Research
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
First reported talosintelligence.com
Page published
Earliest dated coverage: 8 Oct 2026 · First observed: 8 Oct 2026 · Latest dated coverage: 8 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Talos's findings show malware authors are now targeting the AI layer of the analysis pipeline itself, meaning defenders must build LLM tooling that treats text inside a sample as evidence and never as instruction.
Cisco Talos research documents "A3: AI-Analysis Evasion" — malware that embeds natural-language instructions designed to manipulate LLM-based triage and reverse-engineering pipelines via prompt injection. Across 84 samples from four confirmed families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) collected Jan 2025–Jul 2026, the best embedded techniques steered analysis outcomes in the attacker's favor about 35% of the time, though the plaintext instructions are always detectable.