Securing AI at the Frontier
San Francisco
Joined January 2025
- Tweets122
- Following0
- Followers1.2K
- Likes242
Pinned Tweet
Introducing MalwareBench: the first end-to-end, cross-platform benchmark on malware reverse engineering.
Most RE benchmarks are saturated, but not MalwareBench. GPT-6.1 Sol leads with 4.42%. A typical run takes several hours and hundreds of millions of tokens.
Today we are releasing IPI Bench, a new benchmark to measure indirect prompt injection against agents doing realistic workplace tasks. Despite recent progress, frontier models remain broadly susceptible to prompt injection.
With 11 independent queries, an attacker with only outsider access achieved its injected objective on 18–79% of tasks across seven models.
All seven models handled the workflows well, scoring 87.5–98.1% on the main tasks at $0.02–$1.59 per run. Injected material barely changed that: scores stayed within 2.5 points, so an attacked run looks like a normal one from its output.
Full results and methodology: ipibench.generalanalysis.com
If you build or deploy agents and want them tested, get in touch.
We are releasing one of our 12 MalwareBench cases as a research preview.
MalwareBench’s full eval set is private to limit contamination and preserve its value as a test of unfamiliar malware.
DM us for an access token.
Since launching MalwareBench, we’ve had a lot of interest in how we’ve created low-cost, evasive malware and turned them into reverse-engineering tasks.
Here’s a closer look at our five-stage process ⬇️
4. Task validation: The model is provided with a JSON field contract that defines what it must recover. We refine the contract until it satisfies two conditions: with source code (>80% accuracy per field) and without the binary or source (<5%). These checks demonstrate that the tasks are saturable and unguessable, even with internet access.
5. Independent analysis: Finally, to calibrate case difficulty and prove the task is saturable, an AI-assisted human analyst receives only the obfuscated binary and public contract. They must reconstruct artifacts, document evidence-backed findings, and build a reusable extractor. If they finish in under 5 hours, we add additional protections and repeat the review.
MalwareBench’s Conti case asks models to analyze Windows ransomware that encrypts files, renames targets, and leaves a ransom note.
In one run, GPT-6 Astra derived decryption keys from fingerprints of eleven Windows DLLs, verified HMAC-SHA256 tags on encrypted resource pages, and reconstructed configuration values from three XOR shares. However, it could not decrypt the later W!12ENV payload, leaving the investigation incomplete.
Read the full blog: malwarebench.com/blog
