Okay but pretty much any malware is going to follow those same steps - they're what makes it malware. The LLM doesn't "prove" anything - it's not examining the executable, it's not setting up a VM and doing deep packet analysis to see how the malware operates. It's just parroting back the fact this is malware with details seeded from the prompt. This is like yelling into a canyon and "proving" someone is stuck in the canyon and yelling because you heard an echo.

No one should be using an LLM as a security backstop. It's only going to catch the things that have already been seen before, and the minute a bad actor introduces something the least bit novel in the attack, the LLM is confidently going to say it isn't malware because it hasn't seen it before. A simple web search would have turned up essentially the same information and used only a small fraction of the resources.