Okay but pretty much any malware is going to follow those same steps - they're what makes it malware. The LLM doesn't "prove" anything - it's not examining the executable, it's not setting up a VM and doing deep packet analysis to see how the malware operates. It's just parroting back the fact this is malware with details seeded from the prompt. This is like yelling into a canyon and "proving" someone is stuck in the canyon and yelling because you heard an echo.

No one should be using an LLM as a security backstop. It's only going to catch the things that have already been seen before, and the minute a bad actor introduces something the least bit novel in the attack, the LLM is confidently going to say it isn't malware because it hasn't seen it before. A simple web search would have turned up essentially the same information and used only a small fraction of the resources.

If it's malware, it - by definition - is going to need to run a privileged executable. That's the "ware" in "malware". The LLM is just explaining the specific method they're attempting to use - which again should be obvious both by the nature of the actions it's requesting from the user as well as the specific text it's asking to be run. It explicitly says it doesn't know anything about the executable that's being run, so it really isn't offering anything particularly useful or actionable - just wasting resources.

Making a scene?! Oh no! Have I shattered the fragile Lemmy decorum with my boorish behavior? How dreadful!

Listen, if you want to believe an LLM has anything useful to say about the malware you're presented with on dodgy sites, go for it.

And I'll be free to think you're a prime example for why we should start requiring a "drivers license" to get on a computer. To each their own.