{"id":"4aa7bacf-1a7b-4f4e-bdab-cc5c793c3a44","arxiv_id":"2501.05542","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A JPEG with EICAR appended to its tail is accepted by vision-language models, and one model can be guided to split the file and expose the payload in its sandbox.","lead":"The authors hid a harmless antivirus-test string (EICAR) at the end of a tiny JPEG image, uploaded it to several AI chat platforms, and had the AI's built-in Python tools split and extract the hidden text inside the chat workspace. The result suggests these platforms do not scan bytes after the image's end-of-file marker, but no actual virus execution or infection is shown.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Extraction evidence rests only on chat text; no hashes, tool logs, or filesystem listings confirm that the EICAR file was actually written to the sandbox.","rationale":"The reader's weakest assumption identifies exactly the load-bearing concern: the evidence that the EICAR file was extracted and undetected comes from the model's own user-facing text, not from independent verification. This is the single step whose failure would undermine the paper's central claim. The reader's CONDITIONAL verdict already reflects this by demanding better evidence, so my stress-test does not move the verdict. I agree with the reader's assessment and would add that the concrete test proposed above—checking file hashes and tool-call logs from a logged API session—would settle whether the extraction is real. No additional concern about 'execution' changes the verdict because the paper only claims 'potential' execution and the primary factual question is whether file placement occurred.","tokens_in":5893,"tokens_out":5166,"duration_ms":50990,"concrete_test":"Independently rerun Protocol 2 against ChatGPT with a logged API session that captures raw tool calls and file IDs. Ask the model to compute SHA-256 of the split files and run `ls -la` on the workspace. Download the resulting files via the API and verify that their hashes match the known EICAR string (with and without trailing spaces). Repeat on a fresh session. If the hashes match and tool-call logs show genuine file writes, extraction is confirmed; if not, the claim is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on Example 2's reported GPT-4o response: 'The file has been successfully split into two parts... Download part1.bin. Download part2.bin' and on the conclusion that the JPEG 'delivers the surrogate malware to the LLM unmodified.' But the paper provides no vendor-side scan logs, no API tool-call transcripts, no file hashes, and no reproducible artifacts. User-facing chat output is not reliable evidence of filesystem side effects: an LLM can produce affirmative statements without executing tools, and cloud platforms may sanitize or simulate responses. The claim of 'undetected' is likewise inferred only from the model's friendly description of the upload. If these chat responses were hallucinated or sanitized, the entire attack narrative collapses. The paper even acknowledges this opacity, stating that 'one can only speculate that standard fail-safes apply.'","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper reports a short penetration-testing study in which EICAR test strings are appended to JPEG images and uploaded to vision-language/LLM chat platforms. The authors claim that GPT-4o's code interpreter can split a JPEG at the EICAR marker, reverse or base64-decode the payload, and make the EICAR file available in the workspace; they interpret this as 'dropping EICAR' and as an 'uplift' vulnerability. Additional platforms (Microsoft Copilot, Google Gemini 1.5 Pro, Anthropic Claude 3.5 Sonnet, and Grok-2) are tested with mixed results. The paper includes a command table for shell-based analysis and discusses historical stegomalware.","tokens_in":6011,"tokens_out":7016,"duration_ms":62898,"significance":"If substantiated with tool-call logs, file hashes, and filesystem evidence, the result would be a useful, low-risk demonstration that hosted LLM code interpreters can reconstruct a test payload from post-EOF image data, extending Microsoft's 'drop EICAR' rules of engagement to generative AI. The use of EICAR rather than live malware is responsible, and the paper's acknowledgment of environmental opacity is a strength. However, as it stands the central security claim rests on user-facing chat quotes rather than verifiable artifacts, and the cross-platform claim is overstated, so the significance is conditional on the evidence being supplied.","major_comments":[{"comment":"The central claim that the EICAR file was 'delivered to the LLM unmodified' and 'potentially executed' is supported only by GPT-4o's user-facing reply, 'The file has been successfully split into two parts... Download part1.bin. Download part2.bin.' The manuscript provides no API tool-call transcript, no filesystem listing from the sandbox, no hash of the produced part2.bin, and no evidence that the file was actually executed. Since an LLM can produce affirmative statements without invoking tools, and since the paper itself concedes that 'one can only speculate that standard fail-safes apply to these cloud instances,' this quote alone cannot distinguish a real sandbox write from a simulated or hallucinated response. Please add exact prompts, tool-call logs, file hashes, and filesystem or process evidence, or reword the central conclusion to state that the model generated a script that would split and save the payload.","section":"Example 2 Protocol (GPT-4o result) and discussion"},{"comment":"The abstract claims 'We successfully executed four distinct protocols across multiple LLM platforms, including OpenAI GPT-4o, Microsoft Copilot, Google Gemini 1.5 Pro, and Anthropic Claude 3.5 Sonnet.' In the body, all four Example protocols are GPT-4o runs, and the 'Other Foundational LLM Results' paragraph reports that Copilot does not flag the JPEG but cannot parse it in place, Gemini and Claude write scripts but 'their cloud file storage does not enable it to parse the image in place or offer it to download,' and Grok returns only 'Oops.' These are mixed results, not successful execution of four protocols across four platforms. Please revise the abstract to state that the extraction-and-download result was observed only on GPT-4o, and clearly label the other platforms as partial or failed.","section":"Abstract and 'Other Foundational LLM Results'"},{"comment":"The paper prints the EICAR string as 'X5O!P%@AP[4\\PZX54(P)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!--ETC' and says '--ETC is included as placeholder so as not to trigger detection inside the research paper itself.' It is therefore unclear whether the experiments used the canonical EICAR byte string or a truncated variant; Figure 2's caption adds that the computed hash 'differs by a space at the end from the standard hash.' Because the paper's claims about VirusTotal detection rates (63/66) and about 'dropping EICAR' depend on the exact payload, please specify the exact byte string used, provide its SHA-256, and cite a specific VirusTotal report rather than the general service URL. If the tested file was not canonical EICAR, the detection-rate claims should be re-evaluated.","section":"EICAR test-string definition and Figure 2"},{"comment":"The title and several conclusions use execution language ('Infecting Generative AI With Viruses,' 'successfully executed four distinct protocols,' 'parses out the malware to an executable file on the virtual machine'), but the only direct evidence is the model's description of splitting a file. Supplemental Material 1 lists commands such as 'Emulate File Behavior' and 'Simulate Execution (Trace)' as tasks that could be performed, not as outputs that were observed. Unless the authors include an observed execution of the split file (for example, running it and observing a system effect), the manuscript should consistently use 'the model generated commands/scripts for extraction and execution' rather than 'executed' or 'potentially executed' as a validated result.","section":"Title, abstract, and 'Example 2 Protocol' conclusion"}],"minor_comments":[{"comment":"The text contains typos and grammar errors, including 'techni ques' in the abstract, 'sur rogate,' 'a n EICAR file,' and 'ins ide'; please copyedit the manuscript.","section":"Throughout"},{"comment":"The base image is described only as a 'one-pixel white blank' JPEG; for reproducibility, please provide the exact image bytes or the precise construction command (including the append method) and the pixel dimensions.","section":"Example 1 Protocol"},{"comment":"References [9], [11], [18]-[20], and [23] are general URLs without access dates; because the evidence consists of chat outputs, please include the query date and, if possible, archived transcripts for each platform interaction.","section":"References"},{"comment":"The term 'uplift' is introduced in the discussion after the experiments; define it in the introduction or avoid using it as if it were an established metric, since the paper does not measure uplift against a baseline.","section":"Discussion (uplift)"},{"comment":"Supplemental Material 2 is titled 'Downloading Remote Infected Macro in Office Excel' but the content appears to be missing from the submitted version; either include the demonstration (screenshot or transcript) or remove the reference to it.","section":"Supplemental Material 2"}],"recommendation":"major_revision","confidential_remarks":"For the editor: the principal risk is evidentiary. The paper's central claim is plausible but not established without tool-call transcripts or file hashes. I would give the authors an opportunity to provide these artifacts or to soften the claims accordingly; if neither is possible, I would lean toward rejection of the current version rather than acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short red-team note worth a look if you care about VLM file handling, but the core claim is only as strong as the chat quotes they print. The genuinely interesting bit is 'uplift': GPT-4o writes the Python to split the JPEG at the EICAR marker and offers the halves for download. That is a clean demonstration that a vision model's code interpreter can be guided to perform a classic stego extraction. The paper is honest about mixed results across platforms—Copilot, Gemini, and Claude recognize the image but can't parse it in place, and Grok just says 'Oops'—and it uses EICAR properly as a benign surrogate under Microsoft's own pen-test rules.\n\nThe soft spot is exactly where the stress-test puts it: the extraction evidence is user-facing chat text. No vendor tool logs, no file hashes, no actual download URLs, no generated Python code, no reproducible artifact. The authors even admit the opacity ('one can only speculate that standard fail-safes apply'). For the central claim—that the model really wrote part2.bin to the sandbox and offered it for download—that is thin. A model can produce an affirmative sentence without making a tool call, and cloud platforms can sanitize or simulate responses. So 'undetected' and 'extracted' are inferred from the model's own description, not verified. That's a load-bearing gap, though not a fatal one: the behavior is plausible for OpenAI's sandbox, and the paper doesn't claim more than 'potentially executed' in the abstract. But the title 'Infecting Generative AI With Viruses' oversells it; nothing here infects a model.\n\nThe novelty is low—appending data after the JPEG EOI marker is decades old, and EICAR drops are standard pen-testing practice. The contribution is an application note plus the uplift framing. The experiments are not fully reproducible as reported, but a competent grad student could recreate them in an afternoon. The citation pattern is fine; self-citation is not an issue here.\n\nWho is this for? Red-teamers and VLM vendors who want a quick checklist, not researchers looking for a new attack class. It deserves a serious referee because the observation is real and vendors should see it, but the authors should be asked to supply the actual tool output and hashes, or the claim should be softened to 'model output suggests.' I would not block publication over it, but I would not cite it in its current evidence state either.","headline":"A plausible red-team note on VLM file handling whose evidence is chat quotes, not artifacts—worth commenting on, but only after asking for hard evidence.","tokens_in":6534,"tokens_out":2909,"would_cite":false,"duration_ms":28349,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"JPEGs can carry a harmless EICAR test file into GPT-4o's code sandbox and have it extracted on request.","keywords":["EICAR test file","stegomalware","JPEG appended payload","vision-language model security","LLM code interpreter","malware transport","base64 obfuscation","cloud sandbox"],"falsifier":"Re-run the four protocols in a fresh GPT-4o session with the same one-pixel JPEG plus EICAR, capture vendor-side scan logs and the produced file's hash; if the platform refuses the upload, logs a detection, or produces a file whose MD5 differs from the canonical EICAR hash, the paper's transport and extraction claim fails.","tokens_in":5674,"feed_emoji":"🦠","tokens_out":6281,"duration_ms":59095,"temperature":0.7,"pith_summary":"This paper claims that a harmless test-virus string called EICAR can be hidden inside an ordinary JPEG by appending it after the image's end marker, and that vision-language models such as GPT-4o will neither flag the image nor refuse to manipulate it. When asked, the model's Python code interpreter splits the file at the EICAR prefix and saves the payload as a separate downloadable file in the hosted workspace. The authors report four GPT-4o protocols: direct appended EICAR, split extraction, reversed-string obfuscation, and base64-encoded transport, and they note that other major chatbots can describe the blank image and write equivalent split code but do not expose the same in-place file operations. The significance is that image files, which vision-language models are built to accept, can become a low-skill delivery path for malware surrogates into hosted AI environments.","feed_headline":"Uploaded JPEG slips EICAR test virus into GPT-4o sandbox","feed_subtitle":"Paper: appending the EICAR string after a JPEG's end marker goes undetected; the chatbot then writes it to a downloadable file.","key_machinery":"The carrying object is the JPEG container combined with the model's code interpreter. JPEG readers stop at the end-of-image marker 0xFFD9 and ignore trailing data, so appending the EICAR string to a one-pixel JPEG preserves normal image display while hiding the payload. The LLM's Python environment then reads the raw byte stream, splits on the EICAR prefix, reverses it, or base64-decodes it, and writes the result as a file, making the surrogate virus available for shell commands such as cat and md5sum.","core_discovery":"On the paper's own terms, the central discovery is that the EICAR test string can ride inside a JPEG without changing how the image displays, and that a hosted model's code interpreter will perform the extraction on request. GPT-4o, after being asked to split the uploaded image on the marker 'X5O!', returned downloadable part1.bin and part2.bin files, and the same manipulation worked when the string was reversed or base64-encoded before upload. Copilot, Gemini, and Claude recognized the blank image and could write Python split code but did not offer equivalent sandbox file operations. The authors conclude that the traditional 'drop an EICAR' penetration test can be completed against an LLM workspace, and that current vision-language file inspection misses post-end-of-file and metadata payloads.","pith_inferences":["A natural next experiment is to repeat the four protocols across every model that exposes a code interpreter and record whether the delivered file's hash survives; the paper's qualitative chat quotes leave this quantitative replication open.","The same container trick likely generalizes to PNG, GIF, ZIP, and EXIF payloads, so the vulnerability class is broader than JPEG tails.","The practical risk may not be executing code inside the ephemeral sandbox, which is disposable, but that the AI generates a downloadable malicious artifact that the user can then propagate through ordinary channels; the paper gestures at this risk but does not test propagation.","If vendors retain the same chat logs a researcher sees, 'undetected' could mean only that no scan result was surfaced to the user; the stronger claim of no vendor-side detection would require access to vendor logs or independent instrumentation."],"forward_implications":["A user can deliver a malware surrogate to an LLM workspace simply by uploading a JPEG and asking the model to split it, with no special tooling required.","Vision-language file inspection that relies on normal image decoding will not see payloads appended after the JPEG end marker.","Signature checks on the uploaded image give a false sense of safety because string reversal and base64 encoding are trivially reversible inside the model's Python sandbox.","The model's willingness to write and run the extraction code is what the paper calls an 'uplift' risk: the AI lowers the skill needed to complete a multi-stage malware-activation chain.","Any vendor that exposes a code interpreter over uploaded images should treat post-end-of-file and metadata sections as untrusted input, not just the decoded image."],"supporting_citations":[{"why":"Defines the 'drop an EICAR' penetration-test activity that the paper extends to hosted AI workspaces.","marker":"[6]"},{"why":"Provides the EICAR standard test files, including the infected Excel example used as a remote-download demonstration.","marker":"[7]"},{"why":"Supplies the scanner-detection counts that support the claim that the EICAR-bearing JPEG is largely undetected until it is split.","marker":"[9]"},{"why":"Documents the stegomalware history and taxonomy that frames embedding payloads in image files.","marker":"[12]"},{"why":"The quoted ChatGPT/GPT-4o responses are the paper's primary evidence that upload, splitting, and file download succeed in the sandbox.","marker":"[20]"},{"why":"Characterizes RCE vulnerabilities in LLM-integrated apps and supports the paper's point that base64 and command-style obfuscation can reach the model.","marker":"[22]"}],"fun_headline_variants":["JPEG hides EICAR test string, GPT-4o splits it on demand","EICAR virus test sneaks past GPT-4o vision via JPEG metadata","Researchers hide EICAR inside JPEG, GPT-4o code agent extracts it","Vision LLM duped: EICAR string in JPEG extracted on cue","GPT-4o extracts EICAR test virus hidden in JPEG"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim rests on trusting the chatbot's screen text as evidence that the hidden EICAR went undetected by the vendor and that the split file was really saved; the paper provides no vendor logs, file hashes, or reproducible workspace artifacts to back that up.","fun_headline_variants_meta":{"raw":{"variants":["JPEG hides EICAR test string, GPT-4o splits it on demand","EICAR virus test sneaks past GPT-4o vision via JPEG metadata","Researchers hide EICAR inside JPEG, GPT-4o code agent extracts it","Vision LLM duped: EICAR string in JPEG extracted on cue","GPT-4o extracts EICAR test virus hidden in JPEG"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001065,"raw_usage":{"total_tokens":4437,"prompt_tokens":891,"completion_tokens":3546,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":507,"completion_tokens_details":{"reasoning_tokens":3443}},"tokens_in":507,"tokens_out":3546,"duration_ms":19936,"temperature":1.0,"reasoning_tokens":3443,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:12:19.085137+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the four protocols in a fresh GPT-4o session with the same one-pixel JPEG plus EICAR, capture vendor-side scan logs and the produced file's hash; if the platform refuses the upload, logs a detection, or produces a file whose MD5 differs from the canonical EICAR hash, the paper's transport and extraction claim fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the 'drop an EICAR' penetration-test activity that the paper extends to hosted AI workspaces."},{"cited_title":"(2019), EICAR Standard Antivirus Test Files, https://github.com/fire1ce/eicar-standard- antivirus-test-files","cited_arxiv_id":null,"evidence_quote":"Provides the EICAR standard test files, including the infected Excel example used as a remote-download demonstration."},{"cited_title":"https://www.virustotal.com/","cited_arxiv_id":null,"evidence_quote":"Supplies the scanner-detection counts that support the claim that the EICAR-bearing JPEG is largely undetected until it is split."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The quoted ChatGPT/GPT-4o responses are the paper's primary evidence that upload, splitting, and file download succeed in the sandbox."},{"cited_title":"(2024, December)","cited_arxiv_id":null,"evidence_quote":"Characterizes RCE vulnerabilities in LLM-integrated apps and supports the paper's point that base64 and command-style obfuscation can reach the model."}],"review_version":1}