Making sure the checks get printed

What it is

Cisco Talos's "A3: AI-Analysis Evasion" classification, part of its CAIRN research tracking malware that embeds natural-language prompt-injection text to manipulate AI-assisted malware analysis. The malware family MANTLEMAZE exemplifies this category.

How it works

Attackers embed plaintext instructions directed at an AI analyzer — ranging from simple code comments telling an AI to ignore the file, up to "template spraying," a more advanced technique crafted to target specific LLMs. Because the sample's text is fed into the analysis pipeline, a manipulated AI can be steered to misclassify the file. MANTLEMAZE combines this AI-deception attempt with a separate, more conventional threat: BYOVD (Bring Your Own Vulnerable Driver) abuse, which lets it disable EDR from kernel space.

Preconditions / Affected

This matters specifically for organizations using AI/LLM-assisted tools in their malware analysis or triage pipeline — the manipulation targets the AI step, not a traditional static/dynamic analysis process.

What to do

Talos states defenders have "a highly stable detection surface" because the evasion instructions must exist as plaintext in the binary. Concretely:

• Flag imperative language addressed to analysis systems found within binaries as a suspicious signal (e.g., text instructing an "AI" or "analyzer" to ignore, skip, or reclassify the file).
• Treat any text extracted from a sample strictly as evidence to be analyzed, never as a directive the AI system should act on — this applies to anyone building or operating AI-assisted analysis pipelines.
• Talos notes the full blog (linked from the newsletter, not reproduced in the fetched text) contains the detection techniques in more depth plus sample hashes for MANTLEMAZE specifically — the hashes in this newsletter's "most prevalent" list are generic weekly telemetry, not confirmed MANTLEMAZE/A3 samples.

Caveats

Talos reports these prompt-injection techniques only succeed in steering the AI's verdict in the attacker's favor about 35% of the time — a real but limited effect, not a reliable evasion method on its own. That's likely why A3 families pair it with a harder guarantee of impact (BYOVD/EDR killing) rather than relying on AI deception alone.