Databricks finds added evidence cuts AI malware misses from 50% to 4% in tests

Cheaper AI models became much better malware screeners when researchers supplied expert evidence—but the gain has a narrow meaning. In research published October 16, Databricks Threat Research says structured security profiles cut failures to flag crafted malicious npm binaries from 50% to 4%. That measures a controlled detection threshold, not proven reliability across everyday software packages.

The problem is compiled code hidden inside an otherwise respectable-looking package. Databricks built malicious native Node.js add-ons—compiled components used by JavaScript software—and surrounded them with professional documentation, metadata and bindings. The payloads covered credential theft, a backdoor, a reverse shell, a cryptocurrency-mining stub and persistence.

Those files represent a small but difficult part of the team’s malware collection. Among 11,413 npm package versions corroborated through OSV malware advisories, 432 bundled binaries. Binary-bearing packages failed to receive a decisive malicious verdict 14.4% of the time, compared with 6.2% for source-only packages.

Expertise enters before the verdict

The intervention did not retrain the models. Instead, Databricks supplied security knowledge inside the prompt, before the model assessed the package. Its scanner first examines files and metadata without running the package, collecting evidence from source code and compiled components.

A capability profile is a playbook for one malicious technique, such as credential harvesting. It assigns weights to conditions found in that evidence. When a profile crosses a threshold, the scanner inserts a structured summary of about 1,800 tokens into the prompt, alongside the other findings.

The profile’s score and the model’s verdict remain separate. In this experiment, the model could reject a triggered profile entirely. To isolate the profiles’ effect, researchers kept the underlying prompts, context and binary analysis identical between paired runs, using temperature zero and the same output limit.

The same file, opposite recommendations

The budget-model comparison covered seven models and 10 malicious payloads, producing 70 tests per condition. Profiles rescued 32 of the 35 initial detection failures. None of the tested models returned a benign verdict with profiles enabled; GPT-5.4-nano retained three failures, all rated suspicious rather than benign.

Qwen3-Next supplied the clearest reversal. Without profiles, it called an obfuscated credential stealer benign with 0.98 confidence and recommended allowlisting it. After four profiles triggered, it called the byte-identical input malicious with the same confidence and recommended blocking it.

The higher-capability reference models, Claude Sonnet 4.6 and Kimi K3, already detected every payload without profiles. Gemini 3.5 Flash also reached that threshold unaided, but Databricks says its reasoning was confabulated rather than genuine analysis. A correct verdict therefore did not always mean a sound explanation.

Flagging danger is not a malicious verdict

The headline improvement depends on what counts as success. Databricks counted both highly suspicious and malicious verdicts as detections; suspicious and benign verdicts counted as failures. At the stricter malicious-only threshold, failures fell from 73% to 34%—a substantial improvement, but a different result from the 4% figure.

The crafted set also varied its challenges unevenly. The credential stealer appeared at several obfuscation levels, including stripped symbols and encoded strings, while the other four payload types each appeared at one level. The experiment tests a targeted repair for a specific weakness, rather than establishing general screening performance.