[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftreJMsaaxmfV5c2ONH2UgjFR9TC9Ah2ZCPTooSJ4xFY":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"b8cf0322-ae64-4aae-b3b2-da4aa64f70d5","AI reverse engineering let researchers add a new feature to Slack","ai-reverse-engineering-let-researchers-add-a-new-feature-to-slack-462a2b","Intezer researchers used AI agents to rebuild source code for Slack, Apple’s Finder and a TinyTurla-NG sample, from a backdoor family Cisco Talos attributes to the Turla group. They worked from the shipped programs and vendor documentation. The rebuilt Slack ran well enough that the team added a new feature to it: AI text autocomplete, powered by a small local model. Software vendors that count on compiling their programs to keep source code private are … More → The post AI reverse engineering let researchers add a new feature to Slack appeared first on Help Net Security.","Intezer researchers utilized AI agents to reconstruct source code for Slack, Apple's Finder, and a TinyTurla-NG malware sample. The rebuilt Slack application was functional enough for the researchers to add a new AI-powered text autocomplete feature. This research demonstrates that software vendors relying on compilation for source code privacy are vulnerable, as the same AI methods can be used to analyze commercial applications and malware.","AI agents reverse-engineered Slack, Apple Finder, and TinyTurla-NG malware.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F10\u002Fslack-ai-reverse-engineering\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F10153942\u002Fcode-color-1500.webp","2026-11-10T14:45:18+00:00","2026-11-10T15:00:05.195+00:00",7,[17,20,23,25,28],{"name":18,"type":19},"Turla group","threat_actor",{"name":21,"type":22},"Slack","product",{"name":24,"type":22},"Apple Finder",{"name":26,"type":27},"Cisco Talos","vendor",{"name":29,"type":27},"Intezer","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":30,"icon":32,"name":33,"slug":34},null,"Tools","tools",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"malware","TinyTurla-NG","Malware sample reverse-engineered by AI agents.",[26,29,21],{"controls":58,"vendors":117},[59,88],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":89,"name":90,"problem":91,"products":92},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[118,124],{"slug":119,"name":120,"logo_path":121,"roles":122},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[123],"affected",{"slug":125,"name":29,"logo_path":126,"roles":127},"intezer","\u002Fvendor-logos\u002Fintezer.png",[128],"reported_by",{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":139},"ai-powered-reverse-engineering-defeats-compilation-based-code-privacy","AI-Powered Reverse Engineering Defeats Compilation-Based Code Privacy","Researchers demonstrated that AI agents can reconstruct functional source code from compiled binaries of commercial software like Slack and Apple Finder, effectively nullifying the assumption that compilation alone protects intellectual property or hides implementation details. The rebuilt Slack binary was functional enough to add new features, proving that threat actors could use the same techniques to identify hidden vulnerabilities, bypass security controls, or introduce malicious modifications. This matters because many vendors and security teams implicitly rely on 'security through obscurity' via compiled code, without layering additional protections. The same capability that reconstructed Slack could be turned on proprietary security tools, embedded firmware, or malware to accelerate exploitation.",[134,135,136,137,138],"NIST SP 800-53 SA-15: Development Process, Standards, and Tools","NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded","NIS2 Article 21(2)(e)","MITRE ATT&CK T1027: Obfuscated Files or Information","CIS Control 16: Application Software Security",{"NIS2 Article 21(2)(e)":140,"CIS Control 16: Application Software Security":141,"MITRE ATT&CK T1027: Obfuscated Files or Information":142,"NIST SP 800-53 SA-15: Development Process, Standards, and Tools":143,"NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded":144},"This point covers security in acquisition, development and maintenance including vulnerability handling, directly applicable because the incident exposes a development assumption — that compilation obscures code — that should be evaluated and remediated as a vulnerability in the SSDLC.","CIS Control 16 requires organizations to manage the security lifecycle of internally developed or acquired software, which includes evaluating whether the binary distribution model adequately protects against reverse engineering and tampering.","This technique covers adversaries using binary analysis to defeat obfuscation; the research demonstrates that AI tooling dramatically lowers the bar for this technique against commercial software.","SA-15 requires organizations to define and enforce security requirements in the software development process, which would prompt teams to explicitly evaluate and mitigate reverse-engineering risks rather than assuming compilation is sufficient protection.","Formally identifying the vulnerability that compiled binaries can be reconstructed via AI would have prompted proactive controls rather than reliance on obscurity."]