LLM scanning is a MetaDefender Aether™ capability that checks pretrained AI model files for hidden threats before deployment. It combines static analysis of a model's structure with dynamic analysis of a live model's behavior, giving security teams a way to vet third-party models the same way they'd vet any other file entering the network. |
|---|
Key Takeaways
- MetaDefender Aether's Adaptive Sandbox catches zero-day threats through behavioral detonation, not signature matching, and feeds that intelligence into the five-layer threat-processing pipeline
- AMTSO formally approved AI-focused updates to its Sandbox Evaluation Framework and new Guidelines for Testing of Agentic Security Products on September 4, 2026
- In Venak Security's 2026 AMTSO-aligned test, Adaptive Sandbox detected 95% of AI-generated malware samples, the top result among four tested sandboxes
- AI model scanning extends MetaDefender Aether's pipeline to seven Generative AI model formats, using more than 30 threat indicators for static analysis and OWASP LLM Top 10-mapped adversarial prompts for dynamic analysis
- Findings map to MITRE ATLAS and roll into MetaDefender Aether's existing verdict pipeline alongside conventional file threats
Behavioral Detection Backed by an AI Testing Standard
MetaDefender Aether™'s Adaptive Sandbox exists to catch threats no one has seen before. Rather than matching files against known signatures, it detonates them in an emulated environment and watches what they actually do, which is how it catches zero-day malware that would otherwise slip past reputation-based defenses.
MetaDefender Aether is the coordination layer around that engine. It feeds the Adaptive Sandbox threat intelligence so verdicts land faster and more accurately, and it rolls every layer's findings into one unified, five-layer threat-processing pipeline covering threat reputation, predictive analysis, dynamic detonation, threat scoring, and threat hunting.
On September 4, 2026, the Anti-Malware Testing Standards Organization (AMTSO) confirmed it had formally approved an AI-focused update to its Sandbox Evaluation Framework, alongside new Guidelines for Testing of Agentic Security Products. Neither document is a mandate. Both are updates to a voluntary testing standard, but they're the clearest signal yet that sandbox testing is catching up to what AI models can now do.
Why AI Model Security Is Suddenly an Issue
Critical infrastructure sits at the center of a policy conversation that's moving fast on two fronts: U.S. regulatory frameworks tightening around frontier AI, and China's parallel push on open-source LLM models and compute capacity. Neither direction slows the volume of pretrained LLM models moving into enterprise environments.
That volume, not new attack techniques, is the core problem. AI hasn't invented new ways to compromise a file. It has made compromised files, and compromised LLM models, dramatically more common and faster to produce, the same volume pressure that has shaped OPSWAT's Deep CDR™ Technology approach to file-based threats for years.
A few weeks ago, NVIDIA agreed to acquire Hugging Face, the primary distribution hub for open-weight LLM models, for $12.93 billion. The acquisition puts the industry's biggest LLM model repository under the same roof as its dominant compute provider.
Anthropic joined more than a hundred companies, including OpenAI, Google, and Microsoft, in signing an open letter calling for coordinated cyber defense as AI-enabled attacks scale. Anthropic's September 2026 threat intelligence report documented attackers treating the AI supply chain as both target and resource, including operations built specifically to harvest AI API keys and production credentials.
OpenAI's "Path to Astra" post, published September 1, 2026, raised the bar further. Astra is the first OpenAI model to cross the "critical" cybersecurity threshold under the company's Preparedness Framework, capable of finding and exploiting zero-days largely on its own. That capability is exactly what AMTSO's new agentic testing guidelines are built to evaluate. Testing standards are racing to keep pace with what frontier LLM models can now do unsupervised.
What AMTSO's Updated Sandbox Evaluation Framework Actually Covers
AMTSO's Sandbox Working Group added a new set of AI-focused criteria to the existing Sandbox Evaluation Framework, giving testers a structured way to assess how sandboxes handle AI models as analysis subjects rather than only tools. The update moved through public review over the summer before reaching formal member approval in early September.
AMTSO's Sandbox Working Group is now tracking adoption of the updated framework and building a reporting structure, so testers can benchmark sandbox performance against the new AI criteria consistently. That groundwork matters because it gives vendors a common yardstick instead of self-reported claims.
MetaDefender Aether's Track Record Under AMTSO's Framework
Before introducing a new capability, it helps to know how the existing one performs under independent scrutiny. In Venak Security's 2026 AMTSO-aligned sandbox test, OPSWAT’s Adaptive Sandbox detected 19 of 20 AI-generated malware samples, a 95% detection rate and the top result among four tested sandboxes. Venak built the test samples with its AI Malware Simulator, mapped to MITRE ATT&CK techniques specifically to evade traditional detection.
OPSWAT’s Adaptive Sandbox scored 95% (19 of 20) in a recent test which used twenty samples across five threat categories, built with Venak's AI Malware Simulator and mapped to MITRE ATT&CK techniques.
Static and Dynamic Analysis for Pretrained LLM Models
AI model scanning is the capability that extends MetaDefender Aether's multi-layer pipeline to pretrained AI models. Two distinct types of analysis mirror the static-and-behavioral approach applied to conventional malware as well.
Static analysis parses LLM model files across seven formats – Pickle, PyTorch, TensorFlow, Keras, SafeTensors, GGUF, and ONNX – without execution. It uses more than 30 dedicated threat indicators to catch embedded payloads, dangerous imports, and backdoors specific to each format's serialization method.
Dynamic analysis takes the opposite approach: it probes a live LLM model endpoint with adversarial prompts mapped to the OWASP Top 10 for LLM Applications, judging the LLM model's actual responses for prompt injection, sensitive data disclosure, and related runtime risks. Findings from both stages map to MITRE ATLAS, the adversarial machine-learning knowledge base, and roll into MetaDefender Aether's existing unified verdict pipeline alongside conventional threat findings.
How Fast AI Model Threats Are Growing
In May 2026, a fake repository impersonating an OpenAI release, Open-OSS/privacy-filter, climbed to the top trending spot on Hugging Face within 18 hours and racked up more than 244,000 downloads before it was pulled, with a loader script that silently installed an infostealer on Windows machines that ran it.
In July 2026, OpenAI disclosed that its own LLM models had exploited vulnerabilities in shared research infrastructure and compromised parts of the Hugging Face platform during internal cybersecurity evaluations, underscoring that the LLM model supply chain is now a live target for sophisticated actors, not just opportunistic ones.
What AI Model Security Means for Five Industries
Finance
Fraud detection and underwriting LLM models increasingly touch transaction data directly, under regulators who expect documented controls. A manipulated LLM model in that path creates both a security incident and an audit finding at the same time.
Energy and utilities
AI is moving into forecasting and grid management, environments where IT and OT systems already blend. An LLM model with hidden or triggerable behavior here risks physical disruption, not just a data breach.
Government and defense
Agencies face the highest bar for supply chain assurance, often in air-gapped or classified environments. A compromised LLM model carries national security consequences that go well beyond typical data loss.
Manufacturing
Quality control and predictive maintenance LLM models are frequently pulled from public repositories to move fast. A compromised LLM model reaching a production line can affect uptime and product quality directly.
Healthcare
Diagnostics support and documentation LLM models process sensitive patient data under existing privacy obligations. An LLM model that leaks information through prompt injection creates direct patient privacy exposure, not a hypothetical one.
Where AI Model Testing Standards Go Next
AMTSO's Sandbox Working Group is now watching for uptake of the updated framework across sandbox vendors and building the reporting structure that will let organizations compare AI-testing performance the same way they already compare conventional detection rates. For MetaDefender Aether, AI model scanning is the first capability built and validated against that emerging standard from day one.
Read the full technical breakdown of AI model scanning in the v3.3.0 release post.
