Search papers, labs, and topics across Lattice.
This study systematically investigates the gaps in realism between AI environments and malware-analysis sandboxes, highlighting a new surface for sandbox evasion. Using the AIprint framework, the authors extract 450 unique artifacts from 284 open-source AI projects and evaluate their presence across various sandbox backends. The findings reveal that traditional VM-detection methods are inadequate, as they fail to differentiate between genuine AI-capable systems and sandboxes, with twelve distinct AI-environment artifacts uniquely identifying real environments.
Traditional sandbox detection methods falter against AI-capable malware, exposing a critical vulnerability in current security measures.
Sandboxing remains a core technique for observing suspicious program behavior, yet environment-aware malware increasingly suppresses execution when analysis is suspected. Prior generations of sandbox evasion focused on virtualization artifacts, timing discrepancies, and wear-and-tear realism. In this paper, we present the first systematic measurement study of AI-environment artifacts as a new sandbox-evasion surface. We operationalize this realism gap through AIprint, a probe framework that captures persistent artifacts left behind by AI-capable software ecosystems, including AI-assistant configuration directories, model caches, environment variables, local inference services, and package dependencies. We systematically extract 450 unique artifacts from 284 open-source AI projects on GitHub, compile them into unprivileged Windows probes, and evaluate them across seven commercial and open-source sandbox backends together with three AI-capable reference hosts. Our results show that traditional VM-detection baselines fail to reliably distinguish real AI-capable systems from modern sandboxes, whereas twelve AI-environment artifacts appear on the reference hosts and on none of the evaluated backends. A controlled 214-step installation experiment establishes a causal relationship between AI tool and package installation and measurable AI-environment artifact accumulation, while adaptive spoofing experiments reveal a fundamental operational asymmetry: reproducing convincing AI software environments is substantially more expensive than detecting shallow spoofing.
