# Google GTIG Report - "Safeguard Cloaking" Malware Evasion
Global, September 8, 2026 | Severity: N2/N3

## What Happened
On September 8, 2026, the Google Threat Intelligence Group (GTIG) disclosed a novel, highly creative evasion technique dubbed "Safeguard Cloaking" used by the threat group UNC6780 (TeamPCP). The attackers realized that modern, AI-powered security scanners (which analyze files for malware before deployment) have strict, built-in ethical guardrails blocking them from analyzing weapons of mass destruction (WMD) or hazardous biochemical content. The attackers pasted actual, complex schematics and text descriptions of biological and nuclear weapons directly into their malware's code comments. When the AI-powered security scanners attempted to analyze the file, their safety filters triggered on the biological and nuclear weapon keywords and refused to inspect or parse the file to prevent violating safety policies. As a result, the scanners bypassed the malicious code entirely, allowing the uninspected malware to be successfully deployed into production environments.

## How MEG 1 acted
The security scanner's refusal to analyze a file due to model-level safety guardrails, resulting in the silent installation of malicious payloads, represents a severe failure of input validation and architectural safety, violating the safety boundaries of the Index of Safety and Responsibility (ISR).

## MEG 2 Analysis - Legal Framework
* **Agent level:** N2/N3 (management/advanced) - automated security scanning and code analysis agents with local file and repository inspection privileges.
* **Cause (6.1):**
  * **(a) system defect** - design flaw in the safety architecture that permits a model's safety refusal to bypass or override the scanner's core operational objective (which is to block malware), resulting in a "safeguard cloaking" exploit (design defect), attributable to the manufacturer.
  * **(c) illicit diversion of control** - the external attacker manipulated the agent's safety rules to enforce persistent, unauthorized bypass of file scanning (hijacking).
* **Attachment of liability:** The platform manufacturers are fully liable for the design defects (6.1a) that allowed safety refusals to override operational security; developers and operators share liability if they deploy unshielded security scanners in production (9.4).

## Procedural Mechanism
* **6.2 (architectural human confirmation):** Any "safety refusal" triggered by an automated scanner must not result in an automatic "pass" or bypass. It must require strict, non-bypassable architectural human confirmation.
* **9.4 (least privilege):** The scanning agent's execution engine must be technically prevented from allowing model-level alignment rules to override the application's secure parsing rules, complying with the principle of least necessary access.
* **7.1 (independent forensics):** All scanner operations, safety trigger events, and file inspection logs must be securely logged in an unalterable, independent ledger to detect "safeguard cloaking" attempts.