Automatically Attacking Software Reverse Engineering AI Agents

2026-05-28

AI Summary

This work demonstrates that large language model (LLM)-driven reverse engineering systems are vulnerable to adversarial attacks that can be exploited by malware to evade detection. For the first time, the study adapts AutoDAN-style adversarial attacks to the reverse engineering domain, proposing a genetic algorithm–based prompt injection technique. This method stealthily embeds semantically innocuous yet misleading string assignments into binary files to subtly disrupt LLM-assisted disassembly and decompilation pipelines. Evaluated on static analysis frameworks such as GhidraMCP, the approach successfully induces erroneous outputs, effectively compromising the analytical accuracy of AI-powered reverse engineering agents. The findings expose a novel class of vulnerabilities inherent in LLM-integrated security toolchains and offer critical insights for developing more robust AI-based code analysis systems.

Abstract

Software tools for reverse engineering executable binary files, such as Ghidra, enable malware analysts to safely conduct robust static analysis without having access to original source code. Coupled with the analytic power of large language models (LLM), agentic systems enabled with tools, such as GhidraMCP, can allow analysts to automate a previously human driven process. Although this automation can increase the productivity of a single malware analyst, it also introduces a new area of vulnerability for malware obfuscation. This paper presents an adversarial technique using genetic algorithm-based prompt generation, a modification of an adversarial attack known as AutoDAN, to demonstrate the ability to deceive LLM-powered disassembly and decompilation systems into misinterpreting binary executables, effectively corrupting their analytical output. This proof-of-concept methodology exploits inherent vulnerabilities in how LLMs process and interpret decompiled machine code via prompt injection by using extraneous string variable assignments to pass surreptitious instructions to the LLM while not impacting the functionality of the executable file. We demonstrate this capability through several concise examples. This approach could enable attackers to bypass automated detection systems that rely on LLM-driven analysis pipelines. By studying and understanding this attack, insights can be gained regarding the security implication of integrating LLMs into cybersecurity toolchains and building more robust agentic code analysis systems.

Problem

• adversarial attack
• large language models
• reverse engineering
• malware obfuscation
• prompt injection

Innovation

• adversarial attack
• genetic algorithm
• prompt injection
• large language models
• binary reverse engineering