A Measurement Study of AI-Environment Realism Gaps in Malware-Analysis Sandboxes
For malware analysts and sandbox developers, this work identifies a novel evasion surface that current sandboxes fail to address, but the findings are incremental as they extend known evasion techniques to AI-specific artifacts.
This paper presents the first systematic measurement study of AI-environment artifacts as a new sandbox-evasion surface, introducing AIprint to capture persistent artifacts from AI software ecosystems. Evaluation across seven sandbox backends and three reference hosts found twelve artifacts that appear on real AI-capable systems but none of the sandboxes, highlighting a new evasion vector.
Sandboxing remains a core technique for observing suspicious program behavior, yet environment-aware malware increasingly suppresses execution when analysis is suspected. Prior generations of sandbox evasion focused on virtualization artifacts, timing discrepancies, and wear-and-tear realism. In this paper, we present the first systematic measurement study of AI-environment artifacts as a new sandbox-evasion surface. We operationalize this realism gap through AIprint, a probe framework that captures persistent artifacts left behind by AI-capable software ecosystems, including AI-assistant configuration directories, model caches, environment variables, local inference services, and package dependencies. We systematically extract 450 unique artifacts from 284 open-source AI projects on GitHub, compile them into unprivileged Windows probes, and evaluate them across seven commercial and open-source sandbox backends together with three AI-capable reference hosts. Our results show that traditional VM-detection baselines fail to reliably distinguish real AI-capable systems from modern sandboxes, whereas twelve AI-environment artifacts appear on the reference hosts and on none of the evaluated backends. A controlled 214-step installation experiment establishes a causal relationship between AI tool and package installation and measurable AI-environment artifact accumulation, while adaptive spoofing experiments reveal a fundamental operational asymmetry: reproducing convincing AI software environments is substantially more expensive than detecting shallow spoofing.