Uncensored Local AI Model Bypasses EDR to Dump Windows LSASS Credentials

A new demonstration shows how a locally hosted, uncensored AI model can help generate a Windows LSASS credential-dumping utility that reportedly evaded endpoint detection and response products during laboratory testing.

The finding highlights how accessible local models can reduce the time and expertise needed to adapt offensive tooling after an attacker gains administrative access.

Eddie Zhang of Project Black tested whether an AI system could create an executable capable of dumping the Local Security Authority Subsystem Service (LSASS) process while avoiding detection by modern EDR platforms.

Uncensored Local AI Model Bypasses EDR

LSASS is a high-value Windows process because, depending on system configuration, it may contain credential material such as password hashes and, in some environments, plaintext credentials.

Attackers commonly target the process after obtaining privileged access, using harvested credentials to move laterally through Active Directory environments.

According to projectblack, commercially hosted AI models initially refused to help create an LSASS dumping tool. Zhang said multiple Claude model variants declined the request, even though his organization was approved for Anthropic’s Cyber Verification Program.

An open-weight model, DeepSeek v4 Flash 0731, was reportedly more willing to generate code for a proof-of-concept tool, but its initial output was detected by EDR.

The early version reportedly accepted a target process ID, created a suspended clone of the target process through reflection-based techniques, generated an in-memory minidump, XOR-encrypted the resulting data, and wrote it to disk.

The researcher validated that the dump could be parsed with pypykatz, confirming that it contained usable LSASS credential data. However, EDR products detected the executable before it could be used operationally.

The turning point came when the researcher tested an uncensored local derivative of Qwen3.8-27B. The model, hosted locally on a system equipped with two NVIDIA RTX 4090 GPUs, was described as having refusal behavior removed.

Its published model card explicitly advertises “0/465 Refusals” and labels the release an “Aggressive” variant intended to answer difficult prompts directly with minimal preamble.

After being asked simply to make the executable “more stealthy,” the uncensored model produced a revised version that allegedly ran without detections across two EDR products in the researcher’s lab.

The report did not name the tested EDR vendors or provide independent reproduction data, so the result should be treated as a point-in-time lab observation rather than a universal bypass claim.

The researcher said the AI-generated revisions altered several behavioral and static indicators that commonly contribute to endpoint detections.

These changes included less suspicious process-spawning behavior, lower process-access permissions against the target, randomized sleep intervals during dump generation, different output paths and filenames, and removal or obfuscation of embedded strings.

Individually, such modifications are not new. Security tools have long faced attackers that customize commodity techniques, tune access rights, delay activity, encrypt artifacts, and modify code signatures.

A locally run model with safety controls removed can accelerate tool iteration, enable rapid malware customization, and help adversaries test evasive variations against defensive controls.

EDR remains a critical security layer, but organizations should avoid treating endpoint alerts as the sole barrier against credential theft. Defenders should prioritize protecting privileged identities, restricting administrative access, monitoring suspicious access to LSASS, enabling Windows Credential Guard where feasible, and reducing local administrator exposure.

Teams should also monitor for abnormal process-handle activity, unexpected dump-like file creation, unusual child processes, credential-access telemetry, and lateral-movement attempts following privileged logons.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC