AI analysis evasion is no longer a lab demo. Cisco Talos now tracks malware that plants plain-language notes to steer AI triage tools. Those notes sit inside samples as comments or strings. They do nothing when the malware runs.

Talos researcher Ryan Fetterman published the findings on October 8, 2026. India and USA agencies that sell SOC, MDR, or AI security work need a clear brief for clients. This guide sticks to verified Talos and secondary reporting.

AI analysis evasion featured graphic Cisco Talos CAIRN A3 agency guide — Featured image: AI analysis evasion and Cisco Talos CAIRN A3. Graphic: Debugged Pro original.

What AI analysis evasion means in CAIRN A3

Talos places the pattern inside CAIRN as A3: AI-Analysis Evasion. The class covers malware that embeds natural-language instructions to influence automated AI analysis. Operators assume models sit in the triage pipeline.

Classic anti-analysis still targets binaries. Packers, encrypted overlays, VM tricks, and anti-debug checks aim at that layer. A3 aims higher. It targets pipelines that extract text and send it to a language model.

The ambiguity is simple. A model sees the analyst prompt and the file text. If the file text looks like an instruction, a weak boundary can let the sample steer the verdict. That is the core prompt injection malware risk for triage.

Read the primary write-up in Cisco Talos research on AI-analysis evasion. Pair it with your AI security risk and compliance practice so client SOWs cover AI triage controls.

Four malware families and 84 A3 samples

Talos confirmed A3 across four families: FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE. The set covers 84 distinct samples from January 2025 through July 2026. The technique spread and grew more engineered over time.

Four CAIRN A3 malware families FRUITSHELL PLOTSAFE HOLLOWCLAD MANTLEMAZE — Four confirmed A3 families tracked by Cisco Talos CAIRN. Graphic: Debugged Pro original.

FRUITSHELL started with a cheap ignore comment

FRUITSHELL is a PowerShell reverse shell. It builds a TCP session from obfuscated fruit-named variables such as apple, banana, and cherry. Google Threat Intelligence Group previously reported it in the wild.

Two comment lines sit at the top. They tell an LLM not to analyze the file. They claim the script only generates prime numbers from 1 to 1000. No prime number code exists anywhere in the script.

The comments are inert at execution time. Their only job is to appear in extracted text. Over about 15 months, Talos saw the same wording in nine more scripts from at least four actors.

Reuse was not limited to weak scripts. Talos also tracks ROZESHELL. That collection pairs the same AI-evasion comment with AMSI bypass, csc.exe compilation, and a Rozena shellcode loader. Cheap A3 text now rides on capable tooling.

PLOTSAFE turned the lie into a template

PLOTSAFE does not copy one static line. It stamps anti-analysis sentences from a template with variable filler keywords. The structure stays familiar. The claimed purpose changes across builds.

Go compilers drop unused strings. The author added a tiny 29-byte dummy function that references the strings just enough to keep them. The function is never called. That engineering shows intent, not accident.

HOLLOWCLAD sprays seven LLM chat templates

HOLLOWCLAD sprays a refuse-to-reverse-engineer instruction across seven LLM chat template formats. The hope is simple. One planted copy may match the wrapper a scanner uses when it asks a model for help.

The family also plants about 80 tiny sections named after known protectors such as Themida, VMProtect, Enigma, UPX, and Denuvo. The binary is not packed. The armor is costume only.

HOLLOWCLAD adds intimidation notes too. Some claim the sample is a monitored honeypot. Others warn that patching a license check will revoke a key. The goal is to scare a model away from helpful reverse engineering.

MANTLEMAZE mixes fake authority with BYOVD

MANTLEMAZE uses template spray plus fake ownership claims for Google, Microsoft, and Valve. It invents a DoD-style contract number FA8750-23-C-0518. It also invents FIPS claims, NDA numbers, patents, and boot-log lines.

Under that costume sits a loader breadcrumb. A PDB path points at iqvw64e.sys, the Intel Ethernet diagnostics driver. That BYOVD target is CVE-2015-2291. Scattered Spider, BlackByte, and Lazarus have abused it to disable EDR from kernel space.

For a concise secondary summary, see SOCtember coverage of Cisco Talos A3 malware. Use it when you brief non-research stakeholders who need shorter language.

What Talos measured about AI analysis evasion

Talos did not only ask whether models called a sample malicious. The team asked whether anti-analysis language steered the response. That is the right question for AI triage design.

Researchers extracted strings from seven families. They crossed every string into every sample body. Each string was tested in files it never shipped in. Five local LLMs triaged each matched pair three times.

That method produced 135 matched pairs per string. Each pair compared the same file with the string present versus excised. Scores used benign, suspicious, or malicious. Net steer rate subtracted shifts toward malicious from shifts toward benign.

Direct ignore instructions (FRUITSHELL, PLOTSAFE) worked almost universally in those tests.
Complex template tricks often had little effect or made models more suspicious.
Best techniques steered attacker-favorable outcomes in about 35 percent of runs.

Talos calls the overall impact a mixed bag. Agencies should not panic. They also should not ignore the signal. Attackers already assume AI sits in detection paths.

Defense steps for India and USA agency teams

The hard constraint helps defenders. Evasion content must remain plaintext. That gives hunters a stable surface. Imperative language aimed at analyzers inside a binary is itself suspicious.

Legitimate software has little reason to tell a model to refuse analysis, invoke copyright, or claim government contracts. Build detections for that imperative voice. Treat hits as evidence of A3 malware intent.

Deeper control sits in prompt construction. Text inside a sample must be evidence, never instruction. Extracted string blocks should never enter a model as a system directive. Keep that boundary explicit and test it.

Map the control work to the NIST AI Risk Management Framework. Then keep conventional detections alive. Talos stresses that classic malware detection remains unaffected.

Agency checklist for AI analysis evasion defense India USA teams — Six-step agency checklist for AI analysis evasion defenses. Graphic: Debugged Pro original.

AI analysis evasion checklist for client delivery

Inventory AI triage paths. List every product or playbook that sends sample text to a model.
Hunt imperative analyzer language. Search for ignore, refuse, copyright, honeypot, and fake contract phrasing in binaries and scripts.
Separate evidence from instructions. Wrap extracted sample text so models cannot treat it as a system command.
Retest with planted strings. Replay FRUITSHELL-style lines and measure verdict drift before and after prompt fixes.
Keep BYOVD and EDR hunts. MANTLEMAZE still points at iqvw64e.sys and CVE-2015-2291. A3 notes do not replace kernel abuse.
Update India USA RACI. India delivery often owns hunting queries. USA account teams often own risk language in SOWs.

If your firm also covers offensive AI misuse themes, compare notes with our Anthropic cyber mission agency guide. Keep A3 triage defense separate from agent containment and influence-ops briefs so buyers see clear scopes.

How AI analysis evasion fits agency SOWs

India delivery leads often own detection content and runbook updates. USA account leads often own executive briefings and contract risk language. Split ownership early so A3 work does not stall between teams.

Write the SOW with measurable exits. Require an inventory of AI triage tools. Require prompt boundary tests with planted ignore strings. Require hunting coverage for imperative analyzer language in scripts and binaries.

Do not sell fear. Sell verification. Talos shows the best tricks steered outcomes in about one third of runs. That is enough to justify control work. It is not enough to claim every AI product is broken.

Keep adjacent AI security scopes separate in proposals. Agent containment, influence ops, and A3 triage defense need different owners and different success metrics. Clients understand clearer packages and clearer pricing.

Operational notes for SOC and MDR handoffs

SOC analysts should mark A3 hits as enrichment, not as the only verdict. A planted ignore comment does not prove a file is harmless. It proves someone tried to talk to the analyzer.

MDR playbooks should record which model path saw the string. Log the prompt template version. Log whether the string matched a chat template style. That audit trail helps when clients ask why a verdict changed.

Engineering teams should keep plaintext searches cheap. Grep-style hunts for phrases aimed at LLM or AI analyzers catch FRUITSHELL-class reuse fast. Template spray is noisier, but fake protector section names still help.

Key Takeaways

AI analysis evasion is Talos CAIRN class A3: natural-language instructions planted to steer AI triage.
Four families and 84 samples show spread from FRUITSHELL comments to template sprays and fake authority claims.
Cheap ignore instructions steered models most often; complex tricks often backfired; best techniques hit about 35 percent.
Evasion must stay plaintext, so hunt it. Treat sample text as evidence, never as instruction.
India and USA agencies should update AI triage prompts, hunts, and SOW language without dropping conventional detection.

What agencies should tell clients this week

Tell clients the short version. Attackers already write for the AI layer. The first techniques are cheap and uneven. Defenders can still detect them because the content cannot hide.

Offer a fixed-scope review. Map AI triage tools. Harden prompts. Add A3 hunting rules. Confirm EDR still watches known BYOVD drivers. Price the work as a security sprint, not a vague AI project.

Need help scoping that sprint? Start with software development consulting for delivery planning, then route security controls through your AI risk team. Keep promises tied to verified Talos facts only.

About the Author

Nitin Kumar is Lead Project Coordinator at Debugged Pro. He works with India and USA agency teams on delivery plans, security briefs, and client-ready playbooks for AI and software programs.