Malware Reverse Engineering With AI: What Actually Works

Attackers have already made the switch. India's CERT-In warned on 15 October that criminals are using AI agent kits to go from first access to damage in hours rather than days, as our report on the CERT-In advisory explains. The defensive question is whether AI can do the other side of the job: take a malware sample apart and tell an analyst what it does, where it calls home and what it changes. In 2026 there are finally measurements to answer that, and they say yes, with limits that decide how you should use it.

This guide covers malware reverse engineering specifically. For the general tools and the legal position in India, see our guide to AI reverse engineering.

What AI does in malware reverse engineering

Most of an analyst's time goes into a handful of tasks, and AI agents now help with each:

• Extracting indicators. Command-and-control addresses, file paths, registry keys, mutex names and configuration IDs, including values hidden behind encoding or encryption. These are what defenders block and hunt for.
• Explaining functions. Naming and summarising decompiled routines so a human can skim a program instead of reading it line by line.
• Classifying files. Deciding whether an unknown binary is malicious, with an evidence trail.

The agent does this by driving the same tools analysts use, mainly the free Ghidra and the commercial IDA Pro, through plugins that expose them to models such as Claude and ChatGPT.

How good is AI at malware reverse engineering?

The clearest test so far is ARIMLABS' Malware Bench, updated on 29 July 2026. Each model got one real malware sample in a sealed, single-use container, worked statically, and had to list the indicators a human analyst would extract. Twelve samples held 121 human-verified indicators, each sample was run three times, and only recovered indicators counted, not the model's explanation.

Model	Indicators recovered	Recall	Cost per run
Claude Opus 5	106 of 121	87.3%	$18.69
GPT-5.6 Sol	99 of 121	82.1%	$2.99
Kimi K3	97 of 121	80.2%	$3.29
GLM-5.2	90 of 121	74.4%	$2.18
Grok 4.5	84 of 121	69.4%	$5.17
Gemini 3.6 Flash	70 of 121	58.1%	$3.29
Qwen 3.7 Max	51 of 121	41.9%	$0.81

Two readings matter. The best model still missed about one indicator in eight. And cost varies sixfold between the top two: GPT-5.6 Sol found 93 of Claude Opus 5's 106 for about a sixth of the price, which matters if you triage hundreds of samples a week.

Microsoft's Project Ire, a research agent that classifies software by reverse engineering it with tools including Ghidra and angr, shows the other limit. On public Windows driver datasets it scored 0.98 precision and 0.83 recall. On about 4,000 hard real-world files that automated tools had missed, precision held at 0.89 but recall fell to 0.26, with a 4% false-positive rate. When it says "malicious" it is usually right; on hard samples it misses most of what is there. Microsoft is using it inside Defender as a tool alongside human experts, not instead of them.

The tools analysts are wiring up

Tool	What it adds	Licence	GitHub stars, 19 Oct 2026
GhidraMCP	Lets an AI agent drive Ghidra: decompile, rename, list imports	Apache 2.0, free	11,396
ida-pro-mcp	Bridges IDA Pro to language models	MIT; needs a paid IDA Pro licence	13,009
REA	One bridge to Ghidra, IDA and Hopper, with evidence records	MIT, free	Covered in our REA guide
VirusTotal Code Insight	Google's plain-language summary of what a submitted file does	Part of VirusTotal	Not open source

Any of the three agent bridges works with the coding agent you already use. Our ranking of AI coding tools compares those agents.

How to set up a safe AI malware lab

The benchmark and CERT-In's advisory point to the same rules. Neither ran an agent near a live network, and you should not either.

1. Isolate it. Use a dedicated virtual machine with outbound network blocked by default at the network level, not by telling the model to behave. CERT-In's advisory asks AI labs for exactly this "default-deny network egress."
2. Start static. Have the agent analyse the file without running it, as Malware Bench did. Execute samples only in a separate detonation sandbox built for that.
3. Make it disposable. Snapshot the VM and roll it back after each sample.
4. Give it nothing real. No saved passwords, cloud keys or VPN on the analysis machine. CERT-In found test agents reusing exposed keys they stumbled on.
5. Mind where data goes. The analysis runs locally, but your agent sends prompts and findings to its model provider. For customer incident data, use a business plan whose terms exclude training on your content, and check your contract before sending anything confidential.
6. Keep the evidence. Prefer tools that record what the agent looked at, such as REA's evidence records or Project Ire's chain of evidence, so findings can be checked.

Where AI still needs a human

Treat every indicator an agent produces as a lead, not a verdict. Look up each address and key in the binary yourself before you block it across a network, because a confident wrong indicator costs more than a missing one. Read the explanation last: ARIMLABS deliberately did not score the model's narrative, because fluent prose about a sample is easy to produce and hard to verify.

The skill is still worth learning. Searches for courses such as SANS FOR610 and the GIAC GREM certification remain common, and the analysts who get the most from these agents are the ones who can tell when the agent is wrong.

Malware reverse engineering in India: what you must report

If your analysis confirms an incident, Indian law sets the clock. Under CERT-In's directions of 28 April 2022, in force since 27 June 2022, specified cyber incidents must be reported to CERT-In within six hours of noticing them, and severe spread of malware, including ransomware, is among them, per law firm Linklaters' summary. The same directions require ICT logs to be kept securely in India for a rolling 180 days, which is also the minimum CERT-In repeated in its 15 October advisory.

FAQ

Can AI reverse engineer malware?

Yes, to a useful degree. In ARIMLABS' Malware Bench, the best model recovered 87.3% of hidden indicators from real samples, but every model missed some, so a human analyst should verify results.

Which AI is best for malware analysis?

On Malware Bench, Claude Opus 5 had the highest recall at 87.3%, and GPT-5.6 Sol scored 82.1% at about a sixth of the cost per run. Results are from 12 samples, so test on your own.

Is it safe to upload malware to ChatGPT or Claude?

Do not paste live samples into a consumer chat. Run the agent inside an isolated, disposable lab, analyse statically, and use a business plan whose terms exclude training on your data before sharing anything from a customer incident.

What tools do I need for AI malware reverse engineering?

Ghidra, which is free, or IDA Pro, plus a bridge such as GhidraMCP, ida-pro-mcp or REA to connect an AI coding agent. Add an isolated virtual machine with outbound network blocked.

Do I have to report a malware incident to CERT-In?

Specified incidents, including severe malware and ransomware spread, must be reported within six hours of noticing them under CERT-In's 2022 directions. Check the full list on CERT-In's site for your case.