SentinelLabs Tests Frontier AI Models on Long-Horizon Malware Analysis

Jul 22, 2026 · Original article ↗

Summary

SentinelLabs benchmarked frontier models on an eight-stage reverse-engineering investigation of the fast16 implant. GPT-5.6 Sol completed all three runs, but the authors say human oversight remains essential.

Key points

The benchmark recreated SentinelLabs’ investigation of fast16, a 2005 Windows implant, across eight stages that added software samples and external reporting.
Models had to produce and update annotated IDA databases, analyze the implant’s components and patching logic, and support claims with verifiable evidence.
GPT-5.6 Sol completed all three benchmark runs; GPT-5.5, GLM-5.2, and the tested Opus 4.x models did not complete the full investigation.
Sol corrected a mistaken hypothesis that rule matches in MOHID and PKPM indicated broad compatibility, distinguishing meaningful LS-DYNA modifications from incidental matches.
The authors identify project-wide recovery—updating dependent artifacts and conclusions after new evidence—as a key difference in completed runs.
The authors caution that runs were limited and operator involvement mattered; models still made semantic errors and required human review.
SentinelLabs recommends supervised investigative use, with analysts setting objectives, assessing quality, and retaining final publication authority.

Article Details

Attack Vectors: fast16 contains an encrypted, obfuscated Lua-driven operations framework linking a Windows service implant and embedded components.
A fast16 kernel driver implements 101 byte-pattern rules that locate code inside executables, capture addresses, replace code, and repair executable metadata. The investigation identifies meaningful sabotage modifications in LS-DYNA.
Some patch rules also match MOHID and PKPM, but testing found haphazard fragments rather than meaningful modification sequences. The researchers interpret these matches as collateral risk from loose rules, not evidence of intended targeting.
A Symantec claim concerning a possible ANSYS AUTODYN target was evaluated against recovered evidence and additional components; the article does not disclose a definitive targeting conclusion.
Defensive Notes: Use frontier models as supervised investigative agents rather than replacements for senior reverse engineers. Humans should define objectives, expose blind spots, enforce quality standards, and retain publication authority.
Conduct malware analysis in a sandboxed workspace without network egress; the benchmark enforced this boundary with nono shell.
Require annotated analysis databases and claims anchored to specific addresses and artifacts rather than relying solely on prose reports.
Validate whether matching patch rules produce a meaningful modification sequence; isolated byte-pattern matches can support misleading targeting conclusions.
When evidence contradicts a conclusion, withdraw the claim, identify dependent artifacts and tests, repair the underlying analysis or quality-control failure, and propagate corrections throughout the investigation.
Reopen corrected artifacts and perform checks capable of disproving the revised conclusion. File hashes and recoverable backups can help maintain artifact integrity.
Separate unresolved questions that block a conclusion from uncertainty that can be disclosed and deferred.
Treat the benchmark results as a bounded case study: runs per model family were limited, operator involvement was consequential, and even completed runs made semantic errors and premature readiness claims.