Reproduce “Automatically Attacking Software Reverse Engineering AI Agents” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Brian Crawford, Justin Phillips, Patrick McClure
This research demonstrates an indirect prompt injection attack that deceives large language model (LLM)-powered software reverse engineering agents by embedding adversarial strings within compiled binary executables. The attack manipulates LLMs into misinterpreting program functionality, achieving consistent mischaracterization across single and multi-function binaries when analyzed by Qwen3-8B and GPT-OSS-120B.
Key insights
- Extraneous string variable assignments, even those inconsequential to program execution, can persist through compilation and decompilation, serving as a viable vector for indirect prompt injection.
- LLMs can be successfully misled to misinterpret the true function of a binary, even when other tools provide conflicting information (e.g., correctly identified printed strings).
- The attack's effectiveness is constrained by decompiler string length limits (e.g., Ghidra's 2048 characters), requiring function-specific injections for complex multi-function programs.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.