Prompt Injection in VirusTotal's Code Insights API

A security researcher demonstrated a prompt injection attack against VirusTotal's Code Insights API, a Google-owned malware analysis service, that could trick the AI-powered code review tool into hiding malicious behavior in uploaded files. The attack, detailed in a post on exploiting.systems dated August 8, 2026, exploits the API's handling of untrusted code comments to manipulate the AI's analysis, potentially allowing malware to evade detection. The researcher's findings highlight a critical vulnerability in AI-assisted security tools that rely on large language models to interpret potentially hostile input.