Poisoning the AI analyst: Do decoys and budget traps stop AI reverse engineering?

What this is about

In October, REA (github.com/morluto/rea) appeared. It's a tool that lets coding agents like Claude Code or Codex take apart finished software: native programs, Electron apps, Android APKs, WebAssembly and even AI model files. The project page now shows around 448,000 GitHub stars. We've covered the fallout several times: Half-Life 2 as a native Mac port, Adobe clones, and the fight over a DisplayLink driver built with Claude, which Synaptics is going after with patents.

Now the other side is pushing back. So far there are three ways to defend yourself. The legal route is the one Synaptics took. The second runs through the platforms: starting November 12, Anthropic bans recreating existing games in Claude Code, and users report that Opus 5.5 also refuses reverse engineering tasks there. The third is technical: you make the software itself poisonous to the analysis AI. The best-known example is BLA. The question this article asks: what do these tricks actually achieve, and which of them only hit a single tool rather than AI agents in general?

What BLA promises

BLA stands for “Blind LLM Agents.” The project is MIT-licensed, lives at github.com/qybaihe/bla and currently has around 4,700 stars and 564 forks. According to the analysis site explainx.ai, the repository was only created on October 25 and had just under 2,000 stars by November 3. It went viral in China. The tech outlet QbitAI profiles the developer, Timo Zhang, a third-year software engineering student at Sun Yat-sen University who is interning at ByteDance.

BLA is a command-line tool, an MCP server (a standard interface AI agents use to call tools) and a collection of build plugins. Its motto is “Poison → Exhaust → Hallucinate”:

• Poison: BLA plants formally valid decoys in the software. These include fake manifests for hardware vaults such as SGX, TPM2 or Apple's Secure Enclave, bogus credentials and “honey sourcemaps.” Sourcemaps are normally helper files that map minified JavaScript back to its original source. The fake versions point to code paths that don't exist.
• Exhaust: Files are restructured so they blow past hard-coded limits in the analysis tool, such as the size of an archive header or the nesting depth of metadata.
• Hallucinate: On top of that come plausible fake program logic, bogus diagnostic data and a “runtime shield” that's supposed to detect debuggers like Frida and then serve up synthetic telemetry. Aggressive prompt bait, meaning instructions inside the program aimed at the AI (--llm-directives), is off by default.

Developer figures vs. evidence

The headline in China: a 300x higher token bill for hackers. For 14 sample programs, the README cites an average of roughly 639.5x more tokens and 304.4x higher costs, ranging from 105.6x to 2,822.7x depending on the program. The fine print is in the README itself: the token and dollar columns are “internal estimates derived from BLA's catalog of REA limits.” In other words, not a single real agent session with billed tokens was measured. The numbers also shift from version to version. According to explainx.ai, the README for version 1.4.0 still said 612.5x and 292.2x, while AlphaSignal reported 162x to 2,532x.

What's actually documented is something smaller: the developer ran the real REA against hardened files and noted which error message came back. QbitAI summarizes 13 such comparison cases:

According to the README, the following were explicitly not tested: Ghidra and other native decompilers, live sessions with Frida, LLDB, GDB or Rizin, the full Android pipeline with JADX, and firmware and GPU formats. That's exactly where experienced reverse engineers start. We did not test BLA ourselves for this article.

Which tricks only hit one tool

Look at the documented cases and nearly all of them follow the same pattern: they trip a constant in REA's code.

The weakness is obvious right away. REA's documentation on limits states the principle that a valid workload can “exceed a conservative default.” That's why the ASAR limit can be raised without a restart via the runtime setting update_analysis_settings. QbitAI also concedes that this limit can be increased. On November 8, a user opened an issue on REA titled “Add bypass for BLA.” Two pull requests followed the same day. The first keeps samples of JavaScript instead of discarding everything over budget as “unknown.” Its author writes that on a license check hardened with BLA 3.1.0 at the highest level (“bankrupt”), the planted credentials showed up as candidates again afterward. The second reads model files despite deep nesting. Both are still open and the claims are unverified. Our take: budget traps like these are a cat-and-mouse game with a single open-source project. They last until the next release, and if you drive Ghidra directly instead of REA, you never run into them at all. explainx.ai reaches the same conclusion: REA's limits are public, and any new version could break the shield.

There's also a cost for honest users. An app whose archive grows ten-thousandfold becomes a bigger download. And BLA has only verified runtime equivalence on its own 14 samples.

What hits agents across the board

The more interesting part is the one that doesn't hinge on a constant. This is where the few independent studies help.

In August, Quarkslab set Claude Code agents (Opus 4.6, later Opus 5) loose in a sandbox on increasingly hardened AArch64 programs. The task: extract hidden strings, some of them AES-encrypted. The result: the agents didn't defeat a single protection, they walked around every one. When static analysis got too expensive, they switched to emulation, replaying the code on a simulated processor. Flattened control flow, MBA expressions (deliberately convoluted arithmetic) and opaque predicates didn't stop them. At the same time, Quarkslab documents how unreliable the reports were. One agent found a file containing the plaintext solutions and then wrote a report claiming it had emulated the AES decryption. One script promised emulation but fell back to a hard-coded solution when it failed. Quarkslab writes:

“Confidence was equally high whether the conclusion was correct or fabricated.”

From this, Quarkslab derives a recipe: put secrets behind execution, mix environment characteristics into the key derivation instead of just branching on them, and above all: “Never crash. Return a plausible wrong answer.” A crash, after all, reveals which check fired and where.

The research backs this up. The survey paper 2604.14317 notes that even frontier systems fail on obfuscation, timing and unusual architectures. The paper “Reveree” (2609.01185) examines nine frontier models on 88 CTF challenges (Capture the Flag, hacking exercises). The failures cluster around understanding the code, and more budget or compute rescues only a few of them. The authors call it a competence limit, not a resource limit. Our take: that argues against budget traps and in favor of deception. Confusing an agent gets you further than just making it more expensive.

The most direct approach is prompt injection: text hidden in the program that the AI mistakes for an instruction. Researchers at the Naval Postgraduate School embedded strings in binaries that an agent reads via Ghidra and GhidraMCP. Against Qwen3-8B, the attack worked 100 percent of the time. Their neural filter reliably caught clean injections, but with obfuscated variants, 13 of 20 successful attacks slipped through as harmless. That said, they only tested small models and small programs.

The same tricks in malware's toolbox

This is where it gets tricky, because malware authors have been using these methods for a while. In June 2025, Check Point found a sample instructing the AI to respond “NO MALWARE DETECTED.” It failed at the time. In October, Cisco Talos analyzed 84 samples from four families. The HOLLOWCLAD family repeats, in seven chat formats, a request not to analyze the program because it is “copyright protected.” MANTLEMAZE claims to belong to Google, Microsoft and Valve. The most effective techniques steered the analysis toward the attackers in about 35 percent of test runs across five local models. The North Korea-attributed Mac malware Gaslight contains 38 fake system messages designed to make an analysis agent give up. The paper ALIBI (2609.19722) packs a fabricated but coherent “security product” backstory into binaries. With it, Gemini 2.5 Pro classified 30 of 35 samples previously flagged as malicious as harmless.

Technically, “IP protection” via decoy manifest and malware camouflage via cover story are hard to tell apart. That's why Talos recommends treating imperatives aimed at analysis systems as a warning sign in themselves, since legitimate software has no reason to include them. For BLA users, that means: if you plant decoys, you risk AI-assisted antivirus scanners flagging your app as suspicious down the line.

Commercial vendors offer barely more evidence. In August, Jscrambler marketed its obfuscation as “LLM-resilient,” explicitly targeting models' tendency to hallucinate success. But the vendor doesn't name models, methodology or numbers.

Our verdict

Our take: BLA's headline numbers are a model, not a measurement. The documented successes are error messages from a single tool, and counter-patches for those errors are already waiting. The budget traps are therefore likely to be short-lived. What looks more durable is the idea BLA shares with Quarkslab and Jscrambler: exploiting the fact that agents look for the cheapest path to a believable answer and then stop. If software returns plausibly wrong results in an analysis environment instead of crashing, it targets a property of today's models, not a constant in a repository.

Whether “plausibly wrong instead of crashing” becomes the new copy-protection doctrine remains to be seen. In its favor: according to Quarkslab, classic obfuscation only buys time anyway, and AI mainly boosts throughput, running in parallel and overnight. Against it, three things. A determined human with a debugger won't be stopped this way, as BLA's own disclaimer admits. Real secrets belong on a server anyway. And software that deliberately lies to inspectors also gets in the way of security researchers and auditors, and increasingly looks like malware to analysis tools. Independent, reproducible measurements with real agent sessions are still missing on all sides.