[kmonsen]

The thing is, malware vendors can do the same. At least for zero day attacks you just test them on the target’s antivirus to make sure it will not discover the malware.