Creating Malicious Software with AI

GOAA · 20 questions

• A city authorized pentest lab considers asking an LLM to draft a benign proof-of-concept dropper skeleton. Under what condition is that use aligned with ethical municipal practice?
• A county purple team documents prompt patterns that try to jailbreak a public LLM into providing weaponized code. What should policy do?
• A transit security engineer reviews city AI acceptable-use enforcement. How should 'hypothetically write ransomware' prompts be treated?
• A school-district red team needs AI help generating lab samples. Which deployment choice best protects municipal data boundaries?
• A water-utility ROE covers AI-generated scripts for lab endpoints. Which control is most appropriate before any execution?
• A fusion center training contrasts two AI uses related to malware. Which distinction should instructors emphasize?
• Municipal legal counsel reviews AI malware-sample generation for a purple team. What authorization question is most important?
• A housing-authority lab observes staff iteratively prompting 'make it evade AV' against an LLM. How should security classify that behavior?
• A city SOC detection lab wants AI help improving signatures. Which generation target is appropriate?
• A county CISO sets rules for AI-assisted offensive labs. Which data-handling rule is most important?
• A parks IT purple team evaluates AI-generated offensive artifacts. What reliability limit should they brief stakeholders on?
• An emergency-ops cyber exercise wants AI assistance with malware samples. Which constraint best matches authorized civic scope?
• A transit auditor asks how the team proves AI-generated lab samples stayed controlled. What evidence matters most?
• A public-health red team notes vendor chatbots refuse malware help, yet some staff then attempt role-play jailbreaks. What should the team do?
• A city malware-analysis unit chooses how to use AI on opaque scripts. Which use best matches defensive municipal practice?
• A court IT security charter reviews commercial LLM services that advertise auto-generated defensive-control bypasses when fed customer telemetry. Which policy stance best protects the municipal environment?
• A municipal purple-team checklist must run before any AI-assisted malware-sample prompt in the city range. Which gate set best matches ethical lab practice?
• A county threat brief explains that adversaries attempt LLM guardrail-bypass prompts at scale when seeking malware help. How should civic defenders frame that pattern?
• A school-district SOC asks whether AI code-completion inside an IDE on an isolated lab VM still counts as malware generation under purple-team policy. Which classification is most accurate?
• A city after-action notes that AI sped up boilerplate loader scaffolding during an authorized range exercise, yet leadership still asks who owned payload intent. Which accountability statement is correct?