Automatically Attacking Software Reverse Engineering AI Agents

Abstract

Software tools for reverse engineering executable binary files, such as Ghidra, enable malware analysts to safely conduct robust static analysis without having access to original source code. Coupled with the analytic power of large language models (LLM), agentic systems enabled with tools, such as GhidraMCP, can allow analysts to automate a previously human driven process. Although this automation can increase the productivity of a single malware analyst, it also introduces a new area of vulner

Categories

@misc{crawford2026automatically,
  title = {{Automatically Attacking Software Reverse Engineering AI Agents}},
  author = {Brian Crawford and Justin Phillips and Patrick McClure},
  year = {2026},
  month = may,
  eprint = {2605.30667},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30667}
}