligence write-up with the injection strings, which would let defenders test their own wrapper's default for a non-answer.
- Any scanner vendor stating whether a model refusal is recorded as a third state or folded into the benign verdict.
- An advisory and fixed version for the Gemini CLI CVSS 10 that the notes say needed no prompt, injection or tool call.