const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/AI-TOOLS" date="2026-09-02" title="The model is a router, not IDA" lede="Paste a function, not a firmware. Assign a lane, not a personality. If the agent picks jadx on an ELF, you do not have an analyst. You have a guess."/>
<P>AI-on-the-desk is not “ChatGPT but for binaries.” It is a router with a scope gate, then a small window of text, then a human. The models we actually run are listed on <a href="models.html">/models</a>. How we score them is <a href="post-re-eval.html">four numbers</a>, not a vibe.</P>
<H2>What we paste</H2>
<Ul items={[
'A function the static pass already isolated.',
'A calling convention question.',
'A diff of two confirmed layouts.',
'A protocol snippet we already extracted, not the whole PCAP.'
]}/>
<P>What we do not paste: the customer’s firmware into a consumer chatbot. Samples stay in the tenant. If the model vendor is Bedrock, that is because the tenant required in-region, not because Grok was “worse at ARM.”</P>
<H2>What the model is good at</H2>
<P>Naming a plausible struct from a confirmed access pattern. Drafting a parser in Python once offsets are known. Summarizing a 200-line decompiler dump you already trust. Routing: APK → jadx skill, ELF → Ghidra skill, “this looks packed” → stop and say packed.</P>
<H2>What it is bad at</H2>
<P>Being Hex-Rays. Inventing xrefs it did not see. Declaring a vulnerability from a screenshot. Completing a CTF when the harness will not open the file. If you want a leaderboard, use someone else’s. Ours stays empty where we did not measure.</P>
<Callout>Opus 5 on owned samples. Fable 5.1 if the prompt stays on Fable. gpt-daybreak-blue for verified-defender malware triage, not general Sol. Grok 4.6 only behind the same harness. Details: <a href="post-re-models.html">six models</a>.</Callout>
<H2>The router, in one picture</H2>
<Code lang="route.txt">{`scope file exists?  no  → refuse
file(1) / apk / elf / blob
   APK  → jadx + native .so desk
   ELF  → Ghidra/IDA, then Unicorn
   bin  → unblob first
model sees the slice, not the image
human owns the finding`}</Code>
<P>That router is a skill we run locally — <a href="post-skill.html">reverse-skill</a>. If your “AI RE tool” cannot refuse, it is not a tool. It is autocomplete with liability.</P>
<Related items={[
['post-re-models.html','Six models on the desk'],
['post-re-eval.html','Scoring RE agents'],
['post-skill.html','A router for RE agents'],
['models.html','Models we run']
]}/>
</>;
}
window.Article=Article;
mountPost();