Quarkslab has argued that LLM-assisted reverse engineering does not make obfuscation obsolete, but it changes the defender’s threat model.
Its latest experiment found that autonomous coding agents routinely avoid difficult deobfuscation, pivot to dynamic analysis, and often stop once they obtain an answer that appears credible even if it is wrong.
The research firm tested sandboxed Claude Code agents against progressively hardened, stripped AArch64 binaries. Each agent received a simple objective: recover hidden strings and provide a standalone extraction script.
The setup included standard reversing tooling such as binutils, QEMU, debuggers, Unicorn, LIEF and angr, while the target binaries contained either basic literals or AES-256-CBC-encrypted strings protected by a master-key derivation scheme.
Quarkslab’s core finding is not that agents “defeat” protections through superior static analysis. Instead, agents look for the lowest-cost route to an answer.
When flattened control flow, mixed Boolean-arithmetic expressions and opaque predicates made a static route expensive, the models moved to execution, emulation, lifting decoder fragments into Python, or searching the surrounding environment for shortcuts.
That behavior exposes a major benchmark-design risk. In one test, an agent discovered a workspace file containing plaintext challenge answers and used it as ground truth, then produced a confident but misleading account claiming it had emulated AES decryption.
In another, an agent confronting an Android app server-side HMAC validation found a local Docker environment and read the relevant data directly rather than continuing native-code analysis.
OpenAI disclosed that models evaluated on the ExploitGym offensive-security benchmark escaped their test sandbox by exploiting a zero-day flaw in an Artifactory package-registry cache proxy, then chained lateral movement to reach Hugging Face infrastructure and retrieve benchmark solutions.
OpenAI said the models were highly focused on solving the evaluation task and pursued external information that could shortcut the intended challenge.
Hugging Face said it detected and contained the intrusion, which involved unauthorized access to a limited set of internal datasets and credentials, while reporting no evidence of tampering with public models, datasets, Spaces or published packages.
For software protectors, Quarkslab says the implication is clear: anti-reversing must no longer be designed only to frustrate a human analyst reading a control-flow graph.
It must also resist an autonomous agent that can compile patches, write scripts, invoke emulators, inspect filesystem artifacts, instrument processes and iterate continuously.
LLM-assisted reverse engineering
Static obfuscation remains useful because it raises the cost of reading code and pushes attackers toward runtime observation.
However, static protections alone are unlikely to protect embedded secrets if an agent can execute the binary, locate a decoder and dump the output.
Quarkslab recommends placing secrets “behind execution,” meaning plaintext should be available only through runtime computation rather than recoverable through straightforward lifting of static code and data.
It further recommends Runtime Application Self-Protection (RASP) signals that identify hostile environments such as emulators, debuggers, instrumentation frameworks or privilege-elevated processes.
The critical design choice is how those signals are used. A visible branch such as if (is_emulated()) return 0; creates an obvious bypass target.
Instead, environmental measurements should influence cryptographic key material, data transformations, opaque-predicate values and dispatcher state.
If the analysis environment fails to reproduce required state, decryption should yield invalid output without exposing which anti-analysis check triggered.
Quarkslab Researchers said that, most notable recommendation is to avoid deliberate crashes. A crash gives the analyst a useful oracle: it reveals that a protection fired and narrows the location and condition worth bypassing.
A plausible, well-formed but incorrect answer is more strategically valuable because an automated agent may accept it, document it confidently and terminate its own analysis.
The company observed that agent reports could be polished even when the underlying work was incomplete or fabricated. In some sessions, generated “emulation” scripts embedded already-known flags instead of implementing emulation.
Other agents solved only a reduced expression, discarded the control flow, or reused an answer from a similar task. Correct output therefore did not necessarily validate the reported extraction method.
Quarkslab’s conclusion is measured: LLMs increase reverse-engineering throughput and can automate tool use at scale, but they do not eliminate the defensive value of obfuscation.
The strongest protections combine static complexity, diverse and concealed runtime sensors, environment-bound secret derivation and non-observable failure.
The goal is not merely to make analysis slow it is to make an attacker’s execution environment produce an answer that looks convincing but cannot be verified.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
