UAC-0099 buried a nuclear weapons prompt in a VBS dropper to stall AI-assisted triage

The mechanism is simple: a triage wrapper hands the script to a model and asks what it does. The model reaches the comment, treats the file as a request for help building a weapon, and declines. What comes back is a refusal. According to ESET, that is the intended outcome: pull the model onto the sensitive phrase so it stops reading the rest ^[4]. A wrapper built on the assumption that the model always answers has no state for a refusal, so the sample leaves the queue unlabelled, and an unlabelled sample moves on without a verdict.

Compare the cost to ordinary evasion. Repacking, obfuscating or rewriting a loader carries a real risk of breaking execution and requires retesting against the target environment. A comment line carries none, because the interpreter never runs it ^[3], and the script still fetches and installs MATCHBOIL ^[5].

As evasion it is brittle. The bait is a plaintext string in a comment, and static rules and signature-based scanners catch plaintext strings easily; a content-policy bait string is no harder to write a rule for than any other hardcoded artifact. Attackers who keep using it are handing defenders a marker. The useful reading is not the string but the pipeline UAC-0099 expects to meet on the other side.

Two things should be kept distinct here: the public and the inferred. Public: the artifact, the naming, the attribution to a group that hands validated targets onward to GRU-linked Sandworm ^[2]. Inferred: intent. Nothing in ESET's published account shows a triage system actually aborting on this file ^[13]. Treat it as an attacker experiment whose results we do not have, run against tooling defenders had already documented; CERT-UA's advisory came in July and the GuardBreaker description was published 31 August, a gap of 31 to 61 days depending on the advisory's exact date ^[12].

For anyone with a model in the analysis path, the variable to instrument is refusal, not accuracy. A refusal is a distinct terminal state and needs its own route and its own counter: refusals per thousand samples, broken out by source and file type, with a human queue behind it. Refusal rate then becomes a detection signal in its own right, because a transportation-sector VBS dropper asking about nuclear weapons has no innocent reading.

Juraj Janosik, ESET's VP of Artificial Intelligence, told Help Net Security that AI and machine learning cannot be trusted blindly or treated as a silver bullet ^[8], and that without behavioural analysis, sandboxing, reputation and telemetry underneath, attackers will look for ways to manipulate or bypass the model ^[9]. On the narrow point the claim holds: the layers that catch this sample are the ones that never read the comment.</body_markdown> </invoke>