Benchmark Study: AI Agents Using Ghidra to Detect Backdoors in Binary Executables

Summary

The article describes a benchmark study called BinaryAudit that evaluates AI agents' ability to detect backdoors in compiled binary executables. Researchers partnered with reverse engineering expert Michał "Redford" Kowalczyk to create a benchmark testing AI agents using Ghidra (NSA's reverse engineering tool) to find malicious code in ~40MB binaries of real open-source servers, proxies, and network infrastructure without access to source code. The benchmark measures detection accuracy, false positive rates, and tool proficiency for practical malware detection applications.