AI agent incident

UAC-0099 planted a nuclear weapons prompt in malware to stop AI analysis

Reported · 1 source

What happened

ESET reported that the Russia-aligned group UAC-0099 used a technique it called GuardBreaker, deliberately tripping LLM safety filters so AI-assisted malware analysis would refuse to run.

Why it matters

Refusal training is an availability problem for defenders. If triage depends on a model that can be made to decline, the attacker chooses when your analysis stops.

Sources

  1. The Hacker News Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis

New incidents by email

Get incidents like this one in your inbox

New AI agent incidents are covered in the briefing, with what to check on the agents you already run. At least once a week, free.

You confirm by email. Unsubscribe in one click.

Background reading

Does RBAC work for AI agents? An explainer on the problem behind this incident.

Cite or correct this record

“UAC-0099 planted a nuclear weapons prompt in malware to stop AI analysis.” The Permission Layer AI Agent Incident Database, https://thepermissionlayer.com/incidents/uac-0099-guardbreaker/. Database updated October 22, 2026.

Every record traces to the dated sources above. If something here is wrong or missing, email [email protected] and it gets fixed. See this record in the full list.

The Permission Layer

Get the briefing by email

At least one email a week on AI agent identity, permissions, security and spend, written for the people who approve agent access. Five-minute read, free.

You confirm by email. Unsubscribe in one click.