| LLM Scanning is a MetaDefender Aether™ capability that analyzes pretrained LLM model files for hidden threats. It combines static analysis, which inspects a model's structure without executing it, as well as dynamic analysis, which tests a live model's behavior against adversarial prompts, giving organizations a way to vet third-party models before deployment. |
Puntos clave
- MetaDefender Aether™ v3.3.0 adds LLM Scanning across Layer 2 Static Analysis and Layer 3 Dynamic Analysis, extending the platform's five-layer threat processing pipeline to include AI and machine learning model files
- Static analysis parses 7 LLM file formats without executing the model, surfacing embedded payloads through 30+ dedicated threat indicators
- Dynamic analysis tests live model endpoints with 50+ adversarial techniques and 1,000+ prompts spanning nine categories of LLM-specific attack behavior, with findings mapped to MITRE ATLAS
- OPSWAT is among the first sandbox vendors to add LLM Scanning, arriving as AMTSO's updated Sandbox Evaluation Framework turns toward AI-related testing
Why AI Model Files Have Become a Security Problem
Organizations are pulling open-source and third-party models into production faster than they can review them. A model downloaded from Hugging Face is not passive data. It can carry executable code, and once loaded, a single compromised model can affect every system that runs it.
Most teams have little to go on beyond hoping the source was reputable. That gap is showing up in real incidents. In late August 2026, researchers disclosed a flaw in NVIDIA's NemoClaw stack that let an attacker-controlled webpage take over a local Ollama instance and plant hidden instructions directly inside the model an AI agent was using. Days later, Check Point researchers published PuzzleMask, a technique that hides harmful instructions in ordinary English so a fast-screening model misses them while a more capable downstream model still acts on them. And on September 1, 2026, CERT/CC published a vulnerability (CVE-2026-80047) in Hugging Face Transformers that let malicious model repositories write attacker-controlled Python files to a user's system before any remote-code consent check occurred.
The pattern behind all three: the model file and the model's behavior are both attack surfaces, and most security tooling was not built to inspect either one. OpenAI's "A call for collective action on cyber defense," signed by more than 100 organizations including Anthropic, Microsoft, and Google, frames this as a limited window where AI is giving defenders new tools to fix accumulated weaknesses, if they act now. Guides like AI Security & Safety's LLM Security overview point to the same shift, noting that indirect prompt injection has become the dominant attack vector in 2026 as LLMs gain the ability to browse, retrieve documents, and call tools.
AMTSO's Testing Guidance Is Turning Toward AI
AMTSO, the industry body that sets testing standards for security products, used its September 4, 2026 update to announce approval of new "Guidelines for Testing of Agentic Security Products" and an update to its Sandbox Evaluation Framework that also addresses AI-related features. That's a signal that sandbox testing methodology is starting to account for AI-driven and AI-targeted threats, alongside AMTSO's existing work on traditional malware detection.
The September update adds a seventh KPI called LLM-as-Sample Dynamic Analysis. It scores whether a sandbox can ingest an LLM endpoint or model file as a sample, run it through a structured prompt battery under reproducible conditions, and classify its responses the same way it would classify a binary’s behavior. The KPI avoids judging model safety or alignment, as these are assigned to AMTSO’s AI Working Group. LLM-as-Sample Dynamic Analysis nevertheless scores a sandbox on reproducibility metadata and per-category reporting, which is the same discipline sandboxes are already held to for malware samples.
MetaDefender Aether's Adaptive Sandbox already has a track record under AMTSO-aligned testing. In Venak Security's 2026 evaluation, it detected 19 of 20 AI-generated malware samples, the top score among four tested sandboxes. LLM Scanning extends that same sandbox-grade rigor to a threat surface AMTSO's guidance is only beginning to formalize, and it puts MetaDefender Aether among the first sandbox solutions to support it.
What LLM Scanning Adds to MetaDefender Aether™ v3.3.0
MetaDefender Aether is OPSWAT's unified, five-layer zero-day detection solution, combining threat reputation checks, pre-execution static analysis, emulation-based dynamic analysis, threat scoring, and threat hunting into a single verdict per file. Version 3.3.0 extends two of those layers, Layer 2 Static Analysis and Layer 3 Dynamic Analysis, to inspect AI and machine learning model files.
A threat can be baked into a model file before it ships, or it can live in how the model responds once deployed. LLM Scanning covers both paths rather than treating them as separate problems.
Layer 2 Static Analysis: Inspecting the Model File Itself
Static analysis parses a model down to its structure without ever executing it. It supports 7 file formats across the major AI frameworks: Pickle, PyTorch, TensorFlow, Keras, SafeTensors, GGUF, and ONNX, and detects the true format from a file's own bytes rather than trusting its extension, so a renamed payload can't slip past on name alone.
Each format carries its own risk. Pickle and PyTorch allow arbitrary code execution during deserialization. TensorFlow's .pb format can hide a Lambda Layer that enables code execution. Keras .h5 files can carry a marshal-serialized Lambda layer with the same effect. SafeTensors headers and the gaps between tensors can conceal tampering or a polyglot file. GGUF chat templates can be turned into executable logic, and malformed GGUF headers are built to crash or exploit loaders. ONNX graphs can reference external files by path, call custom operators that run code, or carry a logic-level backdoor that only triggers on specific inputs.
Static analysis walks Pickle opcode by opcode with a purpose-built disassembler, disassembles serialized objects inside .pkl, .pt, and .h5 files, and inspects .safetensors and .gguf headers for malformed structures. It exposes embedded payloads, dangerous imports, and anomalous signatures through 30+ dedicated threat indicators, and streams multi-gigabyte models with a bounded memory footprint so scale doesn't force a tradeoff on depth.
One showcase example shows why this matters: a Stacked Pickle sample nested multiple Pickle objects and split a payload across layers, each one looking benign on its own. LLM scanning peels those layers one at a time, decoding and decompressing each segment and reconstructing the full payload without running the code.
Layer 3 Dynamic Analysis: Testing the Model's Live Behavior
A clean model file is not a guarantee of safe behavior. Dynamic analysis connects to any model exposing an OpenAI-compatible chat-completions endpoint and sends it adversarial prompts, judging the responses to expose weaknesses that only appear at inference time.
50+ techniques and 1,000+ adversarial prompts spanning multiple categories of LLM-specific attack behavior. Prompt injection coverage includes direct injection, indirect injection through third-party content, and jailbreak or safety-bypass techniques like refusal suppression and adversarial suffixes. Sensitive information disclosure testing checks for credential leaks, PII exposure, and unauthorized discosure of sensitive documents.
Additional categories cover AI supply chain compromise, data and model poisoning (including RAG and persistent-memory poisoning), improper output handling, excessive agentic tool misuse, system prompt leakage, disinformation and fraud-content generation, and unbounded consumption attacks that burn tokens and cost. Multiple judging mechanisms score each response, and results use two-axis verdicts that separate how confident a finding is from how damaging it would be, making results easier to triage than a single pass/fail score.
The Five-Layer Pipeline Behind LLM Scanning
Static and dynamic LLM findings don't stand alone. They're tagged with techniques from MITRE ATLAS, the adversarial machine learning knowledge base, and roll into MetaDefender Aether's consolidated verdict alongside Layer 1 Threat Reputation, Layer 4 Threat Scoring, and Layer 5 Threat Hunting. That consolidated verdict comes with supporting evidence attached, so analysts get context for faster investigation and response instead of a bare flag. A model that triggers a static red flag and a behavioral one gets correlated into a single, prioritized risk score instead of two disconnected findings an analyst has to reconcile manually.
The Beneficiaries of LLM Scanning
LLM Scanning gives different security roles a way to act on the same finding, not just SOC teams working through alerts one at a time.
- SOC analysts get a consolidated verdict for flagged models, the same workflow they already use for files, instead of a separate, disconnected process for AI artifacts
- Security team leaders get visibility into what's actually moving through model registries and pipelines before it reaches production
- CISOs and IT decision-makers get a control point for enforcing model vetting policy across open-source and third-party AI adoption, work that today often happens with no review at all
- Compliance and risk teams get MITRE ATLAS-mapped evidence when regulators or auditors start asking how the organization is handling AI supply chain risk
LLM Model Threats Across Industries
Finanzas
Banks and financial institutions are adopting LLMs for fraud detection, customer service, and internal copilots, often built on open-source foundation models pulled from public hubs. A 2026 Cambridge study found 81% of financial services firms are already adopting AI at some level. A backdoored or data-leaking model sitting inside a fraud pipeline or customer-facing chatbot creates direct exposure to regulated financial data.
Gobierno
Government and defense agencies face model supply chain risk compounded by the sensitivity of what those models might touch: citizen data, classified or controlled information, and mission-critical decision support. CISA published new federal guidance in 2026 specifically addressing how agencies should evaluate open source AI models before adoption. A compromised or manipulated model is a potential vector for disinformation or sabotage inside systems the public depends on.
Energía
Energy and utility operators are starting to layer AI into grid monitoring, predictive maintenance, and operational decision support, environments where OT and IT increasingly intersect. Energy sector cyber risk research has found that a meaningful share of operational technology devices carry known exploited vulnerabilities and remain insecurely connected to the internet, exposure that grows as AI is layered on top of these systems.
Sanidad
Healthcare organizations are adopting LLMs for clinical documentation, triage support, and administrative automation, often processing protected health information in the process. A 2026 peer-reviewed review found that LLM-based medical applications can leak medical data through API usage, raising direct HIPAA compliance concerns. A model that leaks sensitive data through its outputs, or that carries executable code in its weights, puts patient data and regulatory compliance at risk at the same time.
Fabricación
Manufacturers are pulling AI models into quality control, predictive maintenance, and design automation, frequently sourcing from public model hubs to move fast. A 2026 manufacturing supply chain security analysis named data poisoning a top AI risk in this sector specifically because attackers can corrupt training data to subtly manipulate predictive maintenance and quality control decisions. A poisoned model in a quality-control pipeline can silently degrade decision-making without an obvious failure signal, and a backdoored model in a design tool creates a path into intellectual property.
Vetting AI models before they reach production no longer has to be a manual, best-effort process. MetaDefender Aether v3.3.0 brings the same five-layer rigor OPSWAT applies to files to the models organizations are adopting faster than they can review them
Preguntas frecuentes
What is LLM Scanning in MetaDefender Aether?
AI Model Scanning is MetaDefender Aether's capability that analyzes pretrained LLM model files and probes deployed models for security risks before they reach production, covered across Layer 2 Static Analysis and Layer 3 Dynamic Analysis.
Which model file formats does LLM scanning support?
Static analysis parses 7 formats: Pickle, PyTorch, TensorFlow, Keras, SafeTensors, GGUF, and ONNX, covering the major AI frameworks in use today.
Does static analysis execute the model?
No. Static analysis parses a model down to its structure and never executes it, identifying embedded payloads, dangerous imports, and anomalous signatures without detonation.
How does dynamic analysis test a deployed model?
Dynamic analysis connects to any model exposing an OpenAI-compatible chat-completions endpoint and sends it 50+ adversarial techniques and 1,000+ prompts covering nine categories of LLM-specific attack behavior, with findings mapped to MITRE ATLAS for adversarial machine learning.
Is MetaDefender Aether the only sandbox with LLM scanning?
MetaDefender Aether is among the first sandbox solutions to add LLM scanning, arriving as AMTSO's updated Sandbox Evaluation Framework turns its testing guidance toward AI-related features.
How do LLM scanning findings fit into Aether's overall verdict?
Findings are tagged with MITRE ATLAS techniques and feed into MetaDefender Aether's consolidated, five-layer verdict alongside Threat Reputation, Threat Scoring, and Threat Hunting.
