Cisco Talos finds malware using text prompts to mislead AI analysis

Malware can try to talk an AI security tool into calling it harmless. Cisco Talos says some samples contain natural-language instructions aimed at steering automated analysis, and that simple “ignore all instructions” tactics occasionally worked in its tests.

Cisco Watch analysis

What happened

Cisco Talos describes the technique as “AI-Analysis Evasion”: malware embeds instructions in the sample that attempt to influence an AI model reviewing it. In its report, the researchers say direct-ignore instructions steered models towards benign verdicts in a fraction of tests. More complex approaches often failed or backfired.

Talos recommends treating text found inside a sample as evidence, never as instructions for the analysis system. That distinction matters: a file being examined should not get to set the rules of its own examination.

Why it matters

Security teams are increasingly using AI models in analysis pipelines. If a model treats hostile sample text as an instruction, an attacker may be able to influence the verdict without defeating the underlying detection tools outright. Talos’s findings point to a practical weakness in how those systems handle untrusted input.

The report does not say every model is vulnerable or that these techniques reliably evade detection. Its tests suggest that the simpler prompts sometimes worked, while more elaborate attempts often did not. That is a useful warning, not a reason to assume the malware has found a universal cheat code.

Our read

The sensible fix is also the unglamorous one: keep the sample in the evidence box and the analysis instructions under defender control. Teams using AI for malware review should check that their pipelines enforce that boundary, rather than asking a model politely to remember it.

What to watch

• Whether security teams report similar prompt-based tactics in real-world malware.
• How AI analysis tools isolate sample content from system instructions.
• Whether later testing finds these techniques work across more models or analysis setups.

Discussion spark: Should AI malware-analysis tools be required to technically isolate sample text from their instructions, or can careful prompting and human review be enough?

not affiliated with or endorsed by Cisco