EICAR / GTUBE AV Test Signature Output Request
An attacker asks an AI system to print known antivirus and spam-filter test signatures, such as the EICAR test file or GTUBE string. If the AI happily outputs these without any security scanning catching it, the attacker learns the output path has no antivirus or content-filtering layer watching it.
How the attack works
The attacker sends a prompt asking the AI to output a standard test signature — EICAR (antivirus), GTUBE (spam filter), a Cisco outbreak filter test URL, a Metasploit shellcode test string, or a known-bad file hash. These strings are harmless by design but are recognized by any properly configured AV or spam scanner. If the AI outputs the string and nothing blocks or flags it, the attacker has confirmed the output pipeline is unmonitored. The next step, not covered by this detection, is to attempt getting the AI to output or generate actual malicious content through that same unguarded path.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c52253ef-c5eb-4223-a46f-d03b421195c3
- Severity
- High
Why it matters
An attacker can map which parts of an AI application lack security scanning, then use that gap to move real malware, spam content, or exploit code through the system undetected.
What you can do
- →Run antivirus and content scanning on AI output, not just AI input, especially before output is stored, forwarded, or executed.
- →Treat repeated requests for AV/spam test signatures as reconnaissance and log or alert on them.
- →Don't assume an AI output channel is safe just because input is filtered — test the output path with these same benign signatures yourself.
- →If EICAR-style output is expected for legitimate testing, restrict who can trigger it and separate that from production output paths.
Known benign look-alikes
- AV vendor documentation explaining EICAR test file format for security product testing
- Security awareness training showing what EICAR looks like
- Antivirus software development testing suites