AI reverse engineering let researchers add a new feature to Slack
Intezer researchers used AI agents to rebuild source code for Slack, Apple’s Finder and a TinyTurla-NG sample, from a backdoor family Cisco Talos attributes to the Turla group. They worked from the shipped programs and vendor documentation. The rebuilt Slack ran well enough that the team added a new feature to it: AI text autocomplete, powered by a small local model.
Software vendors that count on compiling their programs to keep source code private are the ones exposed. “Our research shows that an AI agent can reconstruct a working copy of an application when given the original software’s binary or package,” wrote the Intezer researchers behind the work. The same method that opens up a commercial app also opens up malware.
The backdoor rebuild has the numbers
Intezer set five tests for success. The code had to be readable enough to maintain, clean and idiomatic enough to compare with human-written source, compiled only from what the agents wrote, free of bundled third-party libraries, and identical in behavior to the original. Intezer rated TinyTurla the hardest of the three targets.
Codex, running GPT-5.6-sol-high, drove the workflow and made the engineering decisions, while Kimi K3 filled three separate roles in the setup. The agents produced about 3,100 lines of source in two files.
The rebuilt DLL is 296,960 bytes against the original’s 291,840, with 1,072 functions against 1,041 and identical imported symbols. BinDiff, a tool that compares how two binaries are put together, matched 1,034 of the original functions and scored the pair at 92.8% similarity with 98.7% confidence. Put plainly, the copy is built almost the same way as the original. “That is a statement about shape,” the researchers explained.
Intezer checked behavior separately. Its harness, the automated setup that runs the agents and tools, compared each rebuilt function with its original using Binary Ninja’s high-level intermediate language, a readable translation of machine code.
Slack and Finder still have gaps
Claude dug through Slack’s minified client code to identify the third-party libraries inside it. The client contains more than 500,000 functions, most of them from those libraries. Slack’s server is not downloadable, so the agents built a Slack-compatible one on SQLite, guided by network inspection of the real Slack app and Slack’s documentation.
Finder, a 25.8 MB executable, still has gaps around online-only files, sync status and actions that depend on other macOS services. Intezer did not publish how long the rebuilds took or what they cost.
Obfuscation is the suggested defense
Intezer’s advice is to use encryptors and obfuscators, tools that scramble code so it is harder to read. The researchers say these “raise the bar” for AI agents. “The software industry will have to adjust,” they wrote.
