Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
SentinelLABS analyzed macOS.Gaslight, a Rust backdoor containing an approximately 3,500-byte prompt-injection payload with 38 fabricated system messages. The messages imitate an LLM-assisted malware-triage harness and report fake token expiry, memory and disk failures, and bogus analysis warnings, aiming to make the workflow abort, truncate, or refuse analysis. Recovered strings include a {{DATA}} boundary imitation paired with fabricated worker-OOM and static-analysis warnings.
SentinelLABS attributed the activity with high confidence to a DPRK-aligned cluster and documented conventional backdoor capabilities — Telegram command and control, a shell, collection, upload, and LaunchAgent persistence — but the published research did not test an LLM or demonstrate a successful AI-analysis bypass.
Why this analysis has no ERS
The source establishes a real malicious implant and a deliberate prompt-injection attempt, but no assessed AI deployment. The target of the injection — an LLM-assisted malware-triage harness — is hypothetical in this research: SentinelLABS states plainly that it did not test an LLM and did not demonstrate a successful AI-analysis bypass, so no harness product, version, prompt structure, tool policy, or observed model behaviour exists to score. Every IVP anchor would have to be inferred from a described attack rather than derived from observed control performance, which the public-evidence method forbids. The analysis is preserved with its AIDEFEND routes but carries no ERS.
Status: Not scorable by design · Classification: Incident · source date 2026-08-25
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-017.007 | Dual-LLM Isolation PatternAIDEFEND dataVersion 2026.10.15. Quarantining raw strings from Mach-O files, embedded data, and decoded resources in an analyzer with no tools, secrets, or privileged network path, and passing bounded typed observations through a validating broker, is the strongest boundary for this threat class. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-5 Cn-7 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationAIDEFEND dataVersion 2026.10.15. Normalizing and inspecting every sample-derived text field at the sample-to-model boundary, and rejecting or quarantining model dispatch on forged workflow state or reserved delimiters, is the admission enforcement the class requires. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationAIDEFEND dataVersion 2026.10.15. Building the analysis request with typed messages so that only authenticated orchestration fields carry session and error state, while sample bytes live in a data-only namespace, directly reduces the authority of fabricated system messages. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisAIDEFEND dataVersion 2026.10.15. A pinned, calibrated detector for system-message impersonation, instruction bypass, fabricated failure state, and analysis-stopping intent emits a content-bound finding before prompt admission. The brief states it supplies detection evidence only and that an enforcement gate must decide the outcome. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Ro-1 |