Weaponizing AI Safety Guardrails Against the Defenders

TL;DR: Threat actors are now weaponizing AI safety guardrails to blind automated malware analysis tools. Recently, the Russia-aligned group UAC-0099 was caught embedding text about building nuclear weapons inside malicious scripts. Their goal? To intentionally trigger an AI scanner’s safety refusal. If the system drops the analysis, poorly designed security pipelines mistakenly rubber-stamp the malware as safe.

Overview: An Ironic Turn in Attacker Tradecraft

When security researchers spend enough time in the malware analysis trenches, they become accustomed to seeing attackers devise highly creative ways to dodge detection. The cybersecurity industry is well-acquainted with obfuscation, fileless execution, and polymorphic code. But a recent discovery highlights a fascinating, almost ironic shift in attacker tradecraft: using the industry’s own AI safety mechanisms against defensive systems.

The technique, which ESET researchers have dubbed “GuardBreaker,” was spotted in a malicious VBScript tied to UAC-0099 — a Russia-aligned threat group known for targeting critical sectors in Ukraine. When analysts cracked open the script, they did not just find the usual commands for the group’s MATCHBOIL loader. Instead, hidden in the code comments, was a bizarre block of text begging for instructions on uranium enrichment and building a nuclear weapon.

To a human analyst, it looks like a crude joke. To a traditional antivirus scanner, it is just inert text. But to a Large Language Model (LLM) acting as a first-line triage analyst, it is highly radioactive material.

Technical Deep Dive: Tripping the Guardrail on Purpose

Here is the genius of the attack: it is not trying to bypass the AI’s safety guardrails. It is trying to trip them on purpose.

When a security pipeline feeds this script into an LLM, the model immediately detects the safety-sensitive prompt. Bound by its hardcoded ethical guardrails, the AI abruptly halts its analysis, usually spitting out a canned response refusing to fulfill the request. The AI effectively throws its hands up and refuses to read the rest of the file — including the actual malicious payloads hiding just below the nuclear prompt.

Why the Refusal Is the Payload

This is where the real vulnerability lies, and it is a pipeline engineering flaw rather than an AI bug. In many automated security systems, an AI scanner failing to return a definitive “malicious” verdict is mistakenly interpreted as “nothing found.” A refusal state is treated as a free pass, allowing the malware to sail right through to the target environment.

The distinction matters, because it changes where the fix belongs:

• A verdict of “benign” is an analytical conclusion. The model read the file and formed a judgement.
• A refusal is the absence of a conclusion. The model never finished reading. Treating the two as equivalent is what turns a safety feature into an evasion technique.

Not a One-Off

While UAC-0099’s campaign is making headlines, they are not the first to figure this out. Similar tricks appeared earlier this year in malicious Python packages, where attackers stuffed fake biological and nuclear weapon instructions into the code to successfully force AI security scanners into a refusal state.

That repetition is the important signal. This is not a novelty found in a single sample — it is a technique being tested against defensive tooling across different ecosystems, and it works because the weakness is architectural rather than model-specific.

The GRC & Risk Perspective

So, how does the industry fix this? The answer is not to remove the safety guardrails from AI models. Instead, organizations need to completely rewire how their security pipelines handle ambiguity. As researchers at Zscaler pointed out recently, a scanner that refuses to analyze a file has not cleared it.

• Treat refusals as escalations, not results. Security operations centres need to start treating AI safety refusals as high-priority escalations. If an LLM suddenly refuses to read a file, that file needs to be quarantined and handed to a human analyst immediately.
• Fail closed, not open. Any automated stage that cannot produce a verdict — a refusal, a timeout, a parser crash, a truncated input — should default to quarantine. An inconclusive result is not a clean result.
• Log the refusal state explicitly. If your pipeline collapses “refused,” “errored,” and “benign” into one outcome, you have no way to detect that this technique is being used against you. Instrument the difference before you need it.
• Action Items: Audit every AI-assisted stage in your detection pipeline and answer one question for each: what happens when the model declines to answer? If the answer is “the file continues on its way,” you have the same blind spot UAC-0099 is targeting.

As defenders continue to integrate AI into their security stacks, it is critical to remember that attackers are actively testing these systems for blind spots. Automated tools are only as smart as the pipelines built around them, and right now, enterprise security cannot afford to let a safety feature become its biggest liability.