# LLM-generated malware

Published articles for LLM-generated malware.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How attackers are jailbreaking LLMs with CTF framing and how to catch them

DevFeed: [How attackers are jailbreaking LLMs with CTF framing and how to catch them](<https://devfeed.tech/articles/how-attackers-are-jailbreaking-llms-with-ctf-framing-and-how-to-catch-them-53224.md>)

Original publisher: [Read original article](<https://webflow.sysdig.com/blog/how-attackers-are-jailbreaking-llms-with-ctf-framing-and-how-to-catch-them>)

Author: Michael Clark

Published: 2026-06-15T00:00:00Z

Content type: article

Language: en

Sources: [Sysdig Blog](<https://devfeed.tech/sources/sysdig-blog.md>)

Topics: [Machine Learning, Security Attacks](<https://devfeed.tech/topics/machine-learning-security-attacks.md>), [Jailbreak](<https://devfeed.tech/topics/jailbreak.md>), [Security research](<https://devfeed.tech/topics/security-research.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [LLMs](<https://devfeed.tech/topics/llms.md>), [ctf](<https://devfeed.tech/topics/ctf.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>)

Tags: [agentic-ai-attacks](<https://devfeed.tech/tags/agentic-ai-attacks.md>), [ai-assisted-attacks](<https://devfeed.tech/tags/ai-assisted-attacks.md>), [ai-red-team](<https://devfeed.tech/tags/ai-red-team.md>), [ai-threat-detection](<https://devfeed.tech/tags/ai-threat-detection.md>), [aws-credential-harvesting](<https://devfeed.tech/tags/aws-credential-harvesting.md>), [bedrock-abuse](<https://devfeed.tech/tags/bedrock-abuse.md>), [cloud-threat-intelligence](<https://devfeed.tech/tags/cloud-threat-intelligence.md>), [cnapp-threat-research](<https://devfeed.tech/tags/cnapp-threat-research.md>), [coding-assistant-abuse](<https://devfeed.tech/tags/coding-assistant-abuse.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [ctf-framing-exploit](<https://devfeed.tech/tags/ctf-framing-exploit.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-exploit-generation](<https://devfeed.tech/tags/cve-exploit-generation.md>), [cve-templated-user-agent](<https://devfeed.tech/tags/cve-templated-user-agent.md>), [detection](<https://devfeed.tech/tags/detection.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [gotenberg-cve](<https://devfeed.tech/tags/gotenberg-cve.md>), [iam](<https://devfeed.tech/tags/iam.md>), [jailbreak](<https://devfeed.tech/tags/jailbreak.md>), [jailbreak-detection](<https://devfeed.tech/tags/jailbreak-detection.md>), [langflow-exploit](<https://devfeed.tech/tags/langflow-exploit.md>), [litellm-cve](<https://devfeed.tech/tags/litellm-cve.md>), [llm-generated-malware](<https://devfeed.tech/tags/llm-generated-malware.md>), [llm-jailbreak](<https://devfeed.tech/tags/llm-jailbreak.md>), [llm-safety-bypass](<https://devfeed.tech/tags/llm-safety-bypass.md>), [llms](<https://devfeed.tech/tags/llms.md>), [open-webui-vulnerability](<https://devfeed.tech/tags/open-webui-vulnerability.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [praisonai-cve](<https://devfeed.tech/tags/praisonai-cve.md>), [prompt](<https://devfeed.tech/tags/prompt.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [runtime-detection](<https://devfeed.tech/tags/runtime-detection.md>), [sysdig](<https://devfeed.tech/tags/sysdig.md>), [sysdig-trt](<https://devfeed.tech/tags/sysdig-trt.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [user-agent-fingerprinting](<https://devfeed.tech/tags/user-agent-fingerprinting.md>), [waf-detection-rules](<https://devfeed.tech/tags/waf-detection-rules.md>)

### AI overview

Sysdig's Threat Research Team describes attackers using capture-the-flag and CVE-hunting framing to manipulate upstream LLMs into generating exploit code. The resulting prompts and outputs can leak into request fields and are then deployed against real applications.

### Source excerpt

Sysdig TRT caught threat actors jailbreaking LLMs with CTF framing to generate CVE exploits -- and the prompt structure leaks into headers, passwords, and IAM logs.