Security 1 publisher2 min readPublished September 11, 2026 at 5:00 AM PDT

UAC-0099 hid a nuclear-weapons request in a VBScript comment to stall an LLM code scanner

ESET calls the technique GuardBreaker and notes that this bait, unlike most evasion tricks, is left in plain sight for the models reading the code to find.

The Watch · Security desk

What happened

ESET researchers found the technique in a VBScript that the Russia-aligned group UAC-0099 used in the early stages of an attack on a target in Ukraine.
A comment in that script carried a decoy request for guidance on building a nuclear weapon, placed to trip an LLM-powered code scanner's safety guardrails and halt it before the malicious code.
The script's job was to download and install MATCHBOIL, a loader ESET says is used exclusively by UAC-0099 to deliver further payloads.
ESET describes the trick as a very simple attempt at prompt injection, with the attacker's text reaching the model at inference time inside the file being analyzed.

Compiled by The WatchSomething wrong?How this is made

Why it matters

capability A refusal is now an outcome an attacker can request. Any pipeline that treats a declined analysis as a completed check hands the sample a free pass.
decision Owners of LLM-assisted triage have to settle what happens on a refusal or an incomplete run, because a queue that routes on model verdicts will route on attacker-chosen ones.
cost The attacker's side of this costs one line of comment text. The defender's side, on ESET's own advice, costs a second engine and cross-validation of every AI verdict.
exposure Triage agents wired to unpackers and deobfuscators put those tool calls within reach of the file they are inspecting.

The comment is inert. Run the script and the nuclear weapons text does nothing ^[5]. It only has an effect while a model is reading the file. ESET puts the weakness in the architecture: current LLMs process untrusted content and trusted instructions without dependable boundaries between the two ^[7]. Going after the defender's tooling is old practice, and ESET researchers have documented EDR killers extensively ^[21].

What ESET documents is an attempt. Nothing in the write-up says a scanner actually stopped, and no product is named as having been tested against the sample ^[20]. It gives no date for the attack either, describing the VBScript only as recently spotted ^[22]. That UAC-0099 was accounting for an AI system in the target's defenses is ESET's inference ^[8]. The supporting detail is that in other recent attacks the group checked for processes belonging to analysis tools such as IDA and Wireshark ^[9].

Three campaigns have now tried to spoil a model's read of a file ^[19]. Socket found fabricated system instructions and policy-triggering content sitting ahead of a JavaScript payload in the PyPI packages ^[10]. StepSecurity, reporting on the same broader campaign, found a prompt that flatly instructed any analyzing model to disregard the malicious code and report the package as clean ^[11]. The npm case used no instructions at all: its main JavaScript file repeated "You're absolutely right!" tens of thousands of times, aiming to exhaust the model's context window before the malicious script ^[12].

ESET also lists variants it does not tie to a specific incident. Awkwardly structured files could end up truncated or parsed only in part ^[13]. The list includes concealing malicious code under the pretense of being confidential or otherwise sensitive data ^[14]. Agents could be steered toward actions that require human review, exploiting the response times ^[18]. Agents that invoke external tools such as unpackers or deobfuscators widen the surface further, and ESET says those calls could in some cases be hijacked for malware delivery and execution ^[15].

For anyone already running LLM-assisted review, the practical part of ESET's advice is inventory: what the tool inspects, where it sits in the decision chain, and what happens when it refuses to respond or cannot complete a task ^[16]. ESET also says no single LLM engine should have the sole authority to decide that a piece of code is safe, and that AI-assisted output needs to be cross-validated ^[17].

What to watch

A scanner vendor publishing telemetry on how often its model refuses mid-file, and what the triage queue does with those samples.
UAC-0099 iterating from a refusal trigger to comment text that dictates the verdict itself.
MATCHBOIL deliveries carrying the same comment in samples aimed at targets outside Ukraine.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
ESET researchers recently spotted the technique in a VBScript that the Russia-aligned group UAC-0099 used in the early stages of an attack against a target in Ukraine.
ReportedSupportedView cited source
[2]
By inserting a decoy request for guidance on building a nuclear weapon into the script's comment, the actor aimed to trip the safety guardrails of an LLM-powered code scanner and cause it to stop inspecting the rest of the file before reaching the malicious code.
ReportedSupportedView cited source
[3]
The script's purpose was to download and install MATCHBOIL, a loader used exclusively by UAC-0099 to deliver additional payloads.
ReportedSupportedView cited source
[4]
ESET has named the technique GuardBreaker.
ReportedSupportedView cited source
[5]
The decoy comment has no effect on the script's behavior at runtime.
ReportedSupportedView cited source
[6]
ESET describes GuardBreaker as a very simple attempt at prompt injection: an attacker's input reaches the LLM at inference time through a file that is being analyzed.
ReportedSupportedView cited source
[7]
ESET says the technique aims to exploit an architectural weakness in today's LLMs, which process untrusted content and trusted instructions without dependable boundaries between the two.
ReportedSupportedView cited source
[8]
ESET says the presence of the comment suggests UAC-0099 was accounting for an AI system in the target's defenses.
ReportedSupportedView cited source
[9]
In other recent attacks the group also checked for processes associated with established analysis tools such as IDA and Wireshark.
ReportedSupportedView cited source
[10]
Socket found fabricated system instructions and policy-triggering content placed ahead of a JavaScript payload in malicious PyPI packages.
ReportedSupportedView cited source
[11]
StepSecurity, reporting on the same broader campaign, found a prompt that flat-out instructed any analyzing model that parsed the file to disregard the malicious code and report the package as clean.
ReportedSupportedView cited source
[12]
Researchers spotted an npm package whose main JavaScript file repeated "You're absolutely right!" tens of thousands of times in the hopes of exhausting the model's context window and putting the malicious script that followed beyond practical analysis.
ReportedSupportedView cited source
[16]
ESET says businesses relying on LLM-powered code reviews and other LLM-assisted workflows need to know what exactly such a tool inspects, where it sits in the decision chain, and what happens when it refuses to respond or cannot complete a task.
ReportedSupportedView cited source
[17]
ESET says no single LLM engine should have the sole authority to decide that a piece of code is safe, and that AI-assisted output needs to be cross-validated.
ReportedSupportedView cited source
[21]
EDR killers, tools that go straight after security solutions themselves, have been documented extensively by ESET researchers.
ReportedSupportedView cited source
[23]
ESET notes that unlike many other tricks in attackers' evasion playbooks, this decoy comment is there for everyone, especially the models analyzing the code, to see.
ReportedSupportedView cited source
[19]
The ESET write-up describes three distinct documented approaches to spoiling an LLM's analysis of a file: triggering a refusal, instructing the model to report the file clean, and flooding the context window.
DerivedSupported1 source— sign in to open
[20]
ESET's report states the attacker's aim but does not report that any scanner stopped its inspection, and names no product tested against the sample.
DerivedSupported1 source— sign in to open
[22]
ESET gives no calendar date for the attack, describing the VBScript only as recently spotted.
DerivedSupported1 source— sign in to open
[13]
ESET says unusual or awkwardly structured files could end up being truncated or parsed only in part by an analysis pipeline.
ReportedInsufficientView cited source
[14]
ESET says some parts of malicious code could be concealed under the pretense of being confidential information or other sensitive data.
ReportedInsufficientView cited source
[15]
ESET says agents that invoke external tools, such as unpackers or deobfuscators, widen the attack surface further, as the calls could in some cases be hijacked for malware delivery and execution.
ReportedInsufficientView cited source
[18]
ESET says other attacks could steer AI agents towards actions that require human review, causing delays that exploit response times.
ReportedInsufficientView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

welivesecurity.com
1 article · September 10, 2026
GuardBreaker: Derailing AI-assisted malware analysis with a code comment

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

For anyone wiring a model into code review, the mechanism is the part worth reading twice. The injection arrived inside the file under analysis, which is the one input a scanning pipeline cannot decline to read, and it did nothing at all when the script ran. ESET's advice is narrow and usable: know what the tool inspects, know where it sits in the decision chain, and treat a refusal as a result. On that last point the company is explicit, writing that "a lack of output, too, needs to trigger further checks." The post gives no hash and names no scanner, so you cannot replay the sample against your own pipeline.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence58

0100

One vendor, its own sample

Everything traces to the team that found the file. ESET describes the comment, the VBScript and the MATCHBOIL loader it fetched, and publishes no hash, no target, no date and no scanner it was tested against. The artefact is the sort of thing that would be trivial to corroborate if the sample were shared, and it has not been.

Adoption32

0100

Four sightings, none quantified

Four uses of the tactic appear in total: the UAC-0099 script ESET examined, the PyPI packages Socket reported, the same campaign as StepSecurity saw it, and the padded npm file. Three of those reach us through ESET's summary of other firms' work. No one reports how often a scanner actually swallows the bait, or how many pipelines are exposed.

Hype gap

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
UAC-0099 buried a nuclear weapons prompt in a VBS dropper to stall AI-assisted triage
2 publishers
leadership
SecurityBridge's co-founder makes the SAP agent case on one survey and two prior incidents
1 publisher
security
Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours
3 publishers
build
56 build-pipeline attacks, one vendor's alert queue, and the February jump nobody can attribute yet
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources