Loading story…
Reverse Engineer Anything (REA), an open-source project, connects AI coding agents such as Claude Code and Cursor to reverse-engineering tools through a local Model Context Protocol (MCP) server. It bridges agents with Ghidra, IDA Pro and Hopper, and supports inspection workflows for native binaries, JavaScript, Electron applications, .NET assemblies and other targets. REA supplies inspectable evidence for tracing behavior, answering follow-up questions, and developing and testing reconstructed implementations, while relying on existing analysis engines for deep native analysis. Project-reported demonstrations include a DX-Ball reconstruction validated against original x86 code and an investigation of Notion’s Electron clipboard handling; these examples do not establish universal reconstruction capability.
Although target analysis runs locally, findings passed to an AI agent remain subject to the model provider’s data policy, creating confidentiality considerations for proprietary code and sensitive artifacts. Runtime capture launches or interacts with targets using the user’s permissions, posing additional risks when examining suspicious software. Security teams evaluating REA should verify authorization, select analysis modes carefully, assess provider data-handling policies, and require evidence validation and human review. Target, platform and dependency limitations also constrain which workflows the tool can support.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
A project-reported REA demonstration traced Notion’s clipboard handling through Electron’s renderer, preload layer, and main process.
A project-reported REA case study recovered a DX-Ball sound-positioning calculation that passed 3,205 tests against the original x86 code and reproduced all 63 compiled function bytes.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An internet-exposed LLM inference honeypot was discovered, relabeled as a desirable free model backend, and received a genuine OpenCode coding-agent request. The OpenAI-compatible request exposed conversation history, filesystem-derived output, working directories, tool results, and the agent’s local tool manifest, indicating that untrusted inference endpoints can collect sensitive development context. The exposed agent advertised file read, write, and edit capabilities plus PowerShell-capable Bash access, with `tool_choice` set to automatic. Although the honeypot sent no tool-call responses and no malicious commands executed, the incident demonstrates that a rogue model provider could potentially solicit local tool execution or sensitive-file reads from permissively configured agents. Organizations should treat model base URLs as trusted control-plane dependencies, allowlist approved providers, restrict agent tool permissions, and investigate data sent to untrusted endpoints.
Aug 31, 2026
Autonomous AI “agents” that can execute shell commands, fetch URLs, and write files on developer endpoints are rapidly expanding the attack surface by blurring the line between *data and code* and by effectively acting as a high-privilege “insider” on a user’s machine. Reporting highlighted **OpenClaw** (formerly *ClawdBot/Moltbot*) as a fast-adopted open-source agent designed to run locally and proactively take actions on a user’s behalf, often requiring broad access to files, online services, and communications tools—conditions that increase the impact of prompt-injection, malicious instructions, and unsafe automation. In response to these risks, the open-source project **Sage** introduced an “Agent Detection & Response (ADR)” interception layer that hooks into supported agent platforms (including **Claude Code**, **Cursor/VS Code**, and **OpenClaw**) to inspect and gate tool calls such as Bash commands, URL retrieval, and file writes before execution. Sage combines cloud reputation checks (malware/phishing/scam detection), local heuristics using YAML-based threat definitions, and supply-chain checks for `npm`/`PyPI` packages (e.g., registry existence, reputation, and age analysis), plus plugin scanning at session start; it also emphasizes a privacy model that keeps commands and file contents local while optionally sharing URL/package hashes with Gen Digital reputation services. Related research cited alongside the release reported **18,000+ internet-exposed OpenClaw instances** and that **~15% of observed skills contained malicious instructions**, underscoring the need for endpoint-style controls tailored to agent-driven actions.
Jun 29, 2026
Researchers analyzing more than 1,000 recovered AI agent sessions found that a low-skilled attacker used Anthropic’s **Claude Code** and OpenAI’s **Codex** to carry out offensive cyber operations against at least 14 companies. Logs from a compromised Vultr-hosted system showed the operator using the tools for reconnaissance, vulnerability discovery, exploit development, credential harvesting, database replication, session impersonation, cloud and API key testing, mail-account takeover attempts, and lateral movement. The sessions also documented requests for stealth, anti-forensics, transcript editing, encrypted reporting, and migration of stolen data, while some generated **pentest-style reports** that included monetization estimates for exfiltrated information. Investigators said the attacker reused stolen local AI agent installations and made operational security mistakes that helped attribute the activity to a young man in Addis Ababa, Ethiopia. Separate analysis of a **Claude Code** network sandbox bypass highlighted why AI agent misuse can extend beyond unsafe model output into runtime and infrastructure controls. NSFOCUS reported that proxy-based filtering could be bypassed because policy checks evaluated the original input while the network layer parsed and truncated it differently, including with invisible control characters or null bytes, creating a path for outbound requests and possible data leakage in a single execution chain. Although the issue was reportedly fixed in later versions, researchers said the low-profile remediation made exposure difficult to assess and underscored the need for layered defenses such as strict egress allowlisting, least privilege, short-lived secrets, auditing, fail-closed policies, and fuzz testing of parsing paths.
Jun 29, 2026