A planted binary narrative fooled AI malware scanners

A technique called ALIBI hides a false story in a section of a binary that never runs, and it fooled AI malware scanners anyway. No prompt injection, no jailbreak text. Just a coherent but false description of the file as a benign endpoint security tool, planted in a read-only section. Every import and executable behavior stays untouched.

The verdict changed because of text the scanner read, not text the machine executed. Anyone using a model to triage binaries should worry about that gap.

On 50 malicious Windows PE samples, the technique flipped 30 of 35 baseline-malicious verdicts to benign on Gemini 2.5 Pro. GPT-5.5 Pro and Claude Opus 4.7 didn't flip outright, but both downgraded their severity ratings. The trick also carried over to a different file format, flipping 16 of 40 verdicts on ELF binaries.

The researchers also tested a verification-guided defense built to catch this kind of context manipulation. It still let 42.9% of samples reach a benign verdict.

Any AI-assisted malware triage setup that feeds a model the full binary, embedded text included, is exposed to this. Fixing it means not trusting narrative content embedded in a file when scoring behavior. Any unexecuted text section that reads like a vendor description should count as suspicious. The paper doesn't say whether stripping those sections before review would stop the attack.