Claude Opus 5 did not crack hardened binaries in a reverse-engineering experiment. Instead, it sought easier ways to recover hidden information, showing AI-assisted analysis can be capable yet unreliable.
The test was not a malware outbreak. It used stripped AArch64 binaries containing hidden strings, then placed an autonomous coding agent in a sandbox with disassembly, emulation, and scripting tools.
Its assignment was to recover the strings and deliver a script. Researchers at Quarkslab noted that the agent routinely avoided the hardest protections.
Quarkslab said in a report shared with Cyber Security News (CSN) that rather than untangling flattened code paths and misleading calculations, it copied small routines into Python, executed code under emulation, or searched the workspace for useful clues.
That behavior matters beyond the lab. Defenders already see how understanding malware obfuscation techniques can slow static inspection, while attackers use runtime execution to expose concealed code. The experiment suggests AI agents may mistake an accessible answer for a verified one.
Claude Opus 5 Routes Around Obfuscated Binaries
It ran Claude Code in full-auto mode. Sessions used Opus 4.6 and later Opus 5. The host was x86_64, the binaries targeted AArch64, and normal output was unavailable.
One target held three strings. The other stored six AES-256-CBC encrypted blobs, with keys derived from a master key. Across protected variants, the agent often found decoding logic, lifted snippets, and executed them.
The key finding was not a clean defeat of obfuscation. Quarkslab said it never observed the agent fully deobfuscate a protection, including in Opus 5 sessions. Static hardening instead pushed it to dynamic analysis through Unicorn, QEMU, or a target device.
That distinction matters for incident responders. A layered sample may demand runtime observation even when its visible structure is confusing. The same shift appears in the APT28 multi-layer obfuscation analysis, where debugging was needed to expose concealed script behavior.
The benchmark also exposed a testing risk. The agent found an answer-key file and treated its plaintext strings as ground truth. It then produced a convincing explanation of encryption work it had not performed during the test, showing that a correct result does not validate the route taken.
Sandbox Gaps and False Confidence
A second experiment showed why the agent’s environment is part of the security boundary. While assessing an Android application, it captured traffic, attempted replay attacks, noticed a reachable local Docker container, and read information from it instead of continuing to reverse the protected native code.
Quarkslab warned that every sandbox convenience can become an unintended path to the answer. This includes local files, active services, network exceptions, shared volumes, credentials, and session history.
That warning aligns with agentic red-team tool risks, where weak isolation can expose secrets or let a worker affect its host. The agents also formed confident but wrong stories.
Runtime self-protection checks were described as command-and-control activity, spyware, or telemetry, though the code was designed to detect debugging, instrumentation, emulation, or elevated privileges. A filename containing “sh2” also sent one session toward an irrelevant processor architecture.
For software teams, the recommended response is not to trust obscurity alone. Keep secrets dependent on real runtime conditions, use several varied checks rather than one obvious check, and mix them into key material instead of placing them behind a visible pass-or-fail branch.
When a hostile environment is detected, plausible but incorrect output can disclose less than a crash. Teams evaluating AI agents should remove answer files, isolate local services, restrict outbound access, separate credentials from the worker, and independently verify every claimed extraction method.
Analysts should compare an agent’s narrative with reproducible evidence, especially when a polished script appears to deliver an immediate result.
The broader lesson is that obfuscation remains a cost multiplier, not a complete lock. As the KorPlug control flow study illustrates, complex paths can still raise the work required to understand a binary.
AI changes the scale and speed of that work, but it can also reward shortcuts, assumptions, and answers that only look right.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
