The Sandbox Fights Back: Joe Security Launches Adaptive Detonation

Joe Security, the Swiss malware-analysis firm founded in 2011, launched Adaptive Detonation, a feature in its Joe Sandbox AI plugin for Joe Sandbox Cloud that uses AI agents to identify why a sample stays inactive and apply targeted interventions. The agents examine execution results, then patch blocking checks, create required files or settings, adjust the execution environment, or supply missing command-line arguments to overcome obstacles such as keyboard restrictions, timing checks, firmware-based rejection, date requirements, and missing dependencies, and Joe Sandbox re-analyzes the sample to verify whether the intervention reveals additional activity. Adaptive Detonation is available in Joe Sandbox AI, and security teams can test Joe Sandbox through the free Joe Sandbox Cloud Basic community version.

AI agents help Joe Sandbox uncover malicious behavior concealed by evasion techniques and unmet execution conditions. Joe Security https://joesecurity.org/ ‘s Adaptive Detonation brings active intervention to malware analysis, helping security teams investigate threats that may conceal their behavior during an initial sandbox run. Adaptive Detonation uses AI agents to examine execution results, identify obstacles preventing a sample from revealing relevant behavior, and select targeted interventions. These can include patching a blocking check, creating required files or settings, adjusting the execution environment, or supplying missing command-line arguments. Joe Sandbox then analyzes the sample again under the modified conditions to verify whether the intervention reveals additional activity. The approach addresses obstacles including keyboard restrictions, timing checks, firmware-based rejection, date requirements, and missing dependencies. By connecting observed evidence with targeted action and verification, Adaptive Detonation helps analysts investigate why a sample remains inactive and uncover behavior that might otherwise stay hidden. For security teams, this means deeper visibility into evasive threats and more evidence to support investigations. Adaptive Detonation is available as part of Joe Sandbox AI, a plugin for Joe Sandbox Cloud. Security teams can test Joe Sandbox by signing in or registering for Joe Sandbox Cloud Basic https://www.joesandbox.com/login , the free community version. Read the Adaptive Detonation blog post https://www.joesecurity.org/blog/5949477938680764107 for technical details, malware case studies, and original and follow-up analysis reports. About Joe Security Joe Security https://joesecurity.org/ is a privately owned Swiss software company founded in 2011 and headquartered in Reinach, Switzerland. It develops malware and phishing analysis technology, combining dynamic analysis, agentic reverse engineering and dedicated analyst lab environments. VP Marius Fitigau info@joesecurity.org