North Korea's Gaslight Malware Manipulates AI Triage Tools

A new macOS malware, called Gaslight, manipulates artificial intelligence triage tools instead of hiding from them. Security researchers at SentinelOne attribute this implant to a North Korean-aligned threat cluster. Gaslight exploits a known vulnerability in large language models. This vulnerability makes it hard for AI to tell the difference between trusted system instructions and untrusted input data. The malware contains 38 fabricated messages that mimic a broken analysis session. These messages are designed to make the AI believe its own system is failing or compromised. For example, it sends fake token-expiry notices and simulated out-of-memory errors. This floods the AI's context window, pushing it to abort or refuse its output before it can identify the malware. This is not a software bug but a design characteristic of current transformer-based AI systems. This type of attack affects any AI assistant used to analyze suspicious files.