AI reverse engineering let researchers add a new feature to Slack
AI agents reverse-engineered Slack, Apple Finder, and TinyTurla-NG malware.
Intezer researchers utilized AI agents to reconstruct source code for Slack, Apple's Finder, and a TinyTurla-NG malware sample. The rebuilt Slack application was functional enough for the researchers to add a new AI-powered text autocomplete feature. This research demonstrates that software vendors relying on compilation for source code privacy are vulnerable, as the same AI methods can be used to analyze commercial applications and malware.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco Talos?
Get an email when a new story names Cisco Talos, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers demonstrated that AI agents can reconstruct functional source code from compiled binaries of commercial software like Slack and Apple Finder, effectively nullifying the assumption that compilation alone protects intellectual property or hides implementation details. The rebuilt Slack binary was functional enough to add new features, proving that threat actors could use the same techniques to identify hidden vulnerabilities, bypass security controls, or introduce malicious modifications. This matters because many vendors and security teams implicitly rely on 'security through obscurity' via compiled code, without layering additional protections. The same capability that reconstructed Slack could be turned on proprietary security tools, embedded firmware, or malware to accelerate exploitation.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — TinyTurla-NG