More security teams now let an LLM help triage malware, summarize artifacts or review activity. MITRE ATT&CK T1685.007, Impair Autonomous Defenses, covers adversaries who target that automation. It is a sub-technique of Disable or Modify Tools (T1685), in the Defense Impairment tactic, and the platforms listed are Windows and SaaS.
How attackers use it
MITRE says adversaries may use methods like Indirect Prompt Injection (T1698) to disrupt, disable or otherwise impair autonomous defensive capabilities, such as LLM-assisted processing of malware, artifacts or activity. The result can be a system that ignores data, fails to alert on malicious activity, aborts analysis or is disabled completely.
Two patterns are described. First, malware may include content that mimics an LLM prompt scaffold with fake system messages, meant to convince the model it hit an error. Depending on the error, the model may abort, truncate or refuse to continue. Second, adversaries may embed prompts in malware aimed at stopping agents or systems from analyzing it at all.
The core problem is that the artifact under analysis is untrusted input, yet the model reads it in the same stream as its own instructions.
How to detect it
The MITRE page has no detection section for this sub-technique, but its audit mitigation tells you what to record. An analysis that stops early should be visible as such. Track:
- Analysis status and completion state for every sample or alert.
- Artifact provenance, meaning where the input came from.
- Which tools the agent ran.
- The termination reason.
Then review the oddities. A sample that ends in "error" or "refused" far more often than comparable samples, or an analysis that ends without finishing its required stages, deserves a human look.
How to reduce the risk
Each mitigation on the page applies a standard control to the AI analysis service:
- Execution prevention. Content inside an artifact must not control the workflow, end the analysis, skip required stages or start unrelated tools. Enforce stage transitions in code, outside the model, not through instructions generated from artifact content.
- Restrict file and directory permissions. Give the analysis system access only to the files it needs, and stop artifacts from modifying agent configuration, instruction files, analysis state or other trusted resources.
- Audit. Keep the records listed above so incomplete or redirected analysis can be found and reviewed independently.
- Privileged account management. Artifact-derived instructions must not cause the agent to use privileged capabilities. Require independent authorization for consequential actions outside the expected workflow.
- User account management. Run the analysis service under a dedicated identity with only the permissions it needs, separated from analyst, admin or production access.
Check your own environment
- Does any AI analysis step decide, on its own, to stop or skip a stage? If yes, move that decision into code.
- Can the analysis service write to its own prompts, config or state? It should not.
- Do you record why every analysis ended, and does anyone look at the unusual ones?
- Does the analysis identity have access to anything beyond the analysis sandbox?
Quick check
Why is "the model said it hit an error" not a safe reason to stop analysis?
Because malware can include fake system messages that cause exactly that response. Workflow transitions should be enforced independently of text generated from the artifact, and early stops should be logged and reviewed.
