When malware tells the analyst what verdict to return

A malware sample may contain English instructions that address the system analyzing it. The instructions are not from the analyst or the defender's operator. They are part of the suspect artifact. If an automated assistant treats those extracted strings as commands rather than evidence, the object under investigation can influence its own assessment.

Cisco Talos documented 84 distinct samples across four malware families, FRUITSHELL, PLOTSAFE, HOLLOWCLAD and MANTLEMAZE, from January 2025 through July 2026. The researchers found natural-language text designed to change how an AI-enabled analysis pipeline classified the sample. Their stronger approaches steered the test model toward an attacker-desired verdict in roughly 35% of controlled runs.

That number measures an experimental analysis outcome. It does not mean that 35% of enterprise endpoint defenses were bypassed, that 84 machines were compromised or that ordinary binary detection failed. The source documents manipulation of model-mediated judgment, not a demonstrated fleetwide compromise of deployed antivirus products.

The agent-fleet investigation provides a useful comparison. Investigators placed an offscreen mailbox invitation on a page they controlled. They subsequently recorded 33 messages across 13 threads and reported that 12 of their responses were read. This was an investigator-designed intervention after observing automated browsing activity. It is not evidence that the fleet's original data-gathering workflow was itself initiated by prompt injection, nor proof that any correspondent obtained privileged access.

In one setting the untrusted surface was binary strings; in the other it was page text. Both results concern a model-mediated boundary between data to be inspected and instructions that determine subsequent behavior. The consequences differ: verdict contamination in the Talos tests, apparently induced communication in the page experiment.

The control requirement follows the mechanism. The system must be able to quote, classify and summarize hostile material without accepting that material as an operator directive. Logging only the final answer is insufficient to understand how an external string affected a verdict or tool action. The pinned studies do not provide a production-wide measurement of any particular defense, so the actionable conclusion is a boundary to test, not a claimed universal fix. Read the Talos technical account and the agent-fleet report for the separate traces.