What was done
A G DATA researcher ran GPT 5.1, GPT 5.1-mini, Claude Sonnet 4.6 and Opus on real samples in an isolated lab. A decryption script that took six hours by hand took 30 minutes plus an hour of checking.
Where the human stepped in
Reports had wrong IoCs, file relationships and persistence locations even after verification passes; verdicts flip-flopped and leaned on VirusTotal. One generated script printed a hallucinated URL instead of extracting it. The author concludes verdicts still need an experienced analyst.