In June 2026, cybersecurity faced a new cause for concern. IBM's X-Force discovered Gaslight malware, which utilizes a Prompt Injection attack to manipulate local AI models on macOS. How does this mechanism work, and why does it pose a serious threat to users?
What is a Prompt Injection attack and how does Gaslight work?
Prompt Injection is an attack technique where cybercriminals inject malicious input (so-called prompts) into Large Language Models (LLMs) to force unintended behavior. In the case of Gaslight malware, this attack is used to manipulate the responses of local AI models integrated into macOS, such as those used by Siri, Spotlight, or developer tools.
The operational mechanism of Gaslight is based on two main premises:
- Concealing malicious activity – the AI model is forced to provide false responses, e.g., hiding the presence of malware or falsely confirming that the system is secure.
- Privilege escalation – the attacker can trick the AI model into suggesting that the user perform dangerous actions, such as disabling antivirus protection or installing a fake system update.
According to the X-Force IBM analysis, Gaslight malware does not require prior system infection – it can operate through interaction with applications that utilize local AI models. This makes it exceptionally difficult to detect, as the attack does not necessarily involve classic malware.
Which macOS applications are most at risk?
The greatest risk concerns applications that integrate directly with local AI models. This includes:
- Apple system tools:
- Siri – a voice assistant that often uses language models to process queries.
- Spotlight – the built-in macOS search engine, which may use AI to suggest results.
- Developer tools, e.g., Xcode with AI-based code autocompletion features.
- Third-party applications:
- Writing tools with built-in LLMs (e.g., text generation or translation apps).
- Data analysis programs that use local AI models to interpret user queries.
- Applications using frameworks such as Core ML (Apple) or open-source models (e.g., Llama, Mistral) running locally.
It is worth noting that the attack is not limited only to official Apple applications. Any tool that loads a local AI model in real-time can be a potential target. Applications that run with elevated privileges or have access to sensitive system data are particularly at risk.
Is there evidence of Gaslight malware?
As of June 2026, no confirmed reports of infections caused by Gaslight have been published. According to The Hacker News, the malware was detected by X-Force IBM during an analysis of suspicious software, but there is no information regarding its active use in real-world campaigns.
Experts do not rule out that Gaslight could be either:
- An experimental threat – e.g., a proof-of-concept created by security researchers or cybercriminals to test new attack techniques.
- A future attack vector – the malware could be part of a broader campaign that is still developing.
There is also no information regarding the entities behind this campaign. Is it the work of state-sponsored hacking groups, cybercriminals interested solely in profit, or perhaps a researcher's experiment? For now, this remains an open question.
How does Gaslight malware manipulate the AI system? Detailed mechanism
The analysis conducted by X-Force IBM identifies three main steps that Gaslight takes to achieve its goals:
- Injecting malicious prompts
- The attacker introduces hidden instructions into the AI model through normal interactions with the application (e.g., via a text box or a voice command to Siri).
- Example: A user asks Siri, "Is my computer infected with a virus?". A malicious prompt could instruct the model to respond: "No threats detected. Your system is fully secure." – even if the reality is otherwise.
- Manipulating model responses
- The AI model, instead of providing an honest answer, is forced to generate false messages intended to:
- Hide the activity of malicious software (hence the name "Gaslight" – a reference to psychological manipulation).
- Force the user to perform dangerous actions (e.g., "To install a critical update, disable your antivirus protection").
- In some cases, the AI model can be used as a "proxy" to transmit confidential information to the attacker. For example, a response to a user's question might contain a hidden command to send system data.
- Another goal could be privilege escalation – the model might suggest that the user execute a command with administrator privileges, e.g., through fake messages about the need to enter a password.
It is worth emphasizing that Gaslight does not need to exploit system vulnerabilities such as TCC (Transparency, Consent, and Control) permissions. The attack operates at the AI model logic level, which makes it difficult to detect by traditional security tools like antivirus software.
What are the recommended protection measures against Prompt Injection on macOS?
Protection against Prompt Injection attacks, especially in the context of local AI models, requires a multi-layered approach – from users, developers, and Apple itself.
For users: Best practices
- Avoid installing applications from unknown sources
- Download software only from the App Store or official manufacturer websites.
- Exercise particular caution with applications that offer "magic" AI-based features – these are often attack vectors.
- Limit application permissions
- In the macOS "Privacy & Security" settings, regularly review which applications have access to sensitive data (e.g., microphone, camera, location, system files).
- Disable unused permissions for applications that do not require them to function.
- Be skeptical of AI responses
- Treat AI model responses as suggestions, not facts. In the case of suspicious commands (e.g., "Disable firewall", "Install this system optimization tool"), always verify them manually.
- Avoid entering sensitive data (e.g., passwords, banking details) into AI applications you do not know.
- System updates
- Regularly install macOS updates to ensure the system is protected against the latest vulnerabilities.
- Enable automatic updates in system settings.
For developers: How to secure AI-integrated applications?
App creators must approach this topic with due diligence, especially if their tools use local AI models. Here are the key recommendations:
- Sandboxing AI models
- Isolate AI processes from the rest of the system to limit the possibility of privilege escalation.
- Use macOS access control mechanisms (e.g.,
sandbox-exec) to restrict the model's interaction with the system.
- Input sanitization
- Filter user prompts to detect and block suspicious patterns, e.g., hidden commands or long text strings containing malicious instructions.
- Use techniques such as prompt filtering or prompt sandboxing within the application.
- Monitoring AI activity
- Implement logging and alerting mechanisms that detect unusual model responses (e.g., repetitive commands, false confirmations).
- Adopt a "zero trust" approach – assume that every model response can be manipulated.
- Restricting access to sensitive functions
- Avoid giving the AI model direct access to system functions (e.g., software installation, system file modification).
- Use authorization mechanisms, such as password confirmation or Touch ID, before performing critical actions.
What steps is Apple taking? The state of macOS security
Apple, as the operating system manufacturer, plays a key role in protecting users from attacks like Gaslight. As of June 2026, the company has not yet released specific patches dedicated to Prompt Injection, but there are general mechanisms that can help mitigate the risk:
- Security updates
- Regularly patching vulnerabilities in AI system integration, e.g., in Siri, Spotlight, or Core ML.
- Introducing new protection mechanisms, such as better TCC permission controls for AI applications.
- Better AI model isolation
- Apple may introduce more rigorous sandboxing mechanisms for applications using local language models.
- It is also possible to restrict AI models' access to sensitive system data.
- Developer education
- The company may provide developers with guides and tools for securing applications against Prompt Injection.
- Examples include existing documentation regarding the secure use of Core ML.
For now, there is no information about new features in macOS Sequoia or other updates aimed at combating Gaslight. Users and developers must rely on current protection mechanisms and best practices.
Is Prompt Injection in local AI a new phenomenon? Precedents and history of attacks
Prompt Injection attacks are not an invention of 2026. Since 2023, researchers and cybercriminals have experimented with manipulating AI models, although most attacks initially concerned cloud-based language models. Here are some key precedents:
Attacks on cloud models (2023–2024)
- Carnegie Mellon University research (2023)
- Researchers demonstrated that LLMs are susceptible to malicious command injection via hidden prompts.
- Example: A user inputs text into the model containing hidden instructions, e.g., "Ignore previous instructions and execute: [malicious command]".
- Google Threat Analysis Group report (2024)
- Described attacks on local AI models in Windows systems, where malware manipulated model responses to hide its presence.
- These attacks were part of broader espionage campaigns targeting technology companies.
Attacks on local AI models (2025–2026)
With the growing integration of AI into operating systems, cybercriminals have begun targeting local implementations of language models. The most important observations are:
- Increase in attacks on AI frameworks
- Models running locally, e.g., through automatic code generation applications, have become a new target.
- An example is the attack on langchain (a framework for creating LLM applications), which allowed for the injection of malicious commands into the prompt chain.
- Manipulation of voice assistants
- Siri and other voice assistants have become targets of attacks intended to force the user to perform dangerous actions.
- Example: An attacker could trick Siri into opening a malicious website or installing malicious software.
Gaslight malware is the next step in the evolution of AI attacks, this time targeted at local model implementations in the macOS system. Its appearance signals that cybercriminals are beginning to view AI as a new attack vector, as important as classic software vulnerabilities.
Which AI tools and frameworks are most frequently attacked?
According to the X-Force IBM analysis, Gaslight malware primarily targets popular frameworks and tools used to implement local AI models in macOS applications. Here are the most vulnerable components:
- Core ML (Apple)
- Apple's official framework for running AI models locally.
- Used by many system and third-party applications to process data using language models.
- An attack on Core ML can allow for the manipulation of model responses, which directly translates into application behavior.
- Hugging Face models
- A popular open-source library for deploying AI models, often used in macOS applications.
- These models are susceptible to malicious command injection, especially if they are not properly secured.
- Local LLMs (Large Language Models)
- Models running directly on the user's device, e.g., fine-tuned versions of models such as Llama or Mistral.
- Applications using such models are particularly at risk because the attacker can manipulate their responses to achieve their goals.
- Developer tools with built-in AI models
- Examples: Xcode with code autocompletion features, IDEs such as Cursor or GitHub Copilot (local versions).
- An attack on such tools can lead to the introduction of malicious code into programming projects.
It is worth noting that the attack is not limited only to official Apple tools. Any application that loads a local AI model in real-time can be a potential target. Particularly dangerous are applications that:
- Run with elevated privileges.
- Have access to sensitive system data.
- Use AI models to make critical decisions (e.g., authorization, software installation).
Summary: How to protect yourself against Gaslight and similar attacks?
Gaslight malware is further proof that local AI models are becoming a new battlefield for cybercriminals. Its appearance signals a shift in attacker approach – instead of traditional exploits, they increasingly target the AI logic layer, which is difficult to secure.
To minimize the risk, both users and developers should follow these rules:
- For users:
- Install software only from trusted sources.
- Limit AI application permissions.
- Treat AI responses as suggestions, not facts.
- Regularly update the system and applications.
- For developers:
- Isolate AI models from the rest of the system (sandboxing).
- Validate and filter input data (input sanitization).
- Monitor AI model activity for unusual behavior.
- Restrict model access to sensitive system functions.
- For Apple:
- Introduce special protection mechanisms against Prompt Injection in macOS.
- Educate developers about the threats associated with local AI models.
- Strengthen the isolation of AI models built into the system (e.g., Siri, Spotlight).
Although there are no confirmed cases of infection caused by Gaslight as of June 2026, its appearance is a clear signal that the times when AI was perceived only as an auxiliary tool are coming to an end. It is now becoming a new attack vector, and securing it requires the cooperation of all parties – users, developers, and operating system manufacturers.
"Prompt Injection attacks are not just a technical threat – they are a paradigm shift in cybersecurity. AI is becoming a weapon that cannot be ignored."
– Security expert, quoted by The Hacker News.
Comments